Network security data association analysis method and device, electronic equipment and storage medium

Abstract

The invention provides a network security data association analysis method and apparatus, an electronic device and a storage medium. The method comprises the steps of obtaining target network security data; constructing a knowledge graph based on the target network security data; performing network security risk analysis based on the knowledge graph to obtain a risk analysis result; and constructing a multi-dimensional analysis view based on the knowledge graph and the risk analysis result, and visually displaying the multi-dimensional analysis view. According to the network security data association analysis method provided by the invention, a closed-loop analysis result is formed with vulnerability data, a three-layer knowledge graph of the vulnerability data, asset data and threat data is constructed, the problem of data islands caused by data acquisition of different data sources is broken through, deep integration and dynamic analysis of multi-dimensional data are realized, and the network security data association analysis efficiency is improved. The network security risk analysis is further realized through the association relationship in the knowledge graph, and the intelligent level of the network security data association analysis is improved, so that the efficiency and accuracy of the network security data association analysis are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security data association analysis method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of informatization, the network security situation is becoming increasingly severe, and cyberspace security threats are becoming more diverse and complex. When faced with a large amount of network security vulnerability data, enterprises and institutions need an efficient and accurate analysis method. At present, network vulnerability analysis mostly relies on standardized vulnerability databases and traditional rule matching and static analysis methods. These methods are usually based on static rules or predefined classification algorithms, and mainly rely on manual association or rule base maintenance to screen vulnerability data and analyze the relationship between vulnerability data and target objects.

[0003] Therefore, existing technologies mostly rely on rule matching and static analysis methods, and rely on manual intervention for data screening and analysis, which requires a lot of labor costs to maintain and makes it difficult to achieve automated correlation analysis of the relationship between vulnerabilities and target objects. Summary of the invention

[0004] The present invention provides a network security data association analysis method, device, electronic device and storage medium, which are used to solve the problem that it is difficult to realize automated association analysis in existing network vulnerability analysis.

[0005] In a first aspect, the present invention provides a network security data association analysis method, comprising: Obtain target network security data; the target network security data at least includes target vulnerability data, target asset data and target threat data; Based on the target network security data, construct a knowledge graph; Performing network security risk analysis based on the knowledge graph to obtain risk analysis results; Based on the knowledge graph and the risk analysis results, a multi-dimensional analysis view is constructed, and the multi-dimensional analysis view is visualized.

[0006] In one embodiment, constructing a knowledge graph based on the target network security data includes: Constructing multiple types of entities; the multiple types of entities at least include vulnerability entities, asset entities and threat entities; Determining the relationship between the multiple types of entities according to the target vulnerability data, the target asset data, and the target threat data; Determine each of the entities as a node, and determine each of the relationships as an edge; Determining a node attribute of each of the nodes and an edge attribute of each of the edges according to the target vulnerability data, the target asset data, and the target threat data; Constructing a plurality of triples according to each of the nodes and each of the edges; A knowledge graph is constructed based on each of the triples, each of the node attributes, and each of the edge attributes.

[0007] In one embodiment, the network security risk analysis is performed based on the knowledge graph to obtain a risk analysis result, including: Performing graph algorithm analysis based on the knowledge graph to obtain explicit relationship analysis results; Based on the explicit relationship analysis result and the knowledge graph, an analysis is performed through a graph neural network to obtain an implicit relationship reasoning result; A network security risk analysis is performed based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain a risk analysis result.

[0008] In one embodiment, the graph algorithm analysis is performed based on the knowledge graph to obtain the explicit relationship analysis result, including: Performing node importance evaluation on each node in the knowledge graph to obtain key node identification results; Performing attack route analysis on the knowledge graph to obtain explicit attack route analysis results; Performing community detection on the knowledge graph to obtain detection results of asset groups with shared risks; At least one of the key node identification result, the explicit attack route analysis result, and the asset group detection result is determined as an explicit relationship analysis result.

[0009] In one embodiment, the analysis based on the explicit relationship analysis result and the knowledge graph is performed through a graph neural network to obtain an implicit relationship reasoning result, including: Determine structured data in the knowledge graph; the structured data includes node features and edge features; The explicit relationship analysis result and the structured data are input into a graph neural network model to obtain an implicit relationship reasoning result output by the graph neural network model; the implicit relationship reasoning result includes at least one of a multi-hop association path and a potential threat pattern.

[0010] In one embodiment, the network security risk analysis is performed based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain the risk analysis result, including: Predicting an attack route based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain an implicit attack route analysis result; Determining the risk levels of the target asset data, the explicit attack route analysis results, and the implicit attack route analysis results according to the explicit relationship analysis results, the implicit relationship reasoning results, and the implicit attack route analysis results; Perform risk propagation analysis based on the explicit relationship analysis result, the implicit relationship reasoning result, and the implicit attack route analysis result to obtain a risk propagation analysis result; At least one of the hidden attack route analysis result, each of the risk levels, and the risk propagation analysis result is determined as a risk analysis result.

[0011] In one embodiment, constructing a multi-dimensional analysis view based on the knowledge graph and the risk analysis result, and visually displaying the multi-dimensional analysis view includes: Based on the knowledge graph and the risk analysis result, a three-layer relationship diagram, a risk heat map and a timeline diagram are constructed respectively; the three-layer relationship diagram is used to display the association relationship between the target vulnerability data, the target asset data and the target threat data; the risk heat map is used to display the risk level of the target asset data; the timeline diagram is used to display the propagation trend of the target vulnerability data and the target threat data; At least one of the three-layer relationship diagram, the risk heat map and the timeline diagram is determined as a multi-dimensional analysis view, and the multi-dimensional analysis view is visualized.

