Construction and dynamic updating method of security management knowledge graph based on association modeling

Abstract

The present invention relates to a method for constructing and dynamically updating a security management knowledge graph based on association modeling. By collecting multi-source heterogeneous data in the field of security management, the data type is identified and data conversion is performed, an active learning mechanism is set in the named entity recognition model and training is performed, entities are identified from the data, and entities are extracted; an attention-enhanced graph neural network is constructed to analyze image data, and during the message transmission process, an attention weight is calculated for each node and edge, and the node information is updated to realize relationship extraction; based on entity and relationship data, a preliminary security management knowledge graph is constructed; missing information and relationships are inferred and supplemented based on an external standard knowledge base; data changes are detected in real time, and the security management knowledge graph is incrementally updated, and nodes and relationships are added or updated in the security management knowledge graph, so as to realize efficient construction and dynamic update of the security management knowledge graph and provide support for cross-modal intelligent question answering and real-time security assessment.

Description

Technical Field

[0001] The present invention belongs to the fields of artificial intelligence, knowledge graphs, data mining and security management technology, and in particular relates to a method for constructing and dynamically updating a security management knowledge graph based on association modeling. Background Art

[0002] In the field of safety management, data sources are extensive and diverse, including sensor data, video surveillance data, historical safety reports, on-site observation records, social media content, and more. These data sources are often heterogeneous, containing structured, semi-structured, and unstructured data. For example: sensor data includes temperature, humidity, smoke concentration, and CO2 concentration; video surveillance data is used to monitor safety conditions in real time and often includes images or video streams; and text data includes incident reports, safety guidelines, and other data, typically in natural language.

[0003] Due to the complex data sources and different formats, how to extract effective security management knowledge from these heterogeneous data and organize and update them efficiently has become a huge technical challenge.

[0004] Traditional knowledge graph construction methods often rely on structured data, such as tabular information in databases. However, in the field of security management, data is often unstructured, particularly text and video streams. Therefore, extracting effective information from this data and constructing a graph is a current research hotspot. Entity extraction focuses on extracting entities from information such as security incidents, risk sources, personnel, and equipment, while relationship extraction focuses on extracting relationships between entities, such as "trigger" and "association." These extraction processes require efficient technical support, particularly for identifying and establishing relationship chains across heterogeneous data sources.

[0005] Current technologies often rely on static, batch data processing methods, with insufficient support for dynamic data streams and real-time updates. Traditional methods often lack effective solutions, especially for processing and integrating cross-modal data.

[0006] Most current knowledge graphs only support static queries and are insufficient for dynamically changing security management scenarios and real-time incident response. Using reasoning mechanisms to infer unknown knowledge and applying knowledge graphs to efficient question-answering and other approaches is a pressing technical challenge.

[0007] Therefore, the present invention proposes a method for constructing and dynamically updating a security management knowledge graph based on association modeling, which aims to achieve dynamic updating of data, efficient extraction of knowledge, and cross-modal intelligent question and answer. Summary of the Invention

[0008] The purpose of the present invention is to provide a method for constructing and dynamically updating a security management knowledge graph based on association modeling, which is used to infer unknown knowledge through an inference mechanism, and to realize dynamic updating of data, efficient extraction of knowledge and cross-modal intelligent question and answer based on the knowledge graph.

[0009] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0010] The security management knowledge graph construction and dynamic update method based on association modeling includes the following steps:

[0011] S1: Collect multi-source heterogeneous data in the field of security management, create a data type recognition model to identify the data type, and select a matching data conversion method based on the recognition results to perform data conversion;

[0012] S2: Create a named entity recognition model. Set up an active learning mechanism in the named entity recognition model to automatically select data in the security management field for annotation and then train the named entity recognition model. Use the trained named entity recognition model to identify entities from the data and extract the entities.

[0013] S3: Build an attention-enhanced graph neural network to analyze image data. During message transmission, an attention weight is calculated for each node and edge, and node information is updated to achieve relationship extraction.

