Ontology-based network security knowledge graph construction method

Abstract

The invention discloses an ontology-based network security knowledge graph construction method, and relates to the field of network security, the method combines a crawler technology, an ontology technology, knowledge extraction, knowledge fusion and knowledge storage, can efficiently obtain data in the field of network security, reduces labor consumption, and provides a knowledge extraction model to improve the knowledge extraction efficiency. In the aspect of entity classification and relation extraction F1 values, compared with other models, the method has the advantage that the F1 values are improved to a certain extent. In addition, the network security data can be integrated and analyzed, intelligent retrieval of network security knowledge is achieved, and automatic updating and expansion of the atlas are achieved.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and specifically is a method for constructing a network security knowledge graph based on ontology. Background Art

[0002] With the rapid development of information technology, cyberspace is becoming more and more closely connected with the real world. However, the rapidly changing and complex network environment has led to an increasing risk of cyber attacks, which seriously threatens social stability. Knowledge graph technology can integrate information in specific fields and build fragmented knowledge into a semantic network with associations. It has been successfully applied to many fields and is a hot topic of research today. Combining knowledge graphs with the field of network security can analyze and understand the massive amount of data in cyberspace, obtain and integrate effective security knowledge, and provide support for further analysis and decision-making.

[0003] However, there are few studies on knowledge graphs in the field of network security, and they are still in their infancy. In terms of knowledge graph construction, the construction of ontology models is the basic link in building knowledge graphs, and there is no unified cyberspace ontology to refer to. At the same time, since most knowledge in the field of network security exists in the form of unstructured text and comes from a wide range of sources, there is a problem of difficulty in knowledge extraction. Existing technologies use statistical methods and rely on manual feature extraction, making it difficult to update and expand the graph autonomously and unable to be further applied. Therefore, there is still a lack of effective solutions to the problem of building knowledge graphs in the field of network security. Summary of the invention

[0004] In view of the above problems, the present invention proposes a method for constructing a network security knowledge graph based on ontology, which can integrate and analyze massive network security data, reduce manual consumption, realize intelligent retrieval of network security knowledge and automatic update and expansion of knowledge graph, and can also perform relevant applications on the constructed network security knowledge graph. The technical solution of the present invention is as follows:

[0005] A method for constructing a network security knowledge graph based on ontology, characterized by comprising the following steps:

[0006] Step 1: Determine the overall framework for building a network security knowledge graph;

[0007] Step 2: Construct a network security ontology model and determine the division of various types of entities, relationships, and attributes;

[0008] Step 3: Obtain the required basic data and perform preprocessing operations on it;

[0009] Step 4: Extract knowledge from unstructured text data. Knowledge extraction is divided into two parts: named entity recognition and relationship extraction. The model Bert-BiLSTM-MHA-CRF, which combines the BERT pre-training model, bidirectional long short-term memory network (BiLSTM), multi-head attention mechanism (Multi-headAttention) and conditional random field (CRF), is used for named entity recognition. The model Bert-SA-CNN, which combines the BERT pre-training model, self-attention mechanism (Self-Attention) and convolutional neural network (CNN), is used for relationship extraction.

[0010] Step 5: Perform knowledge fusion on structured data and unstructured data after knowledge extraction;

[0011] Step 6: Use the Neo4j graph database to store the knowledge graph in the network security field.

[0012] Preferably, the specific process of determining the overall framework for constructing the network security knowledge graph in step one is: constructing a model layer, the essence of the model layer is to establish a knowledge model of network security data, which is mainly accomplished by constructing an ontology; constructing a data layer, the data layer is responsible for processing specific multi-source heterogeneous network security data, and realizing the structuring of the knowledge graph based on the constructed model layer.

[0013] Preferably, the main sources of basic data obtained in step three are divided into two parts: intelligence information and topology information. The source of intelligence information is the open source network security reports of Tencent Security and Alibaba Cloud Security crawled by crawler scripts. This part is unstructured data. The topology information is obtained by detecting the topology and host information of the intranet environment built in VMware virtualization software through automated tools. This part of information belongs to structured data.