[0012] In a second aspect, the present invention further provides a network security data association analysis device, comprising: An acquisition module, used to acquire target network security data; the target network security data at least includes target vulnerability data, target asset data and target threat data; A knowledge graph construction module, used to construct a knowledge graph based on the target network security data; A risk analysis module, used to perform network security risk analysis based on the knowledge graph to obtain risk analysis results; A visualization display module is used to construct a multi-dimensional analysis view based on the knowledge graph and the risk analysis results, and to visualize the multi-dimensional analysis view.

[0013] In a third aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the network security data association analysis method as described above are implemented.

[0014] In a fourth aspect, the present invention further provides a computer-readable storage medium, comprising a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the network security data association analysis method as described in any one of the above are implemented.

[0015] The network security data association analysis method, device, electronic device and storage medium provided by the present invention expand asset data and threat data to form a closed-loop analysis result with vulnerability data, construct a knowledge graph of the three-layer relationship between vulnerability data, asset data and threat data, break through the data island problem caused by collecting data from different data sources, realize deep integration and dynamic analysis of multi-dimensional data, analyze the association relationship between vulnerability data, asset data and threat data, further realize network security risk analysis through the association relationship existing in the knowledge graph, improve the intelligence level of network security data association analysis, thereby improving the efficiency and accuracy of network security data association analysis, and by constructing a multi-dimensional analysis view, intuitively display the analysis results, improve the readability and guidance of the analysis results, and help users fully grasp the network security situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flow chart of the network security data association analysis method provided by the present invention.

[0018] Figure 2 It is a schematic diagram of a three-layer relationship diagram provided by the present invention.

[0019] Figure 3 It is a schematic diagram of the risk heat map provided by the present invention.

[0020] Figure 4 It is a schematic diagram of the timeline diagram provided by the present invention.

[0021] Figure 5 It is a structural schematic diagram of the network security data association analysis device provided by the present invention.

[0022] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] The terms "first", "second", etc. in the present invention are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein.

[0025] Combine the following Figure 1-Figure 6 The present invention describes the network security data association analysis method, device, electronic device and storage medium provided by the present invention.

[0026] It should be noted that the network security data association analysis method provided in the embodiment of the present invention is implemented based on the network security data association analysis device. The network security data association analysis method provided in the embodiment of the present invention mainly includes five steps: network security data collection and preprocessing, knowledge graph construction, association analysis and reasoning, visualization display, real-time update and expansion. In the process of network security data collection and preprocessing, network security data from multiple sources are captured and data preprocessing is performed to ensure the accuracy and consistency of the data; in the process of knowledge graph construction, it is responsible for data modeling of vulnerability data, asset data, and threat data in network security data, and constructs a multidimensional knowledge graph based on entity-relationship to form a knowledge graph, covering vulnerability nodes, asset nodes, threat nodes and the relationship between them; in the process of association analysis and reasoning, the explicit relationship and potential association between vulnerabilities, assets and threats are analyzed, and attack reasoning is performed in combination with explicit relationships and potential associations; in the process of visualization display, the analysis results are displayed in a graphical form, and a variety of visualization effects are provided to help users quickly understand the association relationship between data; in the process of real-time update and expansion, based on the streaming processing framework, dynamic data updates are supported to ensure the real-time nature of graph content and reasoning content.

[0027] The embodiment of the present invention describes the network security data association analysis method by taking a network security data association analysis device as an example of an execution subject.

[0028] Combination Figure 1 , Figure 1 It is a flow chart of the network security data association analysis method provided by the present invention.

[0029] like Figure 1 As shown, the method includes the following: Step 101: Obtain target network security data; Step 102: construct a knowledge graph based on the target network security data; Step 103: Perform network security risk analysis based on the knowledge graph to obtain risk analysis results; Step 104: Based on the knowledge graph and the risk analysis results, a multi-dimensional analysis view is constructed, and the multi-dimensional analysis view is visualized.

[0030] It should be noted that all actions of acquiring signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located, and with the authorization given by the owner of the corresponding device.

[0031] Specifically, to ensure the diversity and coverage of network security data sources, vulnerability data, asset data, and threat data are extracted from multi-source data, such as open standard vulnerability libraries, threat intelligence platforms, enterprise asset lists, attack events, and attack logs. At the same time, in terms of data collection, ensure that vulnerability data covers the description of the vulnerability, the scope of impact, the way it is used, and related asset and threat information. Data from different sources are in various formats, such as JSON, CSV, text, etc., including structured data and unstructured data. For structured data, you can use Python to write automated scripts to capture Application Programming Interface (API) data. For free text content of unstructured data, you can combine crawler tools (such as Scrapy) to capture it.

[0032] Since the data formats obtained from multiple sources are diverse, it is necessary to preprocess the data and unify it into a standardized format to obtain the target network security data after data processing, including target vulnerability data, target asset data and target threat data. The data preprocessing process includes data cleaning, data standardization, data classification and other processes.

[0033] 1. Data cleaning: (1) Redundant data deduplication: Deduplication of the same data from different sources, while comparing key field information to identify duplicate records.

[0034] (2) Error and anomaly detection: Identify missing fields and abnormal values ​​in the data (such as invalid timestamps and meaningless characters). Use data filling algorithms to handle small-scale missing fields and directly mark large-scale anomalies.

[0035] 2. Data standardization: (1) Field unification: Map the fields of each source data to a unified structured table, and the time needs to be in a unified format (such as ISO8601 standard). The example is as follows: Vulnerability: number, impact, Common Vulnerability Scoring System (CVSS) score, repair suggestions, and level; Asset: name, Internet Protocol (IP) address, operating environment, importance level; Threat: attacker IP, tool name, attack time.