[0014] S4: Based on the entity and relationship data, a preliminary security management knowledge graph is constructed, where each node of the security management knowledge graph represents an entity, and each edge represents the relationship between entities;

[0015] S5: Obtain an external standard knowledge base to match entities and relationships in the preliminary security management knowledge graph, and infer and supplement its missing information and relationships;

[0016] S6: When new sensor data or video data flows in, the data changes are detected in real time and the security management knowledge graph is incrementally updated. When new data is reported, the system checks whether the new data exists in the current graph. If so, the nodes and relationships in the security management knowledge graph are dynamically updated through the real-time sensor data stream or video data stream. If not, the corresponding nodes and relationships are added to the security management knowledge graph.

[0017] Preferably, the specific process of step S1 is as follows:

[0018] S11: Collecting multi-source heterogeneous data including sensor data, video surveillance data, and text report data, and removing noise data and invalid data from the multi-source heterogeneous data;

[0019] S12: Create a data type recognition model and perform model training using the labeled data, input the multi-source heterogeneous data into the data type recognition model to perform data type recognition, and add corresponding data type labels to the data based on the data type recognition results;

[0020] S13: Establish a mapping relationship table between data types and conversion methods, map structured sensor data to a rule-based mapping conversion method, map unstructured video surveillance data to a computer vision combined with structured conversion method, map semi-structured text report data to a natural language processing combined with structured conversion method, search the mapping relationship table based on the data type recognition result to obtain the corresponding conversion method, and execute the corresponding conversion process.

[0021] Preferably, the specific process of rule mapping conversion of structured data is as follows:

[0022] Map the fields and values ​​of the original data to a unified target data format according to pre-defined conversion rules;

[0023] The specific process of combining computer vision with structured conversion of unstructured video surveillance data is as follows:

[0024] Use computer vision technology to extract key features, perform structured transformation on the extracted features, and form structured feature data;

[0025] The specific process of natural language processing combined with structured conversion of semi-structured text report data is as follows:

[0026] Use natural language processing technology to extract information and perform structural conversion. Through named entity recognition, relationship extraction, and text classification, we can extract entity, relationship, and attribute information from text and convert it into a structured data format.

[0027] For semi-structured data, it is converted into a unified structured data format, and the nodes and values ​​of the semi-structured data are mapped to the target data structure according to pre-defined mapping rules.

[0028] Preferably, the specific process of step S2 is as follows:

[0029] S21: Create a named entity recognition model. The named entity recognition model is based on the BERT model. 12 self-attention heads are set in the BERT model to implement the self-attention mechanism. The output layer predicts an entity label for each word through a softmax classifier.

[0030] S22: Confidence scoring is performed on the prediction results of the entity labels, and samples with confidence scores lower than a preset threshold are selected as samples with high uncertainty. The named entity recognition model automatically selects the samples with high uncertainty as text data in the field of security management for annotation and then trains the named entity recognition model.

[0031] S23: Input the converted data in step S1 into the trained named entity recognition model, output the entity recognition result, and extract the entity according to the entity recognition result.

[0032] Preferably, the specific process of step S3 is as follows:

[0033] S31: Construct a graph neural network. The graph neural network has a two-layer structure. The first layer has 64-dimensional input features and the second layer has 64-dimensional output features. Each layer contains 64 node features. The message passing layer contains an aggregation function that aggregates information about neighboring nodes and updates the representation of the current node.

[0034] S32: Setting an attention weight calculation module in the graph neural network, and calculating the attention of each node to the neighboring node and the attention weight of the corresponding edge through the attention weight calculation module;

[0035] S33: Based on the attention of each node to its neighboring nodes and the attention weight of the corresponding edge, the node information is updated to realize relationship extraction.

[0036] Preferably, the specific process of step S4 is as follows:

[0037] S41: Construct a preliminary security management knowledge graph. Nodes are represented using embedded vectors. Graph embedding technology is used to generate vector representations for each node. The constructed knowledge graph is represented as a graph G, G = (V, E), where V is the node set and E is the edge set. Nodes represent entities and edges represent relationships.

[0038] S42: Generate vector representations for entities and relationships through graph embedding for further reasoning and querying. The graph embedding representation formula is as follows:

[0039] ;

[0040] Where We∈R d×m , represents a trainable linear transformation matrix used to map node features from m dimensions to d dimensions of the embedding space; b e ∈R d Represents a trainable bias vector.