[0014] Furthermore, the specific process of data preprocessing is as follows: data cleaning is performed on both intelligence information and topology information to remove invalid, erroneous or redundant information in the original data; for topology information, the detected network topology and configuration information need to be instantiated through the concepts and relationships defined in the ontology, that is, to determine which entity this information belongs to and what relationship exists between them. Intelligence information does not require other operations.

[0015] Preferably, the specific process of performing named entity recognition on unstructured text in step 4 is: annotating it using the BIO annotation method to construct a corresponding entity classification data set; using the Bert-BiLSTM-MHA-CRF model to classify the entities, wherein the BERT model is used to pre-train the sequence to be annotated to generate word vectors including character level, word level and sentence level, the BiLSTM model is used to extract features from the context of the input sequence, the multi-head attention mechanism is used to capture important local features in the sequence, and the CRF model is used for label prediction; the model is trained, and the model parameters are adjusted according to the evaluation indicators of the model, and the model parameters include batch size, maximum number of training times and learning rate.

[0016] Furthermore, the evaluation indicators used by the model for named entity recognition include: precision, recall and F1 score. Precision refers to the proportion of samples predicted by the model as positive examples that are actually positive examples. Recall refers to the proportion of samples that are actually positive examples that the model correctly predicts as positive examples. F1 score is the harmonic mean of precision and recall, which is used to balance precision and recall. The specific calculation formulas for precision, recall and F1 score are as follows: Among them, TP means that the actual sample is a positive example and is also correctly predicted as a positive example, TN means that the actual sample is a negative example and is also correctly predicted as a negative example, FP means that the actual sample is a negative example and is incorrectly predicted as a positive example, and FN means that the actual sample is a positive example and is incorrectly predicted as a negative example.

[0017] Furthermore, the specific process of relation extraction for unstructured text is as follows: label the data according to the predefined relation types in the ontology model and construct the corresponding data set; use the Bert-SA-CNN model to automatically identify a certain semantic relationship between entities from unstructured data, wherein the BERT model is used to pre-train the original text data to generate high-dimensional word embeddings, the self-attention mechanism is used to enhance the ability to capture important features in the text sequence, and CNN is used to extract local features from the word vectors processed by self-attention; train the model and adjust the model parameters according to the evaluation indicators of the model. The model parameters also include batch size, maximum number of training times and learning rate, and the evaluation indicators also include precision, recall rate and F1 value.

[0018] Preferably, the main work of knowledge fusion of structured data and unstructured data after knowledge extraction in step five is to perform entity alignment. Entity alignment can eliminate entity conflicts and unclear pointing problems in heterogeneous data. The local collective entity alignment method is adopted to first calculate the weights between entities, and then obtain the similarity between entities after weighted summation, and finally perform entity alignment based on the similarity between entities.

[0019] The beneficial effects of the embodiments of the present application are as follows:

[0020] The embodiment of the present application provides a method for constructing a network security knowledge graph based on ontology by combining crawler technology, ontology technology, knowledge extraction, knowledge fusion and knowledge storage. The method can efficiently obtain data in the field of network security and reduce manual consumption. At the same time, the proposed knowledge extraction model has a certain improvement in the F1 value of entity classification and relationship extraction compared with other models. In addition, the method can also integrate and analyze network security data, realize intelligent retrieval of network security knowledge and realize automatic updating and expansion of the graph.

[0021] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 An overall framework diagram for constructing a network security knowledge graph provided in an embodiment of the present application;

[0023] Figure 2 The ontology model diagram provided for the embodiment of the present application;

[0024] Figure 3 The intranet network topology diagram provided for the embodiment of the present application;

[0025] Figure 4 A named entity recognition model diagram provided for an embodiment of the present application;

[0026] Figure 5 A relationship extraction model diagram provided for an embodiment of the present application;

[0027] Figure 6 A comparison chart of experimental results between the knowledge extraction model provided in the embodiment of the present application and other models. DETAILED DESCRIPTION

[0028] In order to make the objectives, technical solutions and advantages of the present application more clear, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0029] like Figure 1 As shown, it is an overall framework diagram of the network security knowledge graph constructed in the embodiment of the present application, which includes two components:

[0030] (1) The model layer component is the core of the cybersecurity knowledge graph. Its essence is to establish the knowledge model of cybersecurity data;

[0031] (2) Data layer components process multi-source heterogeneous network security data on the Internet and implement the structuring of the knowledge graph based on the constructed model layer.