[0036] (2) Unstructured data processing: Use natural language processing techniques (e.g., SpaCy, BERT) to extract entities and relations from vulnerability descriptions; Entity: vulnerability number, vulnerability impact scope (such as operating system, application version, etc.); Relationship: influence, utilization, dependence, etc.

[0037] 3. Data classification: Vulnerability data can be classified according to its semantic features, exploitation methods, impact scope, threat level and other dimensions. Machine learning algorithms (such as SVM and KNN algorithms) or rule bases can be used for preliminary classification. The classification results of vulnerability data for semantic features, exploitation methods, impact scope, threat level and other dimensions can be used as entity attributes in the subsequent construction of knowledge graphs.

[0038] After completing a series of data preprocessing and unified formatting processes, the data can be stored. For storage methods, different data structures should adopt corresponding storage methods. Structured data: stored in relational databases (such as MySQL, PostgreSQL); Graph data: stored in graph databases (such as Neo4j), which is convenient for storage after subsequent knowledge graph construction; Streaming data: stored in real time in distributed storage platforms (such as Elasticsearch, HDFS).

[0039] Furthermore, the goal of constructing the indication graph is clarified, requiring the indication graph to cover key entities such as vulnerabilities, assets, and threats, and to describe the semantic associations between the three through relationships. It is also required that the constructed knowledge graph supports real-time updates of dynamic queries and adapts to the needs of association analysis of multi-source and multi-dimensional data. According to the goal of graph construction, based on the target network security data, vulnerability entities, asset entities, and threat entities are constructed, the semantic associations between multiple types of entities are determined, and a knowledge graph is constructed.

[0040] At the same time, we optimize the graph storage and query. We select efficient graph databases (such as Neo4j and TigerGraph) to support fast construction and flexible query; we optimize the index and query statements of the graph database to ensure high performance. In addition, we require the construction of knowledge graphs to support dynamic update mechanisms, design real-time data inflow mechanisms, ensure that graph content is synchronized with data sources, and introduce data verification and conflict resolution logic to avoid redundancy and errors.

[0041] Furthermore, for the constructed knowledge graph, firstly, the global or local structure of the graph is analyzed through preliminary analysis based on the graph algorithm. Then, based on the preliminary analysis results of the graph algorithm, the graph structure data and preliminary analysis results are input into the graph neural network through deep reasoning of the graph neural network. Through multi-layer information aggregation and learning, the feature representation of the node is extracted and the implicit analysis results are output. Finally, based on the preliminary analysis results of the graph algorithm and the implicit analysis results of the deep reasoning of the graph neural network, the possible associations of entity keys that are not explicitly defined are predicted and implicit relationships are mined. Finally, the importance of nodes and relationships is updated in real time based on the analysis results, dynamic prediction and association updates are supported, and a dynamic adjustment basis is provided for security protection strategies.

[0042] Furthermore, through the front-end and back-end separation technology framework and tools, multi-dimensional network security data display can be achieved, supporting multi-level presentation, interactivity and dynamic forms.

[0043] In terms of technical framework and tools, the front-end uses libraries such as D3.js and Cytoscape.js to build an interactive graphical interface, and the back-end uses graph databases such as Neo4j to provide efficient query support.

[0044] In terms of multi-dimensional data display, the relationship between vulnerabilities, assets, and threats can be mapped to intuitively display the relationship between nodes, and on this basis, network security risks can be analyzed. According to the risk analysis results and knowledge maps, multi-dimensional analysis views can be constructed, such as three-layer relationship diagrams, risk heat maps, and timeline diagrams, and visualized according to different dimensional analysis views. Through different visualization methods, multi-dimensional and multi-level analysis needs can be met.

[0045] In terms of multi-level presentation, it supports a global perspective that displays the overall network security situation and highlights key vulnerabilities, assets, and threats, and supports a local perspective for quick decision-making.

[0046] In terms of interactivity and dynamism, it supports dynamic interaction of users with graphics, such as zooming, filtering, and dragging, which facilitates in-depth exploration of specific information, and can achieve real-time updates to dynamically reflect changes in data.

[0047] After completing the network security data correlation analysis and visual display, it supports dynamic data update and expansion to ensure the real-time nature of the graph content and reasoning content.

[0048] The goal of implementing updates and expansions is to achieve dynamic synchronization of knowledge graph content and reasoning content through streaming data processing frameworks (such as Kafka and Flink) to ensure the real-time and accuracy of analysis results. Based on the streaming data processing framework, it receives multi-source real-time data streams and dynamically updates the nodes, relationships, and attributes in the graph. At the same time, it supports automatic data cleaning, conflict detection, and verification to ensure data integrity and consistency. In addition, it also has the ability to expand, and can add new data sources and expand the graph structure according to needs to achieve rapid response to new threats.

[0049] The network security data association analysis method provided by the present invention expands asset data and threat data to form a closed-loop analysis result with vulnerability data, constructs a knowledge graph of the three-layer relationship between vulnerability data, asset data and threat data, breaks through the data island problem caused by collecting data from different data sources, realizes the deep integration and dynamic analysis of multi-dimensional data, analyzes the association relationship between vulnerability data, asset data and threat data, further realizes network security risk analysis through the association relationship existing in the knowledge graph, improves the intelligence level of network security data association analysis, thereby improving the efficiency and accuracy of network security data association analysis, and by constructing a multi-dimensional analysis view, intuitively displays the analysis results, improves the readability and guidance of the analysis results, and helps users fully grasp the network security situation.

[0050] In some embodiments, based on step 102, constructing a knowledge graph based on the target network security data includes: Constructing multiple types of entities; the multiple types of entities at least include vulnerability entities, asset entities and threat entities; Determining the relationship between the multiple types of entities according to the target vulnerability data, the target asset data, and the target threat data; Determine each of the entities as a node, and determine each of the relationships as an edge; Determining a node attribute of each of the nodes and an edge attribute of each of the edges according to the target vulnerability data, the target asset data, and the target threat data; Constructing a plurality of triples according to each of the nodes and each of the edges; A knowledge graph is constructed based on each of the triples, each of the node attributes, and each of the edge attributes.

