Knowledge graph construction and attack path prediction method for network security

Abstract

The invention belongs to the technical field of network security, and particularly discloses a network security knowledge graph construction and attack path prediction method, which comprises the following steps: acquiring an attack mode of network threat intelligence; constructing a network security knowledge graph based on the security vulnerability and attack pattern classification standard data and the attack pattern of the network threat intelligence; according to the method, an entity relationship in a network security knowledge graph is predicted based on a graph attention network GAT of text enhancement, an attack path is constructed based on the predicted entity relationship, and text enhancement is to introduce text information corresponding to entity nodes into a multi-head attention mechanism layer of the GAT. According to the method, the network security knowledge graph is constructed and the entity relationships are predicted based on the GAT, so that the entity relationships can be quickly integrated, the attack paths are constructed, the paths reveal security holes and attack modes which may be utilized by attackers, and accurate and efficient attack path prediction can be realized.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and more specifically, relates to a network security knowledge graph construction and attack path prediction method. Background Art

[0002] With the increasing importance of cybersecurity, cybersecurity training ranges have become a crucial component of cybersecurity infrastructure, playing a crucial role in improving cybersecurity protection capabilities and cultivating cybersecurity talent. As a platform for game-based simulation training, cybersecurity training ranges are crucial for training cyberattack and defense techniques, providing a controlled environment where security experts and researchers can simulate realistic cyber attacks and defenses. However, existing cybersecurity training ranges do not effectively address the design of systematic attack and defense structures. Cyberattack and defense involve identifying and predicting attack paths. Predicting attack paths allows defenders to more effectively and effectively defend against incoming attacks. Therefore, building an attack path prediction model can provide defenders with targeted protection strategies, thereby enhancing overall cybersecurity defense capabilities.

[0003] With the diversification and expansion of internet technologies, cyberattacks have become a major security risk hindering their development. To ensure cybersecurity, the deployment of protective measures such as firewalls and intrusion detection systems is currently a widely adopted defense. These measures achieve network defense by intercepting malicious requests and detecting and classifying network traffic. However, the complexity, stealth, and distributed nature of cyberattacks continue to pose a threat to network and information security. Against this backdrop, cyber threat intelligence has become a resource for combating cyberattacks. Threat intelligence involves collecting, analyzing, and sharing detailed information about cyberattacks, including attackers' strategies, techniques, procedures, and specific indicators and impacts of attack behavior. This information not only helps understand current security threats but also accelerates security responses, promotes the implementation of security controls, and prioritizes defensive measures. Therefore, by effectively utilizing cyber threat intelligence, organizations can strengthen their security defenses and improve their ability to provide early warning of impending attacks. Through the sharing of threat intelligence, threat detection in one organization can be transformed into preventative measures in another.

[0004] The core purpose of attack path prediction technology is to understand and predict attackers' likely attack strategies and paths by analyzing existing security threat intelligence. This technology can help defenders proactively deploy defensive measures, thereby more effectively preventing or mitigating the impact of cyberattacks. However, current attack path prediction technology has limitations, particularly in accurately identifying attackers' current strategies and methods.

[0005] It can be seen that how to accurately and efficiently predict attack paths is a technical problem that needs to be solved urgently in this field. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this application aims to accurately and efficiently predict attack paths. By deeply analyzing real-time information from cyber threat intelligence, potential attack patterns and tactics are extracted, providing attack dimension data for the knowledge graph. This knowledge graph is then used to predict attack paths and promote the development of cybersecurity target fields.

[0007] To achieve the above objectives, in a first aspect, the present application provides a method for constructing a network security knowledge graph and predicting attack paths, the method comprising: Attack patterns (ATT&CK ID) for cyber threat intelligence; Build a network security knowledge graph based on security vulnerability and attack pattern classification standard data (CVE, CWE, CAPEC) and attack patterns of network threat intelligence; The text-enhanced graph attention network (GAT) predicts entity relationships in the network security knowledge graph and constructs attack paths based on the predicted entity relationships. Text enhancement introduces the text information corresponding to the entity nodes into the multi-head attention mechanism layer of GAT.

[0008] Specifically, this application builds a comprehensive cybersecurity knowledge graph by integrating attack patterns (ATT&CK IDs) from cyber threat intelligence with standard data on vulnerability and attack pattern classifications (CVE, CWE, and CAPEC). This graph effectively links security information from different sources and types to form a structured knowledge system.

[0009] This method also utilizes a graph attention network (GAT) based on text augmentation. GAT, through its unique multi-head attention mechanism, effectively captures the relationships between entity nodes in a graph. The introduction of text augmentation further improves prediction accuracy. Specifically, it integrates the textual information corresponding to entity nodes into the GAT's multi-head attention layer, enabling the model to fully utilize this rich textual information when processing entity relationships, leading to a more accurate understanding of the connections between entities.

[0010] GAT can be used to predict the missing head entity or tail entity in the missing triple based on the network security knowledge graph. The complete triple is , h represents the head entity, t represents the tail entity, and r represents the relationship between the head entity and the tail entity. A type of missing triples is missing the tail entity, another type of missing triples The head entity is missing. , GAT can predict based on the network security knowledge graph The missing tail entity t in the prediction result Give a score (the higher the score, the more reliable the relationship). , GAT can predict based on the network security knowledge graph The missing head entity h in the prediction result Give a score.

[0011] Ultimately, based on GAT's predictions of entity relationships, we can quickly integrate these relationships and construct possible attack paths. These paths reveal potential security vulnerabilities and attack patterns that attackers might exploit. This approach enables accurate and efficient attack path prediction.

[0012] In one possible implementation, text enhancement is achieved through the following steps: For each entity node in the network security knowledge graph, generate the corresponding structural embedding representation and text description embedding representation of each entity node; Based on the structural embedding representation and text description embedding representation corresponding to each entity node, a connection vector representing the entity relationship (the potential relationship between the target node and its neighboring nodes) is generated through a multi-head attention mechanism layer. The attention parameter (or attention coefficient) between the entity node and its neighboring nodes is obtained based on the connection vector. Among them, the attention parameter is used to characterize the contribution of neighboring nodes in the process of aggregating (weighted summation) the features of neighboring nodes. The aggregated neighbor information obtained by aggregating the features of neighboring nodes is used to update the (embedded) representation of the entity node to achieve text enhancement of GAT.

[0013] The implementation principle of text enhancement is as follows: First, for each entity node in the cybersecurity knowledge graph, a structural embedding representation and a textual description embedding representation are generated. These two embedding representations capture the structural and textual information of the entity node, respectively. These embedding representations are then input into the multi-head attention mechanism layer of the GAT. In this layer, a connection vector representing the entity relationship (i.e., the potential relationship between the target node and its neighboring nodes) is generated based on the structural and textual description embedding representations of the entity node. Next, the attention parameters (or attention coefficients) between the entity node and its neighboring nodes are calculated using the connection vectors. These attention parameters quantify the contribution of each neighboring node in the process of aggregating neighboring node features. Finally, the neighboring node features are weighted and summed according to the attention parameters to obtain aggregated neighbor information. This aggregated neighbor information is used to update the entity node (embedding) representation, thereby achieving text enhancement for the GAT. In this way, text enhancement fully utilizes the textual information of the entity node, improving the accuracy and efficiency of the GAT in processing entity relationships.

[0014] It should be noted that traditional knowledge graph embedding methods mainly rely on the structural information of the graph to learn node representations. However, entities in knowledge graphs usually come with rich text descriptions. These textual information contains key features at the semantic level, but are not fully utilized by traditional methods. This application generates semantic embeddings by introducing text descriptions. The model can capture the deep semantic associations between entities and relationships, thereby making up for the limitations of relying solely on structural information. "Enhancement" is reflected in the splicing or fusion of text embeddings and structural embeddings to form a more comprehensive node representation.

[0015] Text enhancement can bring the following benefits: Information complementarity: combining the semantic associations of graph structures and the semantic features of text to form a more comprehensive entity representation; Enhance model expressiveness: Improve the accuracy and interpretability of link prediction by fusing multi-source information; Adapting to complex attack scenarios: