Software supply chain security analysis method and system based on knowledge graph and GNN model fusion, medium and processor

Abstract

The invention discloses a software supply chain security analysis method and system based on knowledge graph and GNN model fusion, a medium and a processor. The method comprises the steps of collecting power grid software supply chain safety related data, preprocessing and storing the data, constructing a knowledge graph, mining effective association rules by applying an Apriori algorithm, constructing a GNN model, introducing an attention mechanism for training and testing, and carrying out visualization and interactive design on the model. The system comprises an acquisition module, an atlas module, a mining module, a model module and an analysis module. A computer readable storage medium and a processor may execute the method. Compared with the prior art, the method has the advantages that scattered data can be integrated, association rules can be accurately mined, threats can be accurately identified by means of a GNN model, threat information can be conveniently checked and analyzed through a visual interaction interface, the capability and efficiency of power grid software supply chain safety analysis are comprehensively improved, and powerful support is provided for power grid safety protection.

Description

Technical Field

[0001] The present invention relates to the technical field of software supply chain security analysis, and particularly to a software supply chain security analysis method, system, medium and processor based on the fusion of a knowledge graph and a GNN model. Background Art

[0002] In modern power systems, the scale and complexity of the grid software supply chain have increased exponentially. With the deep integration of information technology and the power industry, a large number of different types of software have been applied to various aspects of the grid, from power dispatching, marketing management to geographic information systems, etc., which makes the grid software supply chain cover extremely wide data sources and application scenarios.

[0003] From the data level, various types of data are scattered and lack an effective integration mechanism. The chaotic state of data management makes it difficult to obtain comprehensive and accurate data support when conducting grid software supply chain security analysis, greatly affecting the reliability of the analysis results. In terms of security threat analysis, serious challenges are currently faced. Due to the lack of an efficient analysis method, it is difficult to accurately identify real threats from a large amount of security data.

[0004] At the same time, existing security analysis models and tools are unable to cope with the complexity of the grid software supply chain and basically adopt one-sided analysis methods, making the security analysis results unable to provide comprehensive and effective guidance for the security protection of the grid.

[0005] In view of this, a software supply chain security analysis method, system, medium and processor based on the fusion of a knowledge graph and a GNN model are needed. Summary of the Invention

[0006] Aiming at the problem that it is difficult to accurately identify real threats from a large amount of security data due to the one-sided analysis method in the prior art, the present invention provides a software supply chain security analysis method, system, medium and processor based on the fusion of a knowledge graph and a GNN model, which can comprehensively analyze the entire software supply chain and accurately identify real threats from a large amount of security data. The specific technical solutions are as follows:

[0007] A software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model, comprising:

[0008] S1: Collect data related to the security of the grid software supply chain, preprocess and store it;

[0009] S2: Construct a knowledge graph of the grid software supply chain according to the collected data;

[0010] S3: Use the Apriori algorithm to mine effective association rules in the knowledge graph;

[0011] S4: Construct a GNN model, introduce an attention mechanism into the model, adjust the attention weights of nodes and edges according to the effective association rules, and then input the model for training and testing;

[0012] S5: Perform visualization and interaction design on the model to facilitate the display and analysis of threat information.

[0013] Furthermore, in step S2, constructing the power grid software supply chain knowledge graph based on the collected data includes the following steps:

[0014] S21: Select a database storage architecture that combines a graph database and a relational database according to the characteristics of power grid software supply chain security data;

[0015] S22: Use database management tools and write data import scripts to import the cleaned and integrated data into the corresponding databases;

[0016] S23: With software as the core, construct a knowledge graph from data in different dimensions;

[0017] S24: Establish indexes for commonly used query fields in the relational database and establish indexes for the key attributes of nodes in the graph database to accelerate the retrieval of associated data;

[0018] S25: Establish a knowledge update and maintenance mechanism for the database, regularly obtain new data from the data collection end, and update the database;

[0019] S26: Conduct knowledge verification and quality control during the data import and knowledge graph construction processes.

[0020] Furthermore, in step S26, the conduct of knowledge verification and quality control includes data integrity verification, data consistency verification, relationship accuracy verification, and data duplication verification.

[0021] Furthermore, in step S3, the use of the Apriori algorithm to mine effective association rules in the knowledge graph includes the following steps:

[0022] S31: Convert the knowledge graph-related data into a transaction dataset, where each transaction consists of several items;

[0023] S32: Set the minimum support threshold and the minimum confidence threshold;

[0024] S33: Generate frequent item sets according to the minimum support threshold and the minimum confidence threshold;

[0025] S34: Generate effective association rules based on the frequent item sets.

[0026] Furthermore, in step S34, generating effective association rules based on frequent item sets includes the following steps:

[0027] For each frequent item set, find all its non-empty true subsets;

[0028] For each non-empty true subset, calculate the confidence of the association rule;

[0029] The association rules whose confidence is greater than or equal to the minimum confidence threshold are selected as valid association rules.

[0030] Furthermore, the confidence calculation formula of the association rule is as follows:

[0031]

[0032] In the above formula, l is a frequent item set; s is a non-empty true subset among all non-empty true subsets; Represents the association rule between non-empty proper subset s and non-empty proper subset ls; Represents association rules confidence; support(l) and support(s) are the support of the frequent item set l and the non-empty proper subset s respectively.

[0033] Furthermore, in step S4, the calculation formula for adjusting the attention weights of nodes and edges according to the effective association rules is as follows:

[0034]

[0035] Where V is the set of all nodes in the knowledge graph; v represents an ordinary node in the knowledge graph; v′ represents any node in the set V of all nodes in the knowledge graph; r is a valid association rule; sim(v,r) and sim(v′,r) represent the similarity between nodes v and v′ and the valid association rule r, respectively, and the value range is [0,1]; α v is the attention weight of node v; R valid is a set of valid association rules;

[0036]

[0037] Among them, e represents a common edge in the knowledge graph; e′ represents any edge in the set E of all edges in the knowledge graph; α e is the attention weight of edge e; sim(e,r) represents the similarity between edge e and the valid association rule r, and its value range is [0,1]; E is the set of all edges in the knowledge graph.

[0038] A software supply chain security analysis system based on the fusion of a knowledge graph and a GNN model, which is applied to the software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model described above, includes:

[0039] A collection module, which is used to collect data related to the security of the power grid software supply chain, preprocess it, and store it;

[0040] A graph module, which is used to construct a power grid software supply chain knowledge graph based on the collected data;

[0041] A mining module, which is used to mine effective association rules in the knowledge graph by using the Apriori algorithm;

[0042] A model module, which is used to construct a GNN model, introduce an attention mechanism into the model, adjust the attention weights of nodes and edges according to the effective association rules, and then input the model for training and testing;

[0043] An analysis module, which is used to perform visualization and interaction design on the model, so as to display and analyze threat information.

[0044] A computer-readable storage medium, the computer-readable storage medium includes a stored program, wherein when the program runs, it controls the device where the computer-readable storage medium is located to execute the software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model described above.

[0045] A processor, the processor is used to run a program, wherein when the program runs, it executes the software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model described above.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] 1. Better data integration and management

[0048] Integrate scattered data: In the prior art, the data of the power grid software supply chain is scattered and lacks integration, which affects the reliability of analysis. This solution comprehensively sorts out 9 dimensions of data, covering questionnaire surveys, application types, application scenarios, etc., uses various collection technologies to collect data, such as automated online questionnaire systems, static code analysis tools, etc., and establishes a data collection task scheduling mechanism to ensure the timeliness and stability of data. Through data cleaning and integration, invalid data is removed, and a basic data set is constructed to make the data more comprehensive and accurate, providing strong support for analysis.