[0051] Specifically, a multi-type entity is constructed, and the multi-type entity includes at least a vulnerability entity, an asset entity, and a threat entity, and the relationship between the vulnerability entity, the asset entity, and the threat entity is determined according to the target vulnerability data, the target asset data, and the target threat data.

[0052] In one embodiment, entity types are defined: vulnerability entity: such as CVE-2024-1234; asset entity: such as "Server-01", "Database-02"; threat entity: such as "Attacker-IP1", "Exploit-Tool".

[0053] Relationship type: impact, exploit, dependency, etc. "Impact" can represent the relationship between vulnerability entity and asset entity; "exploitation" can represent the relationship between threat entity and vulnerability entity; "dependency" can represent the dependency relationship between assets.

[0054] Vulnerability entities, asset entities, and threat entities are all identified as nodes required for constructing a knowledge graph, and the relationships between vulnerability entities, asset entities, and threat entities are all identified as edges required for constructing a knowledge graph.

[0055] At the same time, it is also necessary to determine the node attributes of each node and the edge attributes of each edge based on the target vulnerability data, target asset data and target threat data.

[0056] In one embodiment, each entity and relationship should include its attributes, such as: node attributes: vulnerability (CVSS score), asset (operating environment), threat (attack tool); edge attributes: relationship confidence, timestamp.

[0057] Construct multiple triplets based on each node and each edge.

[0058] In one embodiment, a triple (entity-relationship-entity) is used to represent the graph content. For example: (CVE-2024-1234, impact, Server-01); (Attacker-IP1, exploit, CVE-2024-1234); (Server-01, dependency, Database-02).

[0059] According to each triple, each node attribute and each edge attribute, a knowledge graph is constructed and stored in a graph database, such as Neo4j. Data can be stored in RDF format using RDFlib or directly imported into Neo4j.

[0060] The embodiment of the present invention expands the asset and threat nodes, forms a closed-loop analysis structure with the vulnerability nodes, constructs a three-layer knowledge graph of vulnerabilities, assets and threats, breaks through the data island problem caused by collecting data from different data sources, realizes the deep integration and dynamic analysis of multi-dimensional data, and dynamically analyzes the correlation between the three, thereby improving the efficiency and accuracy of network security data correlation analysis.

[0061] In some embodiments, based on step 103, the network security risk analysis is performed based on the knowledge graph to obtain a risk analysis result, including: Performing graph algorithm analysis based on the knowledge graph to obtain explicit relationship analysis results; Based on the explicit relationship analysis result and the knowledge graph, an analysis is performed through a graph neural network to obtain an implicit relationship reasoning result; A network security risk analysis is performed based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain a risk analysis result.

[0062] Specifically, graph algorithms, such as the shortest path, PageRank, and community detection algorithms, are used to perform global or local structural graph analysis on the knowledge graph to obtain explicit relationship analysis results in the knowledge graph.

[0063] Furthermore, based on the knowledge graph and the results of explicit relationship analysis therein, through deep reasoning based on graph neural network, that is, taking the knowledge graph and the results of explicit relationship analysis as input data, inputting them into graph neural network (such as GraphSAGE, GCN), through multi-layer information aggregation and learning, extracting the feature representation of the nodes, and outputting the implicit relationship reasoning results in the knowledge graph.

[0064] Furthermore, network security risk analysis is performed based on the explicit analysis results and implicit relationship reasoning results, possible associations between entities that are not explicitly defined are predicted, implicit relationships are mined, and risk analysis results are obtained, such as attack routes, risk levels, risk propagation chains, etc.

[0065] The embodiment of the present invention uses the analysis of graph algorithms as a basis to extract explicit relationships in the knowledge graph, provide a preliminary understanding of the graph structure, and then further explore potential complex relationships based on the basic analysis based on the deep reasoning of the graph neural network, generate semantically rich association information, and finally integrate the explicit analysis results and the implicit analysis results to analyze network security risks and provide a decision-making basis for security protection. This hierarchical logic not only reflects the depth of the analysis, but also ensures the coordination between each step of the analysis process, and ultimately achieves comprehensive and accurate association analysis and reasoning.

[0066] According to the above content, the graph algorithm analysis based on the knowledge graph is performed to obtain the explicit relationship analysis results, including: Performing node importance evaluation on each node in the knowledge graph to obtain key node identification results; Performing attack route analysis on the knowledge graph to obtain explicit attack route analysis results; Performing community detection on the knowledge graph to obtain detection results of asset groups with shared risks; At least one of the key node identification result, the explicit attack route analysis result, and the asset group detection result is determined as an explicit relationship analysis result.

[0067] Specifically, the importance of each node in the knowledge graph can be evaluated by using the PageRank algorithm to identify key nodes, that is, high-influence nodes. Nodes with higher weights play a key role in attacks or have an important position in propagating risks. High-influence nodes may be key vulnerabilities or key assets.

[0068] Furthermore, the attack route analysis of the knowledge graph can be performed by using the shortest path algorithm, Dijkstra algorithm, etc. to analyze the explicit attack routes in the knowledge graph, such as the path length of the shortest attack path from the threat source IP to the key assets, the nodes and edges passed through, and other detailed information.

[0069] Furthermore, community detection can be performed on the knowledge graph using the Louvain algorithm, GN algorithm, etc., to divide the nodes in the knowledge graph into communities, identify asset clusters, analyze the local network affected by vulnerabilities, and find asset groups that share similar risks. Since each cluster is a group of assets with similar characteristics, they may be affected by risks at the same time when facing similar risks.