[0032] Building a pattern layer includes the following specific steps:

[0033] (1) Step 1: Build the model layer in a top-down manner and clarify the division of entities and attributes;

[0034] (2) Step 2: Determine the relationship between entities and attributes to achieve a clear structure among entities, attributes, and relationships.

[0035] (3) Step 3: Design an ontology model to sort out massive amounts of network security data.

[0036] Building the data layer includes the following specific steps:

[0037] (1) Step 1: construct the data layer according to the bottom-up method and preprocess the acquired data;

[0038] (2) Step 2, extract knowledge from these data to obtain formalized knowledge;

[0039] (3) Step 3, perform knowledge fusion;

[0040] (4) Step 4: store the knowledge and complete the construction of the network security knowledge graph.

[0041] The ontology model designed by this method is as follows Figure 2 As shown, the ontology model is introduced next:

[0042] The ontology model is constructed from four dimensions: assets, features, attackers, and defenders. It includes three parts:

[0043] (1) Entity division. The model divides a total of 16 entities, which belong to four dimensions. The asset dimension is the basic environment of the attack target, which can be further divided into the host environment and the network environment, mainly including the administrator, host, operating system, hardware and software. The feature dimension is the basic attribute of the attack target, including the IP, port, service and network. The attacker dimension can attack a specific target, which includes the attacker, attack method, vulnerability, malware and virus. The defender dimension can take relevant measures to deal with the attacker's attack, mainly including the defender and defense method.

[0044] (2) Division of relationships: Determine the relationships between entities within and between dimensions for each of the four dimensions. Combined with the relationships within and outside the dimensions, the relationship set of this model is {manage, exist, own, expose, utilize, repair, use, belong to, clear, and kill};

[0045] (3) Attribute division: For the host entity in the asset dimension and the vulnerability entity in the attacker dimension, attribute division is performed to clarify the relevant meaning of each attribute. The specific attribute information is shown in Table 1.

[0046] Table 1

[0047]

[0048]

[0049] This model can clarify entity types and relationships, laying the foundation for knowledge extraction.

[0050] After determining the ontology model, it is necessary to obtain basic data and perform preprocessing operations on it. The main sources of data are intelligence information and topology information. Intelligence information comes from the open source network security reports of Tencent Security and Alibaba Cloud Security crawled by crawler scripts. This part of information belongs to unstructured data. The source of topology information is the topology and host information of the intranet environment built in VMware virtualization software detected by automated tools. This part belongs to structured data. The network topology is as follows: Figure 3 As shown, the following introduces the network topology, which includes four parts:

[0051] (1) DMZ zone, consisting of HTTP server A and mail server B;

[0052] (2) Internal server area, consisting of terminals, video server C, database server D, disk storage server E and application server F;

[0053] (3) Segment I, consisting of 5 hosts;

[0054] (4) Network segment II, consisting of 5 hosts.

[0055] Data preprocessing consists of two steps:

[0056] (1) Step 1: Data cleaning is performed on both intelligence information and topology information to remove invalid, erroneous or redundant information in the original data;

[0057] (2) Step 2: For topology information, the detected network topology and configuration information are instantiated through the concepts and relationships defined in the ontology, while intelligence information does not require other operations.

[0058] Data preprocessing can fully integrate network security data from different sources and various data types. For the unstructured text data, knowledge extraction is required. Knowledge extraction is divided into named entity recognition and relationship extraction. The named entity recognition process includes three steps:

[0059] (1) Step 1: Use the BIO annotation method to annotate the unstructured text data and construct the corresponding entity classification dataset. The dataset contains a total of 2513 network security entities.