[0049] Optimize the storage architecture: Adopt a storage architecture that combines a graph database and a relational database. The relational database stores structured basic data, and the graph database stores complex association relationships, which can visually present the data connections in each dimension and facilitate querying and calling. During data import, preprocess the data to check integrity and consistency, convert the data into node and relationship forms, and improve the efficiency of data storage and management.

[0050] 2. Threat analysis is more accurate and efficient

[0051] Mine effective association rules: Use the Apriori algorithm to mine effective association rules in the knowledge graph. By converting the knowledge graph data into a transaction dataset, setting thresholds to generate frequent item sets, and then generating effective association rules. Compared with the one-sided analysis methods of existing technologies, it can more deeply discover the potential relationships between data and provide richer information for threat analysis.

[0052] Enhance the model analysis ability: Build a GNN model and introduce an attention mechanism to adjust the attention weights of nodes and edges according to the effective association rules. During the training process, the model focuses on key information, can better capture the features related to threat analysis, improve the accuracy and effectiveness of threat analysis, and output more targeted analysis results.

[0053] 3. Threat information display and interaction are more convenient

[0054] Visual presentation: Use visualization libraries such as Echarts and D3.js to design a visualization and interaction interface, and display the threat model with a full-link graph. Distinguish node types by different colors and shapes, and use lines to represent relationships, clearly presenting the data in each dimension and their association relationships, making threat information more intuitive and understandable.

[0055] Powerful interaction functions: Add interaction effects such as filtering, retrieval, and viewing detailed information. Users can quickly locate and view the threat information they are interested in. For example, entering keywords can filter the vulnerability threat information of specific software, and clicking on a node can view the detailed description and scope of influence, which is convenient for users to deeply understand the threat situation and provides convenience for security protection. Description of the drawings

[0056] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0057] Figure 1 It is a schematic flowchart of a software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model;

[0058] Figure 2 It is a schematic structural diagram of a software supply chain security analysis system based on the integration of a knowledge graph and a GNN model. Specific implementation manners

[0059] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0060] It should be understood that when used in this application, the terms "include" and "comprise" indicate the presence of the described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or their combinations.

[0061] It should also be understood that the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include the plural forms.

[0062] It should be further understood that the term "and / or" used in this application refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0063] Embodiment 1

[0064] As Figure 1 shown is a schematic flowchart of a software supply chain security analysis method based on the integration of a knowledge graph and a GNN model, including the following steps:

[0065] S1: Collect data related to the security of the power grid software supply chain and perform preprocessing.

[0066] S11: Comprehensively sort out the data sources related to the security of the power grid software supply chain, mainly covering 9 dimensions:

[0067] 1. Questionnaire survey: The operation habits of user login authentication, such as whether they are used to logging in to power grid-related software using fingerprint recognition, SMS verification codes, etc.; abnormal error messages encountered in the use of power equipment monitoring software, such as error prompt content, occurrence frequency, occurrence scenarios, etc.; users' expectations for the security functions of power trading software, such as encryption methods they hope to add, more convenient identity verification means, etc.

[0068] 2. Application Types: The data format for instruction transmission in power dispatching software, such as whether it uses XML, JSON, or a custom format; The user data storage architecture of power marketing management software, including database table structures, field types, index settings, etc.; The map data update frequency of the power grid geographic information system, as well as the data source channels.

[0069] 3. Application Scenarios: The data collection frequency in the real-time monitoring scenario of the smart grid, for example, collecting the operation parameters of power equipment every few seconds; The transaction data volume and peak periods in the power market trading and settlement scenario, such as the number of daily and monthly transactions, and the data traffic during peak trading periods; The communication network stability indicators in the power grid emergency repair scenario, such as signal strength, network latency, packet loss rate, etc.

[0070] 4. Threat Library: The CVE numbers of common vulnerabilities, such as CVE-2023-1234 representing a specific security vulnerability; Descriptions of attack cases against the power system, including the attack time, the attacker's means, the affected power equipment or software modules, etc.; The signature codes of malware for identifying and detecting malware.

[0071] 5. Security Requirements: The requirements of the power grid user information management software for data encryption algorithms, such as using encryption algorithms like AES, RSA, etc.; The specific methods for data integrity verification in the power trading system, such as using hash algorithms (MD5, SHA-256, etc.) for data integrity verification; The quantitative indicators for availability in the power monitoring system, such as requiring the system annual availability rate to reach over 99.9%.

[0072] 6. Security Design: The role and permission allocation table in the access control policy, which details the access permissions of different roles (such as administrators, ordinary users, operation and maintenance personnel, etc.) to software function modules and data; The key management policy in the encryption mechanism, including key generation methods, update cycles, storage locations, etc.; The log record fields of the security audit system, such as recording information like user login time, IP address, operation content, operation results, etc.

[0073] 7. Security Components: The rule configuration file of the firewall, which contains rules such as the IP address ranges, port numbers, protocol types allowed or prohibited for access; The alarm threshold settings of the intrusion detection system, such as network traffic anomaly thresholds, connection number anomaly thresholds, etc.; The authentication methods and parameters of the identity authentication system, such as using two-factor authentication, including passwords and dynamic verification codes, and the valid duration of the verification codes, etc.

[0074] 8. Test cases: Descriptions of test scenarios for functional test cases. For example, in the functional test of electricity payment, test scenarios simulating different payment amounts and payment methods (WeChat, Alipay, bank cards, etc.); Vulnerability detection results of security test cases, such as whether SQL injection vulnerabilities and XSS vulnerabilities are detected, and the severity levels of the vulnerabilities; Response time metrics of performance test cases, such as the average response time and maximum response time of the electricity query function.

[0075] 9. Industry specifications: Comply with the safety standards and regulatory requirements of the power industry. For example, the safety level classification standards in the "Basic Requirements for Information System Security Classification Protection in the Power Industry", such as the different safety requirements for first-level, second-level, and third-level systems; The specific requirements for network isolation in the "Regulations on the Safety Protection of Power Monitoring Systems", such as the implementation standards for physical isolation and logical isolation; The regulations on data backup strategies in industry standards, such as backup frequency, backup storage duration, off-site backup requirements, etc.

[0076] S12: For different data sources, adopt corresponding data collection technologies. For example, the collection methods for each dimension are as follows:

[0077] 1. Questionnaire survey: Use an automated online questionnaire system with tools such as Wenjuanxing and Tencent Document Questionnaire. By setting questionnaire logic, automatically push the questionnaire link to the work accounts of internal power grid personnel. After the questionnaire is completed, the system can automatically organize the questionnaire results into structured data and store them in a specified database for subsequent analysis, effectively collecting information such as users' views on software security and feedback on usage problems.

[0078] 2. Application type: Utilize static code analysis tools such as SonarQube. It can automatically scan the source code of power grid software and analyze key information such as code structure and dependency libraries. By presetting rules, identify characteristics related to software types, such as specific code patterns of power dispatching algorithms and identification of power equipment monitoring function modules, and then automatically determine the software type without manual line-by-line code review.

[0079] 3. Application scenario: Adopt network traffic monitoring tools like Wireshark. Deploy it at key nodes of the power grid network to automatically capture network traffic data during software operation. By parsing protocols, analyzing data flow directions and interaction frequencies, and combining preset scenario feature models, automatically identify the application scenarios where the software is located, such as determining whether it is data interaction in the electricity trading settlement scenario or traffic transmission in the remote operation and maintenance scenario of power grid equipment.