[0070] Further, at least one of the key node identification result, the explicit attack route analysis result and the asset group detection result is determined as the explicit relationship analysis result.

[0071] The embodiment of the present invention analyzes the knowledge graph through a graph algorithm, extracts the explicit relationships in the knowledge graph, achieves a preliminary understanding of the graph structure, effectively identifies key nodes, reveals explicit attack routes, and detects asset groups with shared risks, providing basic information for further in-depth information mining.

[0072] According to the above content, the implicit relationship reasoning results are obtained by analyzing the explicit relationship analysis results and the knowledge graph through the graph neural network, including: Determine structured data in the knowledge graph; the structured data includes node features and edge features; The explicit relationship analysis result and the structured data are input into a graph neural network model to obtain an implicit relationship reasoning result output by the graph neural network model; the implicit relationship reasoning result includes at least one of a multi-hop association path and a potential threat pattern.

[0073] Specifically, the structured data in the knowledge graph is determined, where the structured data includes node features and edge features, such as vulnerability descriptions and asset attributes, and edge features such as the association weight between vulnerabilities and assets. These structured data and explicit relationship analysis results are normalized to eliminate the influence of different dimensions. Feature engineering methods can also be used to enhance the expressiveness of features and provide input for graph neural networks.

[0074] Furthermore, the explicit relationship analysis results and structured data are input into the graph neural network model. The graph neural network model captures the potential implicit relationships based on the contextual information of the input data, and finally outputs the implicit relationship reasoning results, which specifically include one of the multi-hop association paths and potential threat patterns. Of course, it can also include other implicit reasoning results, such as embedded representations of important nodes.

[0075] For multi-hop association paths, the node representations learned by graph neural networks are used to infer node pairs in the knowledge graph that are not directly connected but connected through multi-hop relationships, thereby identifying potential multi-hop attack paths or information propagation paths.

[0076] For potential threat patterns, the graph neural network model is used to mine abnormal patterns or potential threat patterns in the knowledge graph, including but not limited to new attack methods, hidden transmission channels, potential internal threats, etc.

[0077] Based on the basic analysis, the embodiments of the present invention further mine the potential complex relationships in the knowledge graph according to the explicit analysis results, generate semantically rich association information, reveal multi-hop association paths and potential threat patterns, and enhance the ability to identify complex attack patterns and predict unknown threats.

[0078] According to the above content, the network security risk analysis is performed based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain the risk analysis result, including: Predicting an attack route based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain an implicit attack route analysis result; Determining the risk levels of the target asset data, the explicit attack route analysis results, and the implicit attack route analysis results according to the explicit relationship analysis results, the implicit relationship reasoning results, and the implicit attack route analysis results; Perform risk propagation analysis based on the explicit relationship analysis result, the implicit relationship reasoning result, and the implicit attack route analysis result to obtain a risk propagation analysis result; At least one of the hidden attack route analysis result, each of the risk levels, and the risk propagation analysis result is determined as a risk analysis result.

[0079] Specifically, attack route prediction is performed based on the results of explicit relationship analysis and implicit relationship reasoning. That is, by utilizing the key nodes, explicit attack routes or asset groups in the explicit relationship analysis results, combined with multiple associated paths and potential threat patterns in the implicit relationship reasoning results, potential attack paths can be predicted by simulating attack scenarios to obtain implicit attack route analysis results.

[0080] In one embodiment, the result is as follows: Starting point: attacker IP; End point: database server; Speculated hidden attack path: attacker IP -> SQL vulnerability -> application server -> database server.

[0081] Furthermore, the risk levels of the target asset data, the explicit attack route analysis results, and the implicit attack route analysis results are determined based on the explicit relationship analysis results, the implicit relationship reasoning results, and the implicit attack route analysis results. The risk level can be assessed based on the importance and sensitivity of the target asset data and its role in the organization, combined with factors such as the severity, attack difficulty, and impact range of the explicit and implicit attack routes. The levels can be divided into low risk, medium risk, and high risk. Low risk means a low probability of attack and a small impact; medium risk means a medium probability of attack and a certain impact; high risk means a high probability of attack and a serious impact.

[0082] Furthermore, risk propagation analysis is performed based on the explicit relationship analysis results, implicit relationship reasoning results, and implicit attack route analysis results to obtain risk propagation analysis results. The scope, path, and speed of risk propagation can be evaluated by simulating the process of extending a vulnerability from one node to the entire network and combining the explicit relationship analysis results, implicit relationship reasoning results, and implicit attack route analysis results obtained above.

[0083] Further, at least one of the hidden attack route analysis result, each risk level and the risk propagation analysis result is determined as the risk analysis result.

[0084] The embodiment of the present invention integrates the explicit relationship analysis results and the implicit relationship reasoning results to achieve comprehensive network security risk analysis, effectively predict the implicit attack routes, accurately assess the risk level, and deeply analyze the risk propagation situation, which greatly improves the predictability and accuracy of network security data association analysis and provides a decision-making basis for security protection.

[0085] In some embodiments, based on step 104, constructing a multi-dimensional analysis view based on the knowledge graph and the risk analysis result, and visually displaying the multi-dimensional analysis view includes: Based on the knowledge graph and the risk analysis result, a three-layer relationship diagram, a risk heat map and a timeline diagram are constructed respectively; the three-layer relationship diagram is used to display the association relationship between the target vulnerability data, the target asset data and the target threat data; the risk heat map is used to display the risk level of the target asset data; the timeline diagram is used to display the propagation trend of the target vulnerability data and the target threat data; At least one of the three-layer relationship diagram, the risk heat map and the timeline diagram is determined as a multi-dimensional analysis view, and the multi-dimensional analysis view is visualized.