[0060] (2) Step 2: Use the Bert-BiLSTM-MHA-CRF model to classify entities;

[0061] (3) Step 3: Train the model and adjust the model parameters according to the model evaluation indicators. The model parameters include learning rate, batch size and maximum number of training times. The evaluation indicators include precision, recall and F1 score. The calculation formula of precision is: The calculation formula for recall is: The calculation formula of F1 value is: Among them, TP means that the actual sample is a positive example and is also correctly predicted as a positive example, TN means that the actual sample is a negative example and is also correctly predicted as a negative example, FP means that the actual sample is a negative example and is incorrectly predicted as a positive example, and FN means that the actual sample is a positive example and is incorrectly predicted as a negative example.

[0062] The Bert-BiLSTM-MHA-CRF model is as follows Figure 4 As shown, there are six levels:

[0063] (1) Text input layer, inputting the text sequence to be annotated;

[0064] (2) BERT layer, which pre-trains the sequence to be annotated and generates word vectors at the character level, word level, and sentence level;

[0065] (3) BiLSTM layer, which extracts features from the context of the input sequence;

[0066] (4) Multi-head attention layer to capture important local features in the sequence;

[0067] (5) CRF layer, for label prediction;

[0068] (6) Output layer, outputs the labeled sequence.

[0069] The relationship extraction process also includes three steps:

[0070] (1) The data is annotated according to the relationship types predefined in the ontology model and the corresponding dataset is constructed. The dataset contains the relationships between 2918 network security entities.

[0071] (2) Using the Bert-SA-CNN model, we can automatically identify the semantic relationship between entities from unstructured data;

[0072] (3) Train the model and adjust the model parameters according to the model evaluation indicators. The model parameters also include learning rate, batch size and maximum number of training times. The evaluation indicators also include precision, recall rate and F1 value.

[0073] The Bert-SA-CNN model is as follows Figure 5 As shown, there are five levels:

[0074] (1) Input layer, inputting raw text data;

[0075] (2) BERT layer, which pre-trains the original text data to generate high-dimensional word embeddings;

[0076] (3) Self-attention layer, which enhances the ability to capture important features in text sequences;

[0077] (4) CNN layer, extracting local features from the word vectors processed by self-attention;

[0078] (5) Output layer, generating structured relationship labels.

[0079] Figure 6 This is a comparison chart of the experimental results of the knowledge extraction model and other models. It can be seen that in terms of F1 value, the Bert-BiLSTM-MHA-CRF named entity recognition model and the Bert-SA-CNN relationship extraction model proposed in the present invention have certain improvements compared with other models, and are the highest values ​​among all models, with specific values ​​of 86.84% and 86.20% respectively.

[0080] The above examples are only used to illustrate the technical method of the present invention rather than to limit it. Ordinary technicians in this field can modify or replace the technical solution of the present invention with equivalents without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be based on the claims.

Claims

1. A method for constructing a network security knowledge graph based on ontology, characterized in that: The following steps are involved: Step 1: Determine the overall framework for building a network security knowledge graph; Step 2: Construct a network security ontology model and determine the division of various types of entities, relationships, and attributes; Step 3: Obtain the required basic data and perform preprocessing operations on it; Step 4: Extract knowledge from unstructured text data. Knowledge extraction is divided into two parts: named entity recognition and relationship extraction. The model Bert-BiLSTM-MHA-CRF, which combines the BERT pre-training model, bidirectional long short-term memory network (BiLSTM), multi-head attention mechanism (Multi-headAttention) and conditional random field (CRF), is used for named entity recognition. The model Bert-SA-CNN, which combines the BERT pre-training model, self-attention mechanism (Self-Attention) and convolutional neural network (CNN), is used for relationship extraction. Step 5: Perform knowledge fusion on structured data and unstructured data after knowledge extraction; Step 6: Use the Neo4j graph database to store the knowledge graph in the network security field.