[0080] 4. Threat Library: Connect to an automated threat intelligence platform, such as the Weibo Online API. Programmatically call this API regularly to obtain the latest security threat data, including vulnerability types, attack methods, and threat intelligence details. This data is automatically synchronized to the local threat library, ensuring the real-time and accuracy of threat information.

[0081] 5. Security Requirements: Develop an automated requirements document parsing program, using natural language processing (NLP) technology to analyze security requirements documents for power grid software. The program automatically extracts confidentiality, integrity, and availability requirements from the documents, identifying key aspects such as encryption algorithm requirements and data backup frequency regulations, and converts them into structured data storage, reducing the workload and errors associated with manual extraction.

[0082] 6. Security Design: Code review tools, such as Checkmarx, can automatically scan power grid software source code and analyze code snippets related to security design, such as access control and encryption mechanisms. By matching rules, they automatically identify security design implementations and potential risks, such as detecting access control permission bypass vulnerabilities and correct encryption algorithm usage, and generate detailed reports for subsequent analysis.

[0083] 7. Security Components: Leverage the management APIs of security components, such as those built into firewalls and intrusion detection systems. Write automated scripts to regularly access security component configuration information and operational status data through the APIs, including rule configuration, alarm thresholds, and real-time traffic monitoring data. This enables automated monitoring and data collection of security component status.

[0084] 8. Test Cases: Data is obtained from automated test management tools such as JIRA and TestRail. These tools automatically record test case execution status and result data during test execution. By calling their APIs, information such as test case number, test steps, expected results, and actual results can be automatically exported and stored, facilitating centralized analysis and management of test data.

[0085] 9. Industry Standards: Develop a web crawler program and configure it to automatically crawl power industry safety standards, regulations, and policy documents from official websites such as the National Energy Administration and the Electric Power Industry Association according to specific rules. By analyzing the structure of web pages, it extracts key regulatory content and automatically categorizes and stores it, ensuring timely access to the latest industry regulatory information.

[0086] S13: To ensure the timeliness and stability of data collection, a data collection task scheduling mechanism is established. Use a task scheduling framework such as Airflow or Celery to set up regular collection tasks. Reasonably arrange the collection time interval according to the update frequency and importance of the data. At the same time, build a data collection monitoring system to monitor the execution status of the collection tasks in real time. By recording information such as the start time, end time, amount of collected data, and whether there are errors of the collection tasks, promptly discover and handle abnormal situations during the collection process. Once data collection fails or data is abnormal, the system automatically sends an alarm to notify relevant technical personnel for troubleshooting and repair.

[0087] S14: Clean the collected data to remove invalid, duplicate, and incorrect data. By writing data cleaning scripts, perform screening and processing according to the integrity and legality rules of the data. Integrate the cleaned data in a unified data format to build a basic dataset, providing high-quality data support for subsequent modeling.

[0088] Suppose we have collected the following raw data related to the security evaluation of the power grid software supply chain from 9 dimensions:

[0089] Questionnaire survey: "When logging in to the power trading software, there is sometimes a lag, about 2 - 3 times a month. The SMS verification code login method is used, and fingerprint recognition is expected to be added."

[0090] Application type: "Power dispatching software, using XML data format to transmit instructions, depending on the Java 11 runtime environment."

[0091] Application scenario: "Smart grid real-time monitoring scenario, with a data collection frequency of 10 times per second and an average network latency of 50 ms."

[0092] Threat library: "CVE-2023-1234, SQL injection vulnerability, affecting the power marketing management software. Attackers can use the vulnerability to obtain user information."

[0093] Security requirement: "Power user information management software, requiring the use of the AES-256 encryption algorithm to encrypt and store user data."

[0094] Security design: "Access control policy: Administrators can perform all operations, and ordinary users can only view part of the data, role-based access control."

[0095] Security component: "Firewall, rule: Allow the 192.168.1.0 / 24 network segment to access the power monitoring system, port 8080, protocol TCP."

[0096] Test case: "Test case number 001, test the electricity payment function, input the payment amount of 100 yuan, expect successful payment, and the actual payment is successful."

[0097] Industry standard: "The 'Basic Requirements for Information System Security Classification Protection in the Electric Power Industry' stipulates that secondary systems should conduct vulnerability scans every six months."

[0098] S141: Data cleaning.

[0099] Format unification: Unify the expression like "2 - 3 times a month" in the questionnaire survey to "Number of lags per month: 2.5 times", making it numerical data for convenient subsequent analysis. Unify "Java 11" in the application type to "Java_11", removing spaces for easy data processing.

[0100] Remove noise data: In the questionnaire survey data, if there are some meaningless garbled answers or content irrelevant to the theme, such as "Don't know, just write randomly", then directly delete this data. In the threat library data, if there are duplicate records of vulnerability information, only keep the latest and complete record.

[0101] Outlier handling: In the data collected from the application scenario, if it is found that the average network latency is 5000ms (assuming the normal range is 1 - 100ms), which significantly deviates from the normal range and belongs to an outlier. It can be corrected according to the actual situation, such as checking whether the data source is incorrect. If the error cause cannot be determined, statistical methods (such as mean imputation, median imputation) can be used for processing. Here, it is assumed that the average network latency value of other monitoring points in the same scenario is used for substitution.

[0102] S142: Data integration

[0103] Establish a data dictionary: Establish a data dictionary for the data of each dimension, defining the meaning, type, value range, etc. of the data. For example, for the "Encryption algorithm" field in the "Security requirements" dimension, the data dictionary is defined as: the type is string, and the value range is common encryption algorithm names (such as AES - 256, RSA, etc.).

[0104] Associate data: Use the software name or project ID as the association key to associate the data of different dimensions. Assume that all data is associated with the project of "Electric power trading software". Integrate the feedback data about this software in the questionnaire survey, the characteristic data of this software in the application type, and the operating environment data of this software in the application scenario, etc., to form a complete comprehensive data record about "Electric power trading software".

[0105] Store the integrated data: Store the integrated data in a relational database (such as MySQL). Create a table named "grid_software_security_data" that contains fields such as software name, questionnaire feedback, application type, application scenario, threat information, security requirements, security design, security component configuration, test case results, and industry standard requirements. Insert the cleaned and associated data into this table for subsequent data analysis and threat modeling. Examples of "grid_software_security_data" are shown in Table 1 and Table 2 below:

[0106] Table 1

[0107]

[0108] Table 2

[0109]

[0110] S2: Construct a knowledge graph of the power grid software supply chain based on the collected data.

[0111] S21: According to the characteristics of the power grid software supply chain security data, select a database storage architecture that combines a graph database (such as Neo4j) and a relational database (such as MySQL). The relational database MySQL is used to store structured basic data, such as software name, application type, test case results, etc.; the graph database Neo4j is used to store the complex association relationships between data, such as the relationships between software and threats, and between security requirements and security design, to visually present the connections of data in each dimension and facilitate querying and calling.

[0112] S22: Use database management tools and write data import scripts to import the cleaned and integrated data into the corresponding databases. During the import process, further preprocess the data. For the data in the relational database, check the integrity and consistency of the data to ensure that each field has the correct value; for the data in the graph database, convert the data into the form of nodes and relationships. For example, use the software name as a node and establish relationship edges with related threat information, security requirements, etc., and clarify the type of the edge (such as "faces threat", "meets security requirements", etc.).

[0113] 1. Nodes and relationships related to power trading software

[0114] 1.1 Node creation

[0115] Software Node: Create a node with the label "Software" and attributes {"name": "Power Trading Software", "type": "Power Trading Software", "data_transfer_format": "JSON"}. This node represents the power trading software itself, and its attributes record the basic information of the software.