[0086] In order to realize the multi-dimensional network security data display, a multi-dimensional analysis view is constructed, including a three-layer relationship diagram, a risk heat map and a timeline diagram. The multi-dimensional analysis view is visualized to help users quickly understand the correlation analysis results between multi-dimensional network security data. Figure 2-Figure 4 , Figure 2 is a schematic diagram of a three-layer relationship diagram provided by the present invention, Figure 3 is a schematic diagram of a risk heat map provided by the present invention, Figure 4 It is a schematic diagram of the timeline diagram provided by the present invention.

[0087] Specifically, based on the knowledge graph, a three-layer relationship graph (vulnerability-asset-threat) is constructed. Figure 2 As shown, nodes use different shapes and colors to distinguish vulnerabilities, assets, and threats, edges use lines to represent relationships, and the thickness and color of the line represent the weight or strength of the relationship.

[0088] The three-layer relationship diagram shows the overall structure and explicit associations of vulnerabilities, assets, and threats in the knowledge graph. It is a global display view that helps users understand the overall associations between entities in the system and answer questions such as "which assets are related to which vulnerabilities overall, and which threats may affect which targets". Functions of the global view: 1. It can focus on the overall network security situation; 2. It displays key entities (assets, vulnerabilities, threats) and their explicit relationship networks; 3. It provides users with a macro security threat situation.

[0089] At the same time, a risk heat map will be constructed based on the risk analysis results. Figure 3 As shown, the risk level of different assets is represented by color depth, helping users quickly identify high-risk areas. The horizontal axis represents the asset category or geographical location, and the vertical axis represents the risk level (low, medium, high). The color gradient is from green (low risk) to red (high risk).

[0090] The risk heat map shows the exposure risk level of assets, quantifying and grading them according to the distribution of vulnerabilities and their severity. It focuses on localized and detailed analysis, using colors and data indicators to intuitively express the risk status of a specific area or node.

[0091] Functions of local view: 1. Conduct risk analysis for specific assets or areas; 2. Assist users to understand the distribution and potential impact of high-risk assets; 3. Provide in-depth analysis capabilities for single key assets.

[0092] At the same time, a timeline diagram will be constructed based on the explicit relationship analysis results, implicit relationship reasoning results, and risk analysis results. Figure 4 As shown in the figure, the propagation trend of the vulnerability and the time nodes of the attack events are dynamically displayed. The timeline represents the time as the horizontal axis, marking the key events (such as vulnerability discovery, exploitation, and repair). The event node represents the event type with an icon, and the size represents the degree of impact.

[0093] The timeline diagram shows the vulnerability propagation trend, the evolution of the threat chain, and the time series dynamics of the attack path. It can be limited to a local view to analyze a certain node (such as how a single vulnerability affects multiple assets), or it can be expanded to a global view to show the propagation trend of threats in the entire system.

[0094] Functions of dynamic views: 1. Analyze the time evolution of vulnerabilities and threats; 2. Track key nodes in the attack path and their time impact; 3. Provide decision-making basis for taking preventive measures.

[0095] Furthermore, at least one of the three-layer relationship diagram, the risk heat map and the timeline diagram is determined as a multi-dimensional analysis view, and the multi-dimensional analysis view is visualized.

[0096] In general, the global view (corresponding to the three-layer relationship diagram) shows the overall situation of all major entities and relationships in the system; the local view (corresponding to the risk heat map) focuses on the risk analysis of specific areas or assets; the dynamic view (corresponding to the timeline diagram) connects the global and the local, emphasizing the dynamic changes in the time dimension.

[0097] In addition to the visualization function, users can click and drag nodes on the visualization to view detailed properties and relationships, and it also provides filtering functions (such as filtering by risk level and relationship type). In addition, it will obtain real-time updated data from the backend through WebSocket or API to dynamically refresh the visualization.

[0098] Through multi-dimensional analysis views, the embodiments of the present invention allow users to fully understand the network security situation and potential threats in the system from three levels: macro (global), micro (local), and time series (dynamic).

[0099] After completing the network security data association analysis and visual display, dynamic data update and expansion are supported to ensure the real-time nature of the graph content and reasoning content. The following describes the process.

[0100] 1. Data collection and access: Real-time data sources: including vulnerability databases, threat intelligence platforms, enterprise asset logs, network traffic data, etc. Data access mechanism: Receive real-time data streams through message queue systems such as Kafka.

[0101] 2. Data preprocessing: Data cleaning: De-duplication, format conversion, and field normalization of real-time data streams, as described above; Anomaly detection and filtering: Identify abnormal or erroneous data (such as empty fields, format errors), filter or correct them, and proceed to the next step of processing; Entity and relationship analysis: Use natural language processing technology to extract key entities and relationships from unstructured data (such as vulnerability descriptions). For example, extract key information such as "CVE number", "scope of impact" and "attack method" from the vulnerability description.

[0102] 3. Map update and expansion: Dynamic update mechanism: Dynamically modify the graph structure based on entities (such as vulnerabilities, assets, threats) and their relationships in new data. For example, when new threat intelligence is detected, a new "threat" node and its "exploitation" relationship with "vulnerability" are added.

[0103] Conflict detection and resolution: Conflict detection is performed on existing nodes and relationships in the graph. For example, if two source data have inconsistent descriptions of the impact scope of the same vulnerability, the trusted data is selected based on confidence or priority rules.

[0104] Node and relationship expansion: Supports dynamic expansion of the graph structure. For example, a new "tool" node type is introduced based on new threat intelligence to associate tools used in the attack path.

[0105] 4. Real-time reasoning and weight update: Reasoning tasks: Analyze new data based on graph algorithms to find explicit correlations. Deep reasoning is also performed on new data based on graph neural networks to find implicit correlations. Further network security risk analysis is performed by combining explicit and implicit correlations, and risk analysis results are updated in real time. For example, when new vulnerability data is added to the graph, predict the asset nodes that may be affected and what risks may be caused.

[0106] Weight adjustment: Dynamically adjust relationship weights based on new data. For example, if the latest intelligence on a threat node shows an increase in attack frequency, increase its weight in the associated path.

[0107] 5. Expansion capabilities: New data sources: support access to newly published vulnerability libraries or threat intelligence platforms.

[0108] Graph structure expansion: Dynamically adjust the graph structure according to business needs, such as adding new entity types (such as "supply chain node") and relationship types (such as "depends on").

[0109] Therefore, functions that support dynamic data updates and expansions can achieve real-time monitoring and rapid response, improve situational awareness capabilities, ensure the accuracy and timeliness of data analysis, and thus effectively improve the level of network security protection.

[0110] The network security data association analysis device provided by the present invention is described below. The network security data association analysis device described below and the network security data association analysis method described above can be referenced to each other.

[0111] Reference Figure 5 , Figure 5 It is a structural schematic diagram of the network security data association analysis device provided by the present invention.

[0112] The network security data association analysis device comprises: The acquisition module 510 acquires target network security data; the target network security data at least includes target vulnerability data, target asset data and target threat data.

[0113] The knowledge graph construction module 520 is used to construct a knowledge graph based on the target network security data.

[0114] The risk analysis module 530 is used to perform network security risk analysis based on the knowledge graph to obtain risk analysis results.

[0115] The visualization module 540 is used to construct a multi-dimensional analysis view based on the knowledge graph and the risk analysis result, and to visualize the multi-dimensional analysis view.

[0116] The network security data association analysis device provided by the present invention expands asset data and threat data to form a closed-loop analysis result with vulnerability data, constructs a knowledge graph of the three-layer relationship between vulnerability data, asset data and threat data, breaks through the data island problem caused by collecting data from different data sources, realizes the deep integration and dynamic analysis of multi-dimensional data, analyzes the association relationship between vulnerability data, asset data and threat data, further realizes network security risk analysis through the association relationship existing in the knowledge graph, improves the intelligence level of network security data association analysis, thereby improving the efficiency and accuracy of network security data association analysis, and by constructing a multi-dimensional analysis view, intuitively displays the analysis results, improves the readability and guidance of the analysis results, and helps users fully grasp the network security situation.

[0117] Furthermore, the knowledge graph construction module 520 is also used for: Constructing multiple types of entities; the multiple types of entities at least include vulnerability entities, asset entities and threat entities; Determining the relationship between the multiple types of entities according to the target vulnerability data, the target asset data, and the target threat data; Determine each of the entities as a node, and determine each of the relationships as an edge; Determining a node attribute of each of the nodes and an edge attribute of each of the edges according to the target vulnerability data, the target asset data, and the target threat data; Constructing a plurality of triples according to each of the nodes and each of the edges; A knowledge graph is constructed based on each of the triples, each of the node attributes, and each of the edge attributes.

[0118] Furthermore, the risk analysis module 530 is also used to: Performing graph algorithm analysis based on the knowledge graph to obtain explicit relationship analysis results; Based on the explicit relationship analysis result and the knowledge graph, an analysis is performed through a graph neural network to obtain an implicit relationship reasoning result; A network security risk analysis is performed based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain a risk analysis result.

[0119] Furthermore, the risk analysis module 530 is also used to: Performing node importance evaluation on each node in the knowledge graph to obtain key node identification results; Performing attack route analysis on the knowledge graph to obtain explicit attack route analysis results; Performing community detection on the knowledge graph to obtain detection results of asset groups with shared risks; At least one of the key node identification result, the explicit attack route analysis result, and the asset group detection result is determined as an explicit relationship analysis result.

[0120] Furthermore, the risk analysis module 530 is also used to: Determine structured data in the knowledge graph; the structured data includes node features and edge features; The explicit relationship analysis result and the structured data are input into a graph neural network model to obtain an implicit relationship reasoning result output by the graph neural network model; the implicit relationship reasoning result includes at least one of a multi-hop association path and a potential threat pattern.

[0121] Furthermore, the risk analysis module 530 is also used to: Predicting an attack route based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain an implicit attack route analysis result; Determining the risk levels of the target asset data, the explicit attack route analysis results, and the implicit attack route analysis results according to the explicit relationship analysis results, the implicit relationship reasoning results, and the implicit attack route analysis results; Perform risk propagation analysis based on the explicit relationship analysis result, the implicit relationship reasoning result, and the implicit attack route analysis result to obtain a risk propagation analysis result; At least one of the hidden attack route analysis result, each of the risk levels, and the risk propagation analysis result is determined as a risk analysis result.

[0122] Furthermore, the visual display module 540 is also used for: Based on the knowledge graph and the risk analysis result, a three-layer relationship diagram, a risk heat map and a timeline diagram are constructed respectively; the three-layer relationship diagram is used to display the association relationship between the target vulnerability data, the target asset data and the target threat data; the risk heat map is used to display the risk level of the target asset data; the timeline diagram is used to display the propagation trend of the target vulnerability data and the target threat data; At least one of the three-layer relationship diagram, the risk heat map and the timeline diagram is determined as a multi-dimensional analysis view, and the multi-dimensional analysis view is visualized.

[0123] It should be noted that the network security data association analysis device provided by the present invention can execute the network security data association analysis method described in any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0124] Figure 6 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the network security data association analysis method, which includes: obtaining target network security data; the target network security data at least includes target vulnerability data, target asset data and target threat data; constructing a knowledge graph based on the target network security data; performing network security risk analysis based on the knowledge graph to obtain risk analysis results; constructing a multi-dimensional analysis view based on the knowledge graph and the risk analysis results, and visually displaying the multi-dimensional analysis view.

[0125] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0126] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the network security data association analysis method provided by the above-mentioned embodiments, and the method includes: obtaining target network security data; the target network security data includes at least target vulnerability data, target asset data and target threat data; based on the target network security data, constructing a knowledge graph; based on the knowledge graph, performing network security risk analysis to obtain risk analysis results; based on the knowledge graph and the risk analysis results, constructing a multi-dimensional analysis view, and visually displaying the multi-dimensional analysis view.

[0127] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the network security data association analysis method provided in the above-mentioned embodiments, the method comprising: obtaining target network security data; the target network security data at least includes target vulnerability data, target asset data and target threat data; based on the target network security data, constructing a knowledge graph; based on the knowledge graph, performing network security risk analysis to obtain risk analysis results; based on the knowledge graph and the risk analysis results, constructing a multi-dimensional analysis view, and visually displaying the multi-dimensional analysis view.

[0128] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. Those of ordinary skill in the art may understand and implement the present invention without creative effort.

[0129] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0130] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security data association analysis method, characterized in that: include: Obtain target network security data; The target network security data includes at least target vulnerability data, target asset data and target threat data; Based on the target network security data, construct a knowledge graph; Performing network security risk analysis based on the knowledge graph to obtain risk analysis results; Based on the knowledge graph and the risk analysis results, a multi-dimensional analysis view is constructed, and the multi-dimensional analysis view is visualized.

2. The network security data association analysis method according to claim 1 is characterized in that: The step of constructing a knowledge graph based on the target network security data includes: Constructing multiple types of entities; the multiple types of entities at least include vulnerability entities, asset entities and threat entities; Determining the relationship between the multiple types of entities according to the target vulnerability data, the target asset data, and the target threat data; Determine each of the entities as a node, and determine each of the relationships as an edge; Determining a node attribute of each of the nodes and an edge attribute of each of the edges according to the target vulnerability data, the target asset data, and the target threat data; Constructing a plurality of triples according to each of the nodes and each of the edges; A knowledge graph is constructed based on each of the triples, each of the node attributes, and each of the edge attributes.

3. The network security data association analysis method according to claim 1 is characterized in that: The network security risk analysis is performed based on the knowledge graph to obtain risk analysis results, including: Performing graph algorithm analysis based on the knowledge graph to obtain explicit relationship analysis results; Based on the explicit relationship analysis result and the knowledge graph, an analysis is performed through a graph neural network to obtain an implicit relationship reasoning result; A network security risk analysis is performed based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain a risk analysis result.

4. The network security data association analysis method according to claim 3 is characterized in that: The graph algorithm analysis is performed based on the knowledge graph to obtain the explicit relationship analysis result, including: Performing node importance evaluation on each node in the knowledge graph to obtain key node identification results; Performing attack route analysis on the knowledge graph to obtain explicit attack route analysis results; Performing community detection on the knowledge graph to obtain detection results of asset groups with shared risks; At least one of the key node identification result, the explicit attack route analysis result, and the asset group detection result is determined as an explicit relationship analysis result.

5. The network security data association analysis method according to claim 4 is characterized in that: The implicit relationship reasoning result is obtained by analyzing the explicit relationship analysis result and the knowledge graph through a graph neural network, including: Determine structured data in the knowledge graph; the structured data includes node features and edge features; The explicit relationship analysis result and the structured data are input into a graph neural network model to obtain an implicit relationship reasoning result output by the graph neural network model; the implicit relationship reasoning result includes at least one of a multi-hop association path and a potential threat pattern.

6. The network security data association analysis method according to claim 5 is characterized in that: The network security risk analysis is performed based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain the risk analysis result, including: Predicting an attack route based on the explicit relationship analysis result and the implicit relationship reasoning result to obtain an implicit attack route analysis result; Determining the risk levels of the target asset data, the explicit attack route analysis results, and the implicit attack route analysis results according to the explicit relationship analysis results, the implicit relationship reasoning results, and the implicit attack route analysis results; Perform risk propagation analysis based on the explicit relationship analysis result, the implicit relationship reasoning result, and the implicit attack route analysis result to obtain a risk propagation analysis result; At least one of the hidden attack route analysis result, each of the risk levels, and the risk propagation analysis result is determined as a risk analysis result.

7. The network security data association analysis method according to any one of claims 1 to 6, characterized in that: The step of constructing a multi-dimensional analysis view based on the knowledge graph and the risk analysis result, and visually displaying the multi-dimensional analysis view includes: Based on the knowledge graph and the risk analysis result, a three-layer relationship diagram, a risk heat map and a timeline diagram are constructed respectively; the three-layer relationship diagram is used to display the association relationship between the target vulnerability data, the target asset data and the target threat data; the risk heat map is used to display the risk level of the target asset data; the timeline diagram is used to display the propagation trend of the target vulnerability data and the target threat data; At least one of the three-layer relationship diagram, the risk heat map and the timeline diagram is determined as a multi-dimensional analysis view, and the multi-dimensional analysis view is visualized.

8. A network security data association analysis device, characterized in that: include: An acquisition module, used to acquire target network security data; The target network security data includes at least target vulnerability data, target asset data and target threat data; A knowledge graph construction module, used to construct a knowledge graph based on the target network security data; A risk analysis module, used to perform network security risk analysis based on the knowledge graph to obtain risk analysis results; A visualization display module is used to construct a multi-dimensional analysis view based on the knowledge graph and the risk analysis results, and to visualize the multi-dimensional analysis view.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the network security data association analysis method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, the computer-readable storage medium comprising a non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security data association analysis method according to any one of claims 1 to 7 are implemented.

Images