2. The method for constructing a network security knowledge graph based on ontology according to claim 1 is characterized in that: The specific process of determining the overall framework for constructing the network security knowledge graph in step one is as follows: constructing a model layer. The essence of the model layer is to establish a knowledge model for network security data, which is mainly accomplished by constructing an ontology; constructing a data layer. The data layer is responsible for processing specific multi-source heterogeneous network security data, and on the basis of the constructed model layer, realizes the structuring of the knowledge graph.

3. The method for constructing a network security knowledge graph based on ontology according to claim 1 is characterized in that: The basic data obtained in step three mainly comes from two sources: intelligence information and topology information. The source of intelligence information is the open source network security reports of Tencent Security and Alibaba Cloud Security crawled by crawler scripts. This part is unstructured data. The topology information is obtained by detecting the topology and host information of the intranet environment built in VMware virtualization software through automated tools. This part of information belongs to structured data.

4. The method for constructing a network security knowledge graph based on ontology according to claim 3 is characterized in that: The specific process of data preprocessing is as follows: data cleaning is performed on both intelligence information and topology information to remove invalid, erroneous or redundant information in the original data; for topology information, the detected network topology and configuration information need to be instantiated through the concepts and relationships defined in the ontology, that is, to determine which entity this information belongs to and what relationship exists between them. Intelligence information does not require other operations.

5. The method for constructing a network security knowledge graph based on ontology according to claim 1 is characterized in that: The specific process of named entity recognition for unstructured text in step 4 is: annotate it using the BIO annotation method to construct the corresponding entity classification dataset; use the Bert-BiLSTM-MHA-CRF model to classify the entities, where the BERT model is used to pre-train the sequence to be annotated and generate word vectors at the character level, word level, and sentence level; the BiLSTM model is used to extract features from the context of the input sequence; the multi-head attention mechanism is used to capture important local features in the sequence; and the CRF model is used for label prediction; the model is trained and the model parameters are adjusted according to the evaluation indicators of the model. The model parameters include batch size, maximum number of training times, and learning rate.

6. The method for constructing a network security knowledge graph based on ontology according to claim 5 is characterized in that: The evaluation indicators used by the model for named entity recognition include: precision, recall and F1 score. Precision indicates the proportion of samples predicted by the model as positive examples that are actually positive examples. Recall indicates the proportion of samples correctly predicted by the model as positive examples among samples that are actually positive examples. F1 score is the harmonic mean of precision and recall, which is used to balance precision and recall. The specific calculation formulas for precision, recall and F1 score are as follows: Among them, TP means that the actual sample is a positive example and is also correctly predicted as a positive example, TN means that the actual sample is a negative example and is also correctly predicted as a negative example, FP means that the actual sample is a negative example and is incorrectly predicted as a positive example, and FN means that the actual sample is a positive example and is incorrectly predicted as a negative example.

7. The method for constructing a network security knowledge graph based on ontology according to claim 5 is characterized in that: The specific process of relation extraction for unstructured text is as follows: label the data according to the predefined relation types in the ontology model and construct the corresponding data set; use the Bert-SA-CNN model to automatically identify a certain semantic relationship between entities from unstructured data, where the BERT model is used to pre-train the original text data to generate high-dimensional word embeddings, the self-attention mechanism is used to enhance the ability to capture important features in the text sequence, and CNN is used to extract local features from the word vectors processed by self-attention; train the model and adjust the model parameters according to the evaluation indicators of the model. The model parameters also include batch size, maximum number of training times and learning rate. The evaluation indicators also include precision, recall rate and F1 value.

8. The method for constructing a network security knowledge graph based on ontology according to claim 1, characterized in that: In step five, the main work of knowledge fusion of structured data and unstructured data after knowledge extraction is entity alignment. Entity alignment can eliminate the problems of entity conflicts and unclear pointing in heterogeneous data. The local collective entity alignment method is adopted to first calculate the weights between entities, and then obtain the similarity between entities after weighted summation. Finally, entity alignment is performed based on the similarity between entities.

Images