[0041] Preferably, the specific process of step S5 is as follows:

[0042] S51: Obtain an external standard knowledge base and perform entity extraction and relationship extraction on it;

[0043] S52: performing multi-layer matching on entities between the external standard knowledge base and the preliminary security management knowledge graph, dividing the entities of the two into surface feature entities, semantic feature entities, and structural feature entities, matching the surface feature entities of the two by string similarity, matching the semantic feature entities by embedding vector matching, and matching the structural feature entities by graph topology matching;

[0044] S53: Infer and supplement missing information and relationships based on the matching results.

[0045] Preferably, the specific process of step S6 is as follows:

[0046] When new sensor data or video data flows in, data changes are detected in real time. When new data is reported, the system checks whether the new data exists in the current graph. If so, the nodes and relationships in the security management knowledge graph are dynamically updated through the real-time sensor data stream or video data stream. If not, the corresponding nodes and relationships are added to the security management knowledge graph.

[0047] Preferably, after each update of the security management knowledge graph, the updated version is saved, and detailed information of each version update is recorded, providing a timestamp and version number for each version.

[0048] The beneficial effects of the present invention include:

[0049] The method for constructing and dynamically updating a security management knowledge graph based on association modeling provided by the present invention collects multi-source heterogeneous data in the field of security management, identifies data types and performs data conversion, sets an active learning mechanism in the named entity recognition model and performs training, identifies entities from the data, and extracts entities; constructs an attention-enhanced graph neural network to analyze image data, calculates an attention weight for each node and edge during message transmission, and updates node information to realize relationship extraction; constructs a preliminary security management knowledge graph based on entity and relationship data; infers and supplements missing information and relationships based on an external standard knowledge base; detects data changes in real time and incrementally updates the security management knowledge graph, adds or updates nodes and relationships in the security management knowledge graph, can efficiently construct and dynamically update the security management knowledge graph, and provide support for cross-modal intelligent question answering and real-time security assessment.

[0050] First, by creating a data type recognition model, we can accurately distinguish multi-source heterogeneous data types such as sensors, videos, and texts. By combining differentiated methods such as rule mapping, computer vision + structured conversion, and natural language processing + structured conversion, we can solve the problem of complex data formats and difficulty in unified analysis in the security management field, ensure the basic data quality for subsequent knowledge graph construction, and enable multi-dimensional security data to be effectively integrated into the knowledge graph system.

[0051] Secondly, using the BERT architecture with self-attention heads and an active learning mechanism, we automatically select and annotate high-value samples for training, improving the model's recognition accuracy for entities in the security management field while reducing manual annotation costs. This enables the knowledge graph to accurately capture core entities, laying a solid foundation for security management knowledge association and adapting to the diverse and dynamic nature of entities in security scenarios.

[0052] Thirdly, entity and relationship extraction, as well as clear mapping of security management entities and relationships between nodes and edges, and embedding vectors provide support for subsequent reasoning and querying, transforming security knowledge from scattered data into a structured, computable knowledge network. This facilitates security situation analysis and risk tracing, connects to external standard knowledge bases, and supplements missing information and relationships in the security management knowledge graph through multi-layer entity matching. The introduction of authoritative standards and industry norms improves the knowledge coverage and authority of the graph, effectively resolving the "knowledge island" problem of self-built knowledge graphs in enterprises.

[0053] Finally, updates are triggered by real-time inflow of sensor, video, and other data, and an incremental update mechanism ensures the graph's timeliness, enabling real-time security management monitoring and dynamic risk scenarios. Version storage, along with timestamps and version numbers, ensures traceability of knowledge graph updates, facilitating the review of security incident evolution and verification of management measures, providing full-cycle knowledge support for security decision-making. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a flow chart of the method for constructing and dynamically updating a security management knowledge graph based on association modeling according to the present invention. DETAILED DESCRIPTION

[0055] The following is combined with Figure 1 The present invention is described in further detail:

[0056] Example 1

[0057] See attached Figure 1 As shown, the method for constructing and dynamically updating a security management knowledge graph based on association modeling is characterized by comprising the following steps:

[0058] S1: Collect multi-source heterogeneous data in the field of security management, including sensor data, video surveillance data and text report data, create a data type recognition model to identify the data type, and select a matching data conversion method based on the recognition result to perform data conversion. Structured sensor data, unstructured video surveillance data and semi-structured text report data are converted in corresponding ways.

[0059] S2: Create a named entity recognition model, set up an active learning mechanism in the named entity recognition model to automatically select data in the security management field for annotation, and then train the named entity recognition model. The trained named entity recognition model can identify entities from the data and extract the entities.

[0060] S3: Build an attention-enhanced graph neural network to analyze image data. During message transmission, an attention weight is calculated for each node and edge, and node information is updated to achieve relationship extraction.

[0061] S4: Based on the entity and relationship data, a preliminary security management knowledge graph is constructed, where each node of the security management knowledge graph represents an entity, and each edge represents the relationship between entities;

[0062] S5: Obtain an external standard knowledge base to match entities and relationships in the preliminary security management knowledge graph, and infer and supplement its missing information and relationships;

[0063] S6: When new sensor data or video data flows in, the data changes are detected in real time and the security management knowledge graph is incrementally updated. When new data is reported, the system checks whether the new data exists in the current graph. If so, the nodes and relationships in the security management knowledge graph are dynamically updated through the real-time sensor data stream or video data stream. If not, the corresponding nodes and relationships are added to the security management knowledge graph.

[0064] In this embodiment, the specific process of step S1 is as follows:

[0065] S11: Collecting multi-source heterogeneous data including sensor data, video surveillance data, and text report data, and removing noise data and invalid data from the multi-source heterogeneous data;

[0066] S12: Create a data type recognition model and perform model training using the labeled data, input the multi-source heterogeneous data into the data type recognition model to perform data type recognition, and add corresponding data type labels to the data based on the data type recognition results;

[0067] S13: Establish a mapping relationship table between data types and conversion methods, map structured sensor data to a rule-based mapping conversion method, map unstructured video surveillance data to a computer vision combined with structured conversion method, map semi-structured text report data to a natural language processing combined with structured conversion method, search the mapping relationship table based on the data type recognition result to obtain the corresponding conversion method, and execute the corresponding conversion process.

[0068] The specific process of rule mapping conversion of structured data is as follows:

[0069] Map the fields and values ​​of raw data to a unified target data format based on pre-defined conversion rules. For example, convert temperature data collected by different sensors to a unified field name, data type, and unit to ensure data consistency and standardization.

[0070] The specific process of combining computer vision with structured conversion of unstructured video surveillance data is as follows:

[0071] Utilize computer vision technology to extract key features. For example, in fire surveillance videos, target detection algorithms are used to identify key targets such as flames and smoke in the video, and extract their location, shape, color, and other features. In human behavior surveillance videos, behavior recognition algorithms are used to analyze human behavior. The extracted features are then structured and converted to form structured feature data, such as representing the flame location as coordinate values ​​and the smoke concentration as a numerical value.

[0072] The specific process of natural language processing combined with structured conversion of semi-structured text report data is as follows:

[0073] Utilize natural language processing technology to extract information and perform structured conversion. Through named entity recognition, relationship extraction, text classification and other technologies, we can extract entity, relationship and attribute information from text and convert it into a structured data format. For example, we can extract information such as inspection time, inspection location, inspection items, and inspection results from a safety inspection report to form a structured record.

[0074] For semi-structured XML and JSON format data, they can be converted into a unified structured data format through a parser, and the nodes and values ​​in XML or JSON can be mapped to the target data structure according to pre-defined mapping rules.

[0075] Example 2

[0076] Based on Example 1, the specific process of step S2 is as follows:

[0077] S21: Create a named entity recognition model. The named entity recognition model is based on the BERT model. 12 self-attention heads are set in the BERT model to implement the self-attention mechanism. The formula of the self-attention mechanism is as follows:

[0078] ;

[0079] Among them, Q, K, and V are query, key, and value matrices respectively, and d k The dimension of the key vector is 768. The output layer predicts an entity label for each word through the softmax classifier. The entity label can be "fire" or "equipment".

[0080] S22: Confidence scores are performed on the prediction results of the entity labels, and samples with confidence scores lower than a preset threshold are selected as samples with high uncertainty. The named entity recognition model automatically selects the samples with high uncertainty as text data in the field of security management for annotation and then trains the named entity recognition model.

[0081] Compute confidence for unlabeled data: conf =1+ H ( p ) / log ( N ),in, H ( p ) is the entropy of the predicted probability distribution, N is the number of labels. Samples with a confidence score less than 0.6 are screened and assigned to domain experts for labeling. An incremental training strategy is adopted: in each round, samples with a confidence score less than 0.6 are selected and added to the training set to train the named entity recognition model.

[0082] S23: Input the converted data in step S1 into the trained named entity recognition model, output the entity recognition result, and extract the entity according to the entity recognition result.

[0083] The specific process of step S3 is as follows:

[0084] S31: Construct a graph neural network. The graph neural network has a two-layer structure. The first layer has 64-dimensional input features and the second layer has 64-dimensional output features. Each layer contains 64 node features. The message passing layer contains an aggregation function that aggregates the information of neighbor nodes and updates the representation of the current node:

[0085] ;

[0086] Among them, W (k) is the weight matrix of the kth layer, b (k) is the bias term, h i (k)is the representation of node i at the kth layer, N(i) is the set of neighbors of node i;

[0087] S32: Setting an attention weight calculation module in the graph neural network, and calculating the attention of each node to the neighboring node and the attention weight of the corresponding edge through the attention weight calculation module;

[0088] S33: Based on the attention of each node to its neighboring nodes and the attention weight of the corresponding edge, the node information is updated to realize relationship extraction.

[0089] The specific process of step S4 is as follows:

[0090] S41: Construct a preliminary security management knowledge graph. Nodes are represented using embedded vectors. Graph embedding technology is used to generate vector representations for each node. The constructed knowledge graph is represented as a graph G, G = (V, E), where V is the node set and E is the edge set. Nodes represent entities and edges represent relationships.

[0091] S42: Generate vector representations for entities and relationships through graph embedding for further reasoning and querying. The graph embedding representation formula is as follows:

[0092] ;

[0093] Where We∈R d×m , represents a trainable linear transformation matrix used to map node features from m dimensions to d dimensions of the embedding space; b e ∈R d Represents a trainable bias vector.

[0094] Example 3

[0095] Based on Example 1 or Example 2, the specific process of step S5 is as follows:

[0096] S51: Obtain external standard knowledge bases, including national security standards bases, industry security specifications, and authoritative security research institution knowledge bases, and perform entity extraction and relationship extraction on them;

[0097] S52: performing multi-layer matching on entities between the external standard knowledge base and the preliminary security management knowledge graph, dividing the entities of the two into surface feature entities, semantic feature entities, and structural feature entities, matching the surface feature entities of the two by string similarity, matching the semantic feature entities by embedding vector matching, and matching the structural feature entities by graph topology matching;

[0098] S53: Infer and supplement missing information and relationships based on the matching results. For example, if entity A "belongs to a security zone" and entity B "belongs to the same security zone," then "A and B have a network connection." Alternatively, based on the rule "Software has a vulnerability → Security patch required," the missing relationship "Patch required - Security patch A" can be inferred. After manual review of the inferences and supplements, the vulnerability information, patch relationships, and impact areas are added to the graph.

[0099] The specific process of step S6 is as follows:

[0100] When new sensor data or video data flows in, data changes are detected in real time. When new data is reported, the system checks whether the new data exists in the current graph. If so, the nodes and relationships in the security management knowledge graph are dynamically updated through the real-time sensor data stream or video data stream, so that the graph remains up to date without recalculation. The dynamic update mechanism updates nodes using the following formula: ; Among them, V new Represents the new feature entity after the node is updated, V old Represents the feature entity before the node is updated, M is the new feature entity of the real-time sensor data stream or video data stream. If not, the corresponding node and relationship are added to the security management knowledge graph.

[0101] After each update of the security management knowledge graph, the updated version is saved, and the detailed information of each version update is recorded, providing a timestamp and version number for each version.

[0102] For example, after a data update, the graph version becomes V1. The system records the details of this update and provides a timestamp and version number for each version. If security managers need to view historical versions, they can query historical versions V0, V1, V2, V3, etc. to trace back events.

[0103] In summary, the method for constructing and dynamically updating a security management knowledge graph based on association modeling provided by the present invention collects multi-source heterogeneous data in the field of security management, identifies data types and performs data conversion, sets an active learning mechanism in the named entity recognition model and performs training, identifies entities from the data, and extracts entities; constructs an attention-enhanced graph neural network to analyze image data, calculates an attention weight for each node and edge during message transmission, and updates node information to realize relationship extraction; constructs a preliminary security management knowledge graph based on entity and relationship data; infers and supplements missing information and relationships based on an external standard knowledge base; detects data changes in real time and incrementally updates the security management knowledge graph, adds or updates nodes and relationships in the security management knowledge graph, can efficiently construct and dynamically update the security management knowledge graph, and provide support for cross-modal intelligent question and answer and real-time security assessment.

[0104] By creating a data type recognition model to accurately distinguish heterogeneous data types from multiple sources, such as sensors, videos, and text, and combining differentiated methods such as rule mapping, computer vision + structured transformation, and natural language processing + structured transformation, we address the complex data formats and difficulty in unified analysis in the security management field. This ensures the quality of the basic data for subsequent knowledge graph construction and allows multi-dimensional security data to be effectively integrated into the knowledge graph system. Using BERT as the basic architecture with self-attention heads and an active learning mechanism, we automatically select high-value sample annotation training, improving the model's recognition accuracy for entities in the security management field while reducing manual annotation costs. This enables the knowledge graph to accurately capture core entities, laying a solid foundation for security management knowledge associations and adapting to the diverse and dynamically changing nature of entities in security scenarios.

[0105] By extracting entities and relationships, and clearly mapping security management entities and relationships between nodes and edges, embedding vectors support subsequent reasoning and querying, transforming security knowledge from fragmented data into a structured, computable knowledge network. This facilitates security situation analysis and risk tracing, connects to external standard knowledge bases, and supplements missing information and relationships in the security management knowledge graph through multi-layer entity matching. The introduction of authoritative standards and industry specifications improves the graph's knowledge coverage and authority, effectively resolving the "knowledge silos" problem of enterprise-built knowledge graphs. Updates are triggered by real-time influx of sensor, video, and other data, and an incremental update mechanism ensures graph timeliness, meeting the requirements of real-time security management monitoring and dynamic risk scenarios. Version preservation, along with timestamps and version number recording, ensures traceability of knowledge graph updates, facilitating the review of security incident evolution and verification of management measures' effectiveness, providing full-cycle knowledge support for security decision-making.

Claims

1. A security management knowledge graph construction and dynamic update method based on association modeling, characterized by: The following steps are involved: S1: Collect multi-source heterogeneous data in the field of security management, create a data type recognition model to identify the data type, and select a matching data conversion method based on the recognition results to perform data conversion; S2: Create a named entity recognition model. Set up an active learning mechanism in the named entity recognition model to automatically select data in the security management field for annotation and then train the named entity recognition model. Use the trained named entity recognition model to identify entities from the data and extract the entities. S3: Build an attention-enhanced graph neural network to analyze image data. During message transmission, an attention weight is calculated for each node and edge, and node information is updated to achieve relationship extraction. S4: Based on the entity and relationship data, a preliminary security management knowledge graph is constructed, where each node of the security management knowledge graph represents an entity, and each edge represents the relationship between entities; S5: Obtain an external standard knowledge base to match entities and relationships in the preliminary security management knowledge graph, and infer and supplement its missing information and relationships; S6: When new sensor data or video data flows in, the data changes are detected in real time and the security management knowledge graph is incrementally updated. When new data is reported, the system checks whether the new data exists in the current graph. If so, the nodes and relationships in the security management knowledge graph are dynamically updated through the real-time sensor data stream or video data stream. If not, the corresponding nodes and relationships are added to the security management knowledge graph.

2. The method for constructing and dynamically updating a security management knowledge graph based on association modeling according to claim 1 is characterized in that: The specific process of step S1 is as follows: S11: Collecting multi-source heterogeneous data including sensor data, video surveillance data, and text report data, and removing noise data and invalid data from the multi-source heterogeneous data; S12: Create a data type recognition model and perform model training using the labeled data, input the multi-source heterogeneous data into the data type recognition model to perform data type recognition, and add corresponding data type labels to the data based on the data type recognition results; S13: Establish a mapping relationship table between data types and conversion methods, map structured sensor data to a rule-based mapping conversion method, map unstructured video surveillance data to a computer vision combined with structured conversion method, map semi-structured text report data to a natural language processing combined with structured conversion method, search the mapping relationship table based on the data type recognition result to obtain the corresponding conversion method, and execute the corresponding conversion process.

3. The method for constructing and dynamically updating a security management knowledge graph based on association modeling according to claim 2 is characterized in that: The specific process of rule mapping conversion of structured data is as follows: Map the fields and values ​​of the original data to a unified target data format according to pre-defined conversion rules; The specific process of combining computer vision with structured conversion of unstructured video surveillance data is as follows: Use computer vision technology to extract key features, perform structured transformation on the extracted features, and form structured feature data; The specific process of natural language processing combined with structured conversion of semi-structured text report data is as follows: Utilize natural language processing technology to extract information and perform structural conversion. Through named entity recognition, relationship extraction, and text classification, we extract entity, relationship, and attribute information from text and convert it into a structured data format. For semi-structured data, it is converted into a unified structured data format, and the nodes and values ​​of the semi-structured data are mapped to the target data structure according to pre-defined mapping rules.

4. The method for constructing and dynamically updating a security management knowledge graph based on association modeling according to claim 3 is characterized in that: The specific process of step S2 is as follows: S21: Create a named entity recognition model. The named entity recognition model is based on the BERT model. 12 self-attention heads are set in the BERT model to implement the self-attention mechanism. The output layer predicts an entity label for each word through a softmax classifier. S22: Confidence scoring is performed on the prediction results of the entity labels, and samples with confidence scores lower than a preset threshold are selected as samples with high uncertainty. The named entity recognition model automatically selects the samples with high uncertainty as text data in the field of security management for annotation and then trains the named entity recognition model. S23: Input the converted data in step S1 into the trained named entity recognition model, output the entity recognition result, and extract the entity according to the entity recognition result.

5. The method for constructing and dynamically updating a security management knowledge graph based on association modeling according to claim 1 is characterized in that: The specific process of step S3 is as follows: S31: Construct a graph neural network. The graph neural network has a two-layer structure. The first layer has 64-dimensional input features and the second layer has 64-dimensional output features. Each layer contains 64 node features. The message passing layer contains an aggregation function that aggregates information about neighboring nodes and updates the representation of the current node. S32: Setting an attention weight calculation module in the graph neural network, and calculating the attention of each node to the neighboring node and the attention weight of the corresponding edge through the attention weight calculation module; S33: Based on the attention of each node to its neighboring nodes and the attention weight of the corresponding edge, the node information is updated to realize relationship extraction.

6. The method for constructing and dynamically updating a security management knowledge graph based on association modeling according to claim 1 is characterized in that: The specific process of step S4 is as follows: S41: Construct a preliminary security management knowledge graph, using embedded vectors to represent nodes and using graph embedding technology to generate vector representations for each node; S42: Generate vector representations for entities and relationships through graph embedding for further reasoning and querying.

7. The method for constructing and dynamically updating a security management knowledge graph based on association modeling according to claim 1 is characterized in that: The specific process of step S5 is as follows: S51: Obtain an external standard knowledge base and perform entity extraction and relationship extraction on it; S52: performing multi-layer matching on entities between the external standard knowledge base and the preliminary security management knowledge graph, dividing the entities of the two into surface feature entities, semantic feature entities, and structural feature entities, matching the surface feature entities of the two by string similarity, matching the semantic feature entities by embedding vector matching, and matching the structural feature entities by graph topology matching; S53: Infer and supplement missing information and relationships based on the matching results.

8. The method for constructing and dynamically updating a security management knowledge graph based on association modeling according to claim 1 is characterized in that: The specific process of step S6 is as follows: When new sensor data or video data flows in, data changes are detected in real time. When new data is reported, the system checks whether the new data exists in the current graph. If so, the nodes and relationships in the security management knowledge graph are dynamically updated through the real-time sensor data stream or video data stream. If not, the corresponding nodes and relationships are added to the security management knowledge graph.

9. The method for constructing and dynamically updating a security management knowledge graph based on association modeling according to claim 8 is characterized in that: After each update of the security management knowledge graph, the updated version is saved, and the detailed information of each version update is recorded, providing a timestamp and version number for each version.

Images