[0116] Vulnerability Node: Create a node with the label "Vulnerability" and attributes {"vulnerability_id": "CVE-2023-5678", "type": "CSRF", "description": "An attacker can use this vulnerability to forge cross-site requests and tamper with transaction information"}. This node is used to represent the vulnerability faced by the software.

[0117] Security Requirement Node: Create a node with the label "SecurityRequirement" and attributes {"requirement": "Data Encryption", "algorithm": "AES-256"}, representing the security requirements of the software.

[0118] Access Control Node: Create a node with the label "AccessControl" and attributes {"control_type": "Role-Based", "roles": ["Administrator", "Regular User"]}, which is used to describe the access control part in the security design of the software.

[0119] Test Case Node: Create a node with the label "TestCase" and attributes {"test_function": "Power Payment", "result": "Success"}, representing a test case of the software and its result.

[0120] Industry Standard Node: Create a node with the label "IndustryStandard" and attributes {"standard": "Vulnerability Scanning Period", "cycle": "Half Year"}, representing the relevant industry standard requirements.

[0121] 1.2 Relationship Creation

[0122] Faces Threat Relationship: Create a relationship of type "FACES_THREAT" from the "Power Trading Software" node to the "CVE-2023-5678 Vulnerability" node, indicating that the power trading software faces the threat of this vulnerability.

[0123] Meet Requirement: Create a relationship of type "MEETS_REQUIREMENT" from the "Power Trading Software" node to the "AES-256 Encryption Security Requirement" node, indicating that the software meets this security requirement.

[0124] Adopt Design Relationship: Create a relationship of type "IMPLEMENTS_DESIGN" from the "Power Trading Software" node to the "Role-Based Access Control" node, indicating that the software adopts this security design.

[0125] Passed Test Relationship: Create a relationship of type "TESTED_BY" from the "Power Trading Software" node to the "Power Payment Test Case" node, indicating that the software has been tested by this test case.

[0126] Comply with Specification Relationship: Create a relationship of type "COMPLIES_WITH" from the "Power Trading Software" node to the "Vulnerability Scanning Cycle Industry Specification" node, indicating that the software complies with the requirements of this industry specification.

[0127] 2. Nodes and Relationships Related to Power Dispatching Software

[0128] 2.1 Node Creation

[0129] Software Node: Create a node with the label "Software" and attributes {"name": "Power Dispatching Software", "type": "Power Dispatching Software", "data_transfer_format": "XML"}.

[0130] Vulnerability Node: Create a node with the label "Vulnerability" and attributes {"vulnerability_id": "CVE-2023-9876", "type": "Buffer Overflow", "description": "Buffer overflow may lead to incorrect dispatching instructions, affecting the normal dispatching of the power grid"}.

[0131] Security Requirement Node: Create a node with the label "SecurityRequirement" and attributes {"requirement": "Data Encryption", "algorithm": "3DES"}.

[0132] Access Control Node: Create a node with the label "AccessControl" and attributes {"control_type": "Permission-Based", "roles": ["Dispatcher", "Operation and Maintenance Personnel"]}.

[0133] Test case node: Create a node with the label "TestCase" and the attributes {"test_function": "Dispatch instruction issuance", "result": "Success"}.

[0134] Industry standard node: Create a node with the label "IndustryStandard" and the attributes {"standard": "Vulnerability scanning cycle", "cycle": "Half a year"}.

[0135] 2.2 Relationship creation

[0136] Faces threat relationship: Create a relationship of type "FACES_THREAT" from the "Power dispatching software" node to the "CVE-2023-9876 vulnerability" node.

[0137] Meets requirement relationship: Create a relationship of type "MEETS_REQUIREMENT" from the "Power dispatching software" node to the "3DES encryption security requirement" node.

[0138] Implements design relationship: Create a relationship of type "IMPLEMENTS_DESIGN" from the "Power dispatching software" node to the "Role-based access control" node.

[0139] Tested by relationship: Create a relationship of type "TESTED_BY" from the "Power dispatching software" node to the "Dispatch instruction issuance test case" node.

[0140] Complies with relationship: Create a relationship of type "COMPLIES_WITH" from the "Power dispatching software" node to the "Vulnerability scanning cycle industry standard" node.

[0141] S23: With software as the core, construct a knowledge graph from data in different dimensions. In the graph database, create a main node for each software, and then according to the association relationships between the data, draw different edges from the main node to connect to other relevant nodes. For example, draw an edge of "faces threat" from the main node of the power trading software to the corresponding CSRF vulnerability node; draw an edge of "meets security requirements" to the security requirement node of the AES-256 encryption algorithm; draw an edge of "adopts security design" to the security design node of role-based access control, etc. In this way, construct a complex knowledge graph to comprehensively display the knowledge system related to software supply chain security.

[0142] S24: In the relational database, create indexes for frequently queried fields, such as software names, vulnerability numbers, etc., to improve the speed of data query. In the graph database, create indexes for the key attributes of nodes (such as node types, software names, etc.) to accelerate the retrieval of associated data. At the same time, optimize the query statements of the graph database, such as using appropriate indexing strategies, reducing unnecessary traversal operations, etc., to ensure that the required data can be quickly obtained during threat analysis.

[0143] S25: Establish a knowledge update and maintenance mechanism for the database, regularly obtain new data from the data collection end, and update the database. When new vulnerabilities are discovered, security requirements change, or software application scenarios change, make corresponding modifications and supplements to the database in a timely manner. For example, if a new vulnerability is discovered in the power trading software, add a new vulnerability record to the relational database and establish the association between this vulnerability and the power trading software in the graph database. At the same time, regularly clean up the data in the database, delete expired or invalid data, and ensure the accuracy and effectiveness of the database.

[0144] S26: During the data import and knowledge graph construction process, conduct knowledge verification and quality control. Check whether the logical relationships between data are reasonable, such as whether the security requirements match the security design, whether the threats are related to the software application types, etc. Ensure the accuracy of the knowledge in the database through a combination of writing verification scripts and manual review. For data that does not conform to logic or contains errors, correct or delete it in a timely manner to ensure the quality of the database and provide a reliable data basis for subsequent threat modeling and analysis. Further, knowledge verification and quality control can be carried out through the following indicators:

[0145] 1. Data integrity verification

[0146] Consider the importance weight of different attributes and introduce a weighted integrity ratio formula.

[0147]

[0148] In the above formula, n is the number of data records in the dataset; m is the number of attributes, and the weight of each attribute k is w k (0 ≤ w k ≤ 1, and ). For record i, if the value of attribute k exists, then x ik = 1, otherwise x ik = 0.

[0149] Suppose we have 5 data records about power software, including 4 attributes: "software name" (weight w1 = 0.2), "application type" (weight w2 = 0.2), "security requirements" (weight w3 = 0.3), and "test case results" (weight w4 = 0.3).

[0150] The data records are as follows:

[0151] Record 1: Power trading software, power trading category software, using AES-256 encryption, power payment test successful;

[0152] Record 2: Power dispatching software, power dispatching category software, using 3DES encryption, dispatching instruction issuing test successful;

[0153] Record 3: Power trading software,, using AES-256 encryption,;

[0154] Record 4: Power dispatching software, power dispatching category software,,, dispatching instruction issuing test successful;

[0155] Record 5: Power trading software, power trading category software, using AES-256 encryption, power payment test successful;

[0156] For record 1: x 11 = 1, x 12 = 1, x 13 = 1, x 14 = 1;

[0157] For record 2: x 21 = 1, x 22 = 1, x 23 = 1, x 24 = 1;

[0158] For record 3: x 31 = 1, x 32 = 0, x 33 = 1, x 34 = 0;

[0159] For record 4: x 41 = 1, x 42 = 1, x 43 = 0, x 44 = 1;

[0160] For record 5: x 51 = 1, x 52 = 1, x 53 = 1, x 54 = 1;

[0161]

[0162] 2. Data consistency verification

[0163] Consider the association constraint relationships between attributes and calculate the consistency ratio based on the violations of the constraints. Suppose there are n data records in the dataset (n = 5) and s attribute association constraint conditions (here s = 2). For each constraint condition j, if record i violates constraint j, then y ij = 1, otherwise y ij = 0.

[0164]

[0165] Suppose there are 2 attribute association constraint conditions:

[0166] Constraint 1: When AES-256 encryption is used in "Security Requirements", the "Test Case Result" should be "Power Payment Test Successful".

[0167] Constraint 2: When the "Test Case Result" is "Dispatch Instruction Issuance Test Successful", the "Application Type" should be "Power Dispatch Software".

[0168] For record 1: It satisfies Constraint 1 (Security Requirement is AES-256 encryption and Test Case Result is Power Payment Test Successful), and satisfies Constraint 2 (Test Case Result is Power Payment Test Successful, without violation of Constraint 2), y 11 = 0, y 12 = 0.

[0169] For record 2: It satisfies Constraint 1 (Security Requirement is 3DES encryption, without violation), and satisfies Constraint 2 (Test Case Result is Dispatch Instruction Issuance Test Successful and Application Type is Power Dispatch Software), y 21 = 0, y 22 = 0.

[0170] For record 3: It satisfies Constraint 1 (Security Requirement is AES-256 encryption but Test Case Result is empty, violating Constraint 1), and does not violate Constraint 2 (Test Case Result is empty, without violation of Constraint 2), y 31 = 1, y 32 = 0.

[0171] For record 4: It satisfies Constraint 1 (Security Requirement is 3DES encryption, without violation), and satisfies Constraint 2 (Test Case Result is Dispatch Instruction Issuance Test Successful and Application Type is Power Dispatch Software), y 41 = 0, y 42 = 0.

[0172] For record 5: It satisfies Constraint 1 (Security Requirement is AES-256 encryption and Test Case Result is Power Payment Test Successful), and satisfies Constraint 2 (Test Case Result is Power Payment Test Successful, without violation of Constraint 2), y 51 = 0, y52 = 0。

[0173]

[0174] 3. Relationship Accuracy Verification

[0175] Let the total number of relationships in the knowledge graph be R (here R = 2, that is, the "faces threat" relationship between "power trading software" and "vulnerability (CVE-2023-5678)", and the "faces threat" relationship between "power dispatching software" and "vulnerability (CVE-2023-9876)").

[0176] Consider the confidence of the relationship and the semantic rationality of the relationship. Assume that for each relationship (u, v, r) in the knowledge graph (indicating that there is a relationship r between nodes u and v), there is a relationship confidence c(u, v, r) (ranging from 0 to 1), and according to the semantic rules, there are q semantic rationality judgment conditions (here q = 3). For the relationship (u, v, r), if the semantic rationality condition l is satisfied, then z (u,v,r)l = 1, otherwise z (u,v,r)l = 0. The formula is as follows:

[0177]

[0178] For example, for the "faces threat" relationship between "power trading software" and "vulnerability (CVE-2023-5678)": the confidence c1 = 0.8, and 2 semantic rationality conditions are satisfied,

[0179] For the "faces threat" relationship between "power dispatching software" and "vulnerability (CVE-2023-9876)": the confidence c2 = 0.9, and 3 semantic rationality conditions are satisfied,

[0180]

[0181] 4. Data Duplication Verification

[0182] Let there be n data records in the dataset (n = 5). For any two records i and j, calculate the similarity sim(i, j) (ranging from 0 to 1). The similarity calculation can be based on the matching of attribute values and combined with the attribute weight w k (which has the same meaning as the attribute weight in data integrity verification). If sim(i, j) ≥ the duplication threshold (which can be set according to the actual situation, here set to be 0.8), then these two records are considered to be duplicates.

[0183] Let the number of pairs of duplicate records be p.

[0184]

[0185] For example, calculate the similarity between record 1 and record 5:

[0186] If the "software name" is the same, the similarity is 1;

[0187] If the "application type" is the same, the similarity is 1;

[0188] If the "security requirements" are the same, the similarity is 1;

[0189] If the "test case results" are the same, the similarity is 1;

[0190] The similarity sim(1, 5) = 0.3×1 + 0.3×1 + 0.2×1 + 0.2×1 = 1, which is greater than the duplication threshold of 0.8. These two records are considered duplicates.

[0191] After calculating the similarities between other records, they are all less than 0.8 and are not considered duplicates.

[0192]

[0193] S3: Use the Apriori algorithm to mine the effective association rules in the knowledge graph.

[0194] The Apriori algorithm is a classic algorithm for mining the association relationships between item sets in a dataset. Its core basis is the property that "all non-empty subsets of a frequent item set must also be frequent item sets". Based on this, the algorithm starts from smaller item sets (such as 1-item sets) and gradually generates larger item sets. During the generation process, it uses the above property for pruning to reduce unnecessary calculations, thereby efficiently finding all frequent item sets and then generating association rules.

[0195] 1. Convert the data related to the knowledge graph into a transaction dataset, where each transaction consists of several items. For example, in the knowledge graph of power software, a transaction can represent the set of attributes of a software, and the items can be software attribute information such as "the application type is power trading software", "uses the AES-256 encryption algorithm", and "has the user permission management function".

[0196] After converting to the transaction dataset, each row represents a transaction (here, the information of a software is used as a transaction), and each transaction is an item set composed of relevant attribute information, as shown below:

[0197] Further assume that we perform more detailed splitting and attribute extraction on the data. For example, the encryption algorithm type in the security requirements is listed separately as an item, and the roles or permissions in the security design are also listed separately, etc. The transaction dataset may become the following more detailed form:

[0198]

[0199] Through such a transformation, the data originally stored in a structured manner in the knowledge graph is converted into a form of transaction dataset suitable for processing by association rule mining algorithms such as the Apriori algorithm. The item sets in each transaction can be used for subsequent operations such as frequent item set mining and association rule generation.

[0200] 2. Set the minimum support threshold and the minimum confidence threshold.

[0201] Minimum support threshold (denoted as minSup): It represents the minimum frequency requirement for an item set to appear in the transaction dataset. For example, if minSup = 0.5, it means that an item set must appear in the dataset with a frequency of at least 50% to be considered a frequent item set.

[0202] Minimum confidence threshold (denoted as minConf): It is used to measure the credibility of association rules. For example, when minConf = 0.7, only association rules with a confidence of not less than 70% will be retained.

[0203] 3. Generate frequent item sets.

[0204] 3.1 Generate frequent 1-item sets.

[0205] Scan the dataset: Traverse the transaction dataset and count the number of occurrences of each individual item.

[0206] Calculate the support: For each item i, its support support(i) is calculated as the number of occurrences of the item divided by the total number of transactions.

[0207] Filter the frequent item sets: Select the items with a support greater than or equal to minSup and form a frequent 1-item set, denoted as L1.

[0208] 3.2 Generate larger frequent item sets based on the frequent 1-item sets.

[0209] Join operation: From the frequent (k - 1)-item set L k-1 Generate candidate k-item set C k . Specifically, combine the item sets in L k-1 . If the first k - 2 items of two frequent (k - 1)-item sets are the same, then merge them into a candidate k-item set. For example, if there are frequent 2-item sets {A, B} and {A, C}, the candidate 3-item set {A, B, C} can be generated.

[0210] Pruning operation: According to the Apriori property, if a (k - 1)-subset of a candidate k-item set is not a frequent (k - 1)-item set (i.e., not in L k-1 ), then this candidate k-item set must not be a frequent item set, and remove it from C kEliminate from.

[0211] Scan the data set: traverse the transaction data set again and count the number of occurrences of each candidate k-itemset.

[0212] Calculate support: For a candidate k-itemset c, its support (c) is the number of occurrences divided by the total number of transactions.

[0213] Filter frequent item sets: retain candidate k-item sets whose support is not less than minSup to form frequent k-item sets L k .

[0214] Iterative process: Repeat the above steps of connection, pruning, scanning, calculation and screening until no new frequent itemsets can be generated.

[0215] 4. Generate effective association rules based on frequent item sets.

[0216] For each frequent itemset l, find all its non-empty proper subsets, denoted as subsets(l). For example, for the frequent itemset {A,B,C}, its non-empty proper subsets are {A}, {B}, {C}, {A,B}, {A,C}, {B,C}.

[0217] For each non-empty proper subset s: compute the association rules Confidence The calculation formula is:

[0218]

[0219] Where support(l) and support(s) are the support of frequent item set l and subset s respectively.

[0220] Screening effective association rules: Select association rules with confidence greater than or equal to minConf as the final mining results.

[0221] Assume we have the following transaction dataset, which records the attributes of different power software:

[0222] Transaction ID Item set T1 {The application type is power trading software, using the AES-256 encryption algorithm, with real-time monitoring function} T2 {The application type is power trading software, using the AES-256 encryption algorithm} T3 {The application type is power dispatching software, using the 3DES encryption algorithm} T4 {The application type is power trading software, using the AES-256 encryption algorithm, with real-time monitoring function} T5 {The application type is power trading software, using the AES-256 encryption algorithm}

[0223] Set minSup=0.4 (ie the occurrence frequency is at least 2 times) and minConf=0.7.

[0224] Generate frequent 1-itemset

[0225] "Application type is power trading software" appears 4 times, with a support of 4÷5=0.8;

[0226] "Using AES-256 encryption algorithm" appears 4 times, with a support of 4÷5=0.8;

[0227] The phrase "has real-time monitoring function" appears 2 times, and the support degree is 2÷5 = 0.4;

[0228] The phrase "The application type is power dispatching software" appears 1 time, and the support degree is 1÷5 = 0.2;

[0229] The phrase "Adopts 3DES encryption algorithm" appears 1 time, and the support degree is 1÷5 = 0.2;

[0230] The frequent 1-itemsets are: {"The application type is power trading software"}, {"Adopts AES-256 encryption algorithm"}, {"has real-time monitoring function"}.

[0231] Generate frequent 2-itemsets

[0232] Candidate 2-itemsets: {"The application type is power trading software, adopts AES-256 encryption algorithm"}, {"The application type is power trading software, has real-time monitoring function"}, {"Adopts AES-256 encryption algorithm, has real-time monitoring function"}

[0233] After scanning the data set, calculate the support degree:

[0234] {"The application type is power trading software, adopts AES-256 encryption algorithm"} appears 4 times, and the support degree is 4÷5 = 0.8;

[0235] {"The application type is power trading software, has real-time monitoring function"} appears 2 times, and the support degree is 2÷5 = 0.4;

[0236] {"Adopts AES-256 encryption algorithm, has real-time monitoring function"} appears 2 times, and the support degree is 2÷5 = 0.4;

[0237] The frequent 2-itemsets are: {"The application type is power trading software, adopts AES-256 encryption algorithm"}, {"The application type is power trading software, has real-time monitoring function"}, {"Adopts AES-256 encryption algorithm, has real-time monitoring function"}

[0238] Generate frequent 3-itemsets

[0239] Candidate 3-itemsets: {"The application type is power trading software, adopts AES-256 encryption algorithm, has real-time monitoring function"}

[0240] After scanning the data set, calculate the support degree: appears 2 times, and the support degree is 2÷5 = 0.4;

[0241] The frequent 3-itemsets are: {"The application type is power trading software, adopts AES-256 encryption algorithm, has real-time monitoring function"}

[0242] Generate association rules

[0243] For the frequent 3-itemset {"The application type is power trading software, using the AES-256 encryption algorithm, with real-time monitoring function"}:

[0244] Rule 1:

[0245] Support: 0.4;

[0246] Confidence: (Less than minConf = 0.7, invalid rule);

[0247] Rule 2:

[0248] Support: 0.4

[0249] Confidence: (Greater than minConf = 0.7, valid rule);

[0250] Rule 3:

[0251] Support: 0.4

[0252] Confidence: (Greater than minConf = 0.7, valid rule);

[0253] S4: Build a GNN model, introduce an attention mechanism into the model, and adjust the attention weights of nodes and edges according to valid association rules, and then input the model for training and testing.

[0254] Data preparation: Extract data related to the security of power software from the database, including various attribute information of the software (such as application type, security requirements, security design, etc.), and the relationships between nodes (such as threat faced, requirement met, etc.). Preprocess this data and convert it into a format suitable for input to the GNN model. For example, encode the attribute information and represent the relationships as an adjacency matrix or edge list form.

[0255] Model architecture construction: Select a suitable GNN model architecture, such as Graph Convolutional Network (GCN), Graph Attention Network (GAT), etc. Taking GCN as an example, define parameters such as the number of layers of the model, the number of neurons in each layer, and the size of the convolutional kernel. The input layer of the model receives the preprocessed data, and through multiple convolutional operations, extracts and aggregates features from the graph-structured data, and obtains the feature representation of each node at the output layer for subsequent threat analysis tasks.

[0256] Introduce the attention mechanism into the GNN model. By calculating the degree of association between nodes and edges and valid association rules, different attention weights are assigned to different nodes and edges. During the information transmission process of the model, the information of nodes and edges is weighted according to the attention weights, enabling the model to focus on the parts related to valid association rules. Assume the set of valid association rules is R valid , for the node v and edge e in the knowledge graph, the degree of their association with valid association rules can be used to calculate the attention weights α v and α e :

[0257] For node v:

[0258]

[0259] where sim(v,r) represents the similarity between node v and valid association rule r; V is the set of all nodes in the knowledge graph. The similarity calculation can be determined based on factors such as the matching degree between node attributes and the attributes involved in the association rule, and the value range is [0,1]. This formula calculates the sum of the similarities between the node and all valid association rules, and normalizes it with the sum of the similarities between all nodes and valid association rules to obtain the attention weight of the node. v represents an ordinary node in the knowledge graph, used to calculate its attention weight. v′ represents any node in the set V of all nodes in the knowledge graph. In the double summation inside, v′ traverses each node in the set V. By calculating the similarity between each node and all valid association rules r and then accumulating, the in the numerator is normalized to determine the attention weight α v of node v.

[0260] Assume that the valid association rule r involves a set of attribute sets A r , and the node v has the attribute set A v . The Jaccard similarity can be used to measure the attribute matching degree between the node and the rule.

[0261] The Jaccard similarity formula is:[[]]

[0262]

[0263] where, |A v ∩A r | represents the number of intersection elements of the attribute set of node v and the attribute set involved in rule r, and |A v ∪A r | represents the number of elements in their union.

[0264] For edge e:

[0265]

[0266] Among them, sim(e, r) represents the similarity between edge e and the valid association rule r, and E is the set of all edges in the knowledge graph. Similarly, the similarity calculation is based on the matching of the node attributes connected by the edge and the characteristics of the edge itself with the association rule, and the value range is [0, 1]. This formula calculates the attention weight of the edge similarly. e represents an ordinary edge in the knowledge graph, and is used to calculate its attention weight. e′ represents any edge in the set E of all edges in the knowledge graph. In the double summation inside, e′ traverses each edge in the set E. By calculating the similarity between each edge and all valid association rules r and then accumulating, the in the numerator is normalized to determine the attention weight α of edge e e .

[0267] Edge e connects two nodes v1 and v2, and the set of attributes involved in rule r is A r . The matching situation between the attributes of the two nodes connected by the edge and the rule attributes can be considered.

[0268] A simple calculation method is:

[0269]

[0270] Among them, and are the sets of attributes of nodes v1 and v2 respectively.

[0271] Using the allocated attention weights, during the training process of the GNN model, the model focuses on the nodes and edges related to the valid association rules. When transmitting information and updating features, greater influence is given to the nodes and edges with higher attention weights, so as to better capture the key information related to threat analysis and improve the accuracy and effectiveness of the model for threat analysis. In practical applications, according to the input software-related data, the model can more accurately identify potential threats and output more targeted analysis results.

[0272] Define the loss function and optimizer: According to the task objective of threat analysis, select an appropriate loss function. For example, if the task is to predict whether a software has a specific threat, the cross-entropy loss function can be used. Select an optimizer, such as Adam, SGD, etc., to update the parameters of the model during the training process to minimize the loss function.

[0273] Model Training: Divide the adjusted data into a training set, a validation set, and a test set. During training, input the training set data into the model, calculate the output of the model through forward propagation, then calculate the difference between the output and the true labels according to the loss function, and then use the optimizer to update the model parameters through backpropagation. During training, regularly evaluate the performance of the model using the validation set, adjust the hyperparameters of the model (such as the learning rate, number of layers, etc.) to prevent overfitting. Stop training when the performance of the model on the validation set no longer improves.

[0274] S5: Visualize and interactively design the model to facilitate the display and analysis of threat information.

[0275] Determine the Display Content and Data Preparation: Sort out the key information to be displayed from the threat model, covering data in dimensions such as application type, application scenario, threat library, security requirements, security design, security components, test cases, industry specifications, etc., as well as the correlation relationships between them. For example, sort out data such as the application type of power dispatching software, the specific vulnerabilities it faces (from the threat library), and the corresponding security requirements (such as data encryption algorithm requirements). At the same time, ensure that the data format meets the requirements of the visualization library, and it may be necessary to clean, transform, and structure the data. For example, organize the data into JSON format, including node information (such as the attributes of software nodes, vulnerability nodes, etc.) and edge information (relationship type and connected nodes).

[0276] Select the Visualization Library and Determine the Chart Type: Both Echarts and D3.js can be used to create complex visualization charts. Echarts is easy to use and has a rich set of chart templates; D3.js is more flexible and can customize complex visualization effects. Select the appropriate library according to the requirements or use both in combination. For the full-link diagram of the threat model, a force-directed graph or a relationship graph type can be selected, which can clearly display the complex relationships between nodes. Taking Echarts as an example, its force-directed graph can present each element and its association in the threat model by setting the attributes of nodes and edges.

[0277] Design the Visualization Layout: Plan the overall layout of the chart, and determine the position and size of each element. Set different colors, shapes, and sizes for different types of nodes (such as software nodes, vulnerability nodes, etc.) to distinguish their types and importance. For example, set software nodes as circles, vulnerability nodes as diamonds, and adjust the node size according to the severity of the vulnerability. At the same time, reasonably arrange the styles of the edges, such as the line color and thickness, to represent the strength or type of the relationship. For the edges of threat relationships, they can be highlighted with thick red lines, while other relationships are represented by ordinary lines.

[0278] Data mapping and chart drawing: Map the prepared data onto visualization elements. In Echarts, define the node and edge data of the force-directed graph by configuring the series property.

[0279] In D3.js, create visualizations by selecting and manipulating SVG elements. First, select the container where the chart will be added, and then dynamically create SVG elements for nodes and edges according to the data, and set their attributes and styles.

[0280] Add interactive effects: Utilize the interactive features of the visualization library to add interactive effects such as filtering, retrieval, and viewing detailed information. In Echarts, the tooltip can be configured to display detailed information about nodes, and the filtering function can be achieved through the filter in the toolbox. D3.js can achieve interaction by binding events (such as click, mouseover, etc.). For example, when the mouse hovers over a vulnerability node, display the detailed description and impact scope of the vulnerability; when clicking on a software node, filter out all relationships and information related to that software.

[0281] Optimization and improvement: Check the visualization effect to ensure that the chart is clear and easy to read, and the relationships are presented accurately. Adjust the layout of nodes and edges to avoid overlap and chaos. Optimize styles such as colors, fonts, and lines to improve the aesthetics and professionalism of the visualization. In terms of performance, if the data volume is large, optimize the algorithm and set reasonable parameters, such as the node attraction and repulsion parameters of the force-directed graph, to ensure the smoothness of chart loading and interaction.

[0282] S6: Model optimization and update

[0283] Model evaluation and tuning: Adopt evaluation metrics such as cross-validation, accuracy, recall rate, and F1 value to regularly evaluate the constructed threat model. Adjust the parameters of the Apriori algorithm and GNN model according to the evaluation results, such as adjusting the learning rate and number of layers of the GNN model, to optimize the model performance and ensure the accuracy and stability of the model.

[0284] Data update and model iteration: Establish a data update mechanism, regularly collect new data, and update the threat modeling database in a timely manner. When new security events, vulnerabilities, or industry specification changes occur, quickly adjust the model structure and parameters so that the model can adapt to the changing security environment and maintain the timeliness and effectiveness of threat analysis.

[0285] Beneficial effects:

[0286] Threat information can be seen through three methods: constructing a knowledge graph, running a GNN model, and using a visual interactive interface. Through these three methods, the threat information of power software can be comprehensively and deeply analyzed and presented from different angles and levels.

[0287] 1. Threat Information Presentation Based on Knowledge Graph: The knowledge graph stores data in a combined manner of a graph database (such as Neo4j) and a relational database (such as MySQL). In the graph database, nodes and relationships are constructed with software as the core. For example, the power trading software is used as a node and is connected to the node representing the vulnerability through the "FACES_THREAT" (faces threat) relationship. Threat information can be intuitively obtained from node attributes and relationship types. For example, in the attributes of the "CVE-2023-5678" vulnerability node, it is clearly stated that the vulnerability type is "CSRF" and the description is "attackers can use this vulnerability to forge cross-site requests and tamper with transaction information", clearly showing the details of the threats faced by the power trading software.

[0288] 2. Analyzing Threat Information with the GNN Model: When the GNN model conducts threat analysis, it inputs various attribute information of the software and relationship information between nodes. The Apriori algorithm is used to mine potential effective association rules between data, and the attention mechanism is introduced to focus on the nodes and edges related to the effective association rules, and feature extraction and aggregation are performed on the input data. During the training process, the model learns the association patterns between different factors and threats. When new software-related data is input, the model can output potential threat identification results and targeted analysis results. For a new power software, the model may output that it faces a threat of a specific SQL injection vulnerability, and specifically analyze that this threat is caused by insufficient verification of user input in the software security design, and the scope of influence involves risks such as user data leakage.

[0289] 3. Viewing Threat Information Using a Visualization Interaction Interface: Visualization libraries such as Echarts and D3.js are used to display the threat model in the form of a full-link graph, and the front-end framework Vue.js is used to develop the interaction interface. In the visualized full-link graph, the association relationships of various dimensions such as application type, application scenario, and threat library can be clearly seen. Node types are distinguished by different colors and shapes, and relationships are represented by lines. Through the filtering and retrieval functions provided by the interaction interface, users can quickly locate the threat information they are interested in. When users enter keywords related to "power dispatching software" and "vulnerability" in the filtering box, they can filter out all the vulnerability threat information faced by the power dispatching software. Clicking on a specific vulnerability node can also view detailed vulnerability descriptions, scope of influence, and other information.

[0290] Example Two

[0291] As Figure 2 shown, a software supply chain security analysis system based on the integration of a knowledge graph and a GNN model is applied to the software supply chain security analysis method based on the integration of a knowledge graph and a GNN model as described above, and includes:

[0292] An acquisition module, which is used to collect data related to the security of the power grid software supply chain, preprocess and store it;

[0293] A knowledge graph module, which is used to construct a knowledge graph of the power grid software supply chain based on the collected data;

[0294] A mining module, which is used to mine effective association rules in the knowledge graph by using the Apriori algorithm;

[0295] A model module, which is used to construct a GNN model, introduce an attention mechanism into the model, adjust the attention weights of nodes and edges according to the effective association rules, and then input the model for training and testing;

[0296] An analysis module, which is used to perform visualization and interaction design on the model to facilitate the display and analysis of threat information.

[0297] Embodiment III

[0298] A computer-readable storage medium, the computer-readable storage medium includes a stored program, wherein when the program runs, it controls the device where the computer-readable storage medium is located to execute the above-mentioned software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model.

[0299] Embodiment IV

[0300] A processor, the processor is used to run a program, wherein when the program runs, it executes the above-mentioned software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model.

[0301] This application discloses a software supply chain security analysis method, system, medium and processor based on the fusion of a knowledge graph and a GNN model. The method includes collecting data related to the security of the power grid software supply chain, preprocessing and storing it, constructing a knowledge graph, mining effective association rules by using the Apriori algorithm, constructing a GNN model and introducing an attention mechanism for training and testing, and performing visualization and interaction design on the model. The system includes acquisition, knowledge graph, mining, model and analysis modules. The computer-readable storage medium and the processor can execute this method. Compared with the prior art, the present invention can integrate scattered data, accurately mine association rules, accurately identify threats with the help of the GNN model, conveniently view and analyze threat information through a visual interaction interface, comprehensively improve the ability and efficiency of power grid software supply chain security analysis, and provide strong support for power grid security protection.

[0302] Those of ordinary skill in the art will appreciate that the units of each example described in combination with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the components of each example have been generally described according to their functions in the above description. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0303] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored, etc.

[0304] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, read-only memories (ROMs), random access memories (RAMs), mobile hard disks, magnetic disks, or optical discs that can store program codes.

Claims

1. A software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model, characterized in that Including: S1: Collect data related to the security of the power grid software supply chain, preprocess and store it; S2: Construct a knowledge graph of the power grid software supply chain based on the collected data; S3: Use the Apriori algorithm to mine effective association rules in the knowledge graph; S4: Construct a GNN model, introduce an attention mechanism into the model, adjust the attention weights of nodes and edges according to the effective association rules, and then input the model for training and testing; S5: Perform visualization and interaction design on the model to facilitate the display and analysis of threat information.

2. The software supply chain security analysis method based on the fusion of knowledge graph and GNN model according to claim 1, wherein In step S2, the constructing a knowledge graph of the power grid software supply chain according to the collected data includes the following steps: S21: Select a database storage architecture that combines a graph database and a relational database according to the characteristics of the power grid software supply chain security data; S22: Use a database management tool and write a data import script to import the cleaned and integrated data into the corresponding database; S23: Take software as the core and construct a knowledge graph from data in different dimensions; S24: Establish indexes for commonly used query fields in the relational database and establish indexes for the key attributes of nodes in the graph database to accelerate the retrieval of associated data; S25: Establish a knowledge update and maintenance mechanism for the database, regularly obtain new data from the data collection end, and update the database; S26: Conduct knowledge verification and quality control during the data import and knowledge graph construction process.

3. The software supply chain security analysis method based on the fusion of knowledge graph and GNN model according to claim 2, characterized in that, In step S26, the conducting knowledge verification and quality control includes data integrity verification, data consistency verification, relationship accuracy verification, and data duplication verification.

4. The software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model according to claim 1, wherein In step S3, the using the Apriori algorithm to mine effective association rules in the knowledge graph includes the following steps: S31: Convert the data related to the knowledge graph into a transaction dataset, and each transaction consists of several items; S32: Set the minimum support threshold and the minimum confidence threshold; S33: Generate frequent item sets according to the minimum support threshold and the minimum confidence threshold; S34: Generate effective association rules according to the frequent item sets.

5. The software supply chain security analysis method based on the fusion of knowledge graph and GNN model according to claim 4, wherein In step S34, the generating effective association rules according to the frequent item sets includes the following steps: For each frequent item set, find all its non-empty proper subsets; For each non-empty proper subset, calculate the confidence of the association rule; Select the association rules with a confidence greater than or equal to the minimum confidence threshold as effective association rules.

6. The software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model according to claim 5, wherein The confidence calculation formula of the association rule is as follows: In the above formula, l is the frequent item set; s is a non-empty proper subset among all non-empty proper subsets; represents the association rule between the non-empty proper subset s and the non-empty proper subset l - s; represents the association rule confidence. support(l) and support(s) are the supports of the frequent item set l and the non-empty proper subset s respectively.

7. The software supply chain security analysis method based on the fusion of knowledge graph and GNN model according to claim 1, characterized in that, In step S4, the calculation formula for adjusting the attention weights of nodes and edges according to the effective association rules is as follows: Among them, V is the set of all nodes in the knowledge graph; v represents an ordinary node in the knowledge graph; v ′ represents any node in the set V of all nodes in the knowledge graph; r is an effective association rule; sim(v, r), sim(v ′ , r) respectively represent the similarity between the nodes v, v ′ and the effective association rule r, and the value range is [0, 1]; α v is the attention weight of the node v; R valid is the set of effective association rules; Among them, e represents an ordinary edge in the knowledge graph; e ′ represents any edge in the set E of all edges in the knowledge graph; α e is the attention weight of edge e; sim(e, r) represents the similarity between edge e and the effective association rule r, and the value range is [0, 1]; E is the set of all edges in the knowledge graph.

8. A software supply chain security analysis system based on the fusion of a knowledge graph and a GNN model, characterized in that, Applied to the software supply chain security analysis method based on the fusion of the knowledge graph and the GNN model according to any one of claims 1 to 7, including: An acquisition module for collecting data related to the security of the power grid software supply chain, preprocessing and storing it; A graph module for constructing a knowledge graph of the power grid software supply chain according to the collected data; A mining module for using the Apriori algorithm to mine effective association rules in the knowledge graph; A model module, which is used to build a GNN model, introduce an attention mechanism into the model, adjust the attention weights of nodes and edges according to valid association rules, and then input the model for training and testing; An analysis module, which is used to perform visualization and interaction design on the model to facilitate the display and analysis of threat information.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein when the program runs, it controls the device where the computer-readable storage medium is located to execute the software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model according to any one of claims 1 to 7.

10. A processor, characterized in that, The processor is used to run the program, wherein when the program runs, it executes the software supply chain security analysis method based on the fusion of a knowledge graph and a GNN model according to any one of claims 1 to 7.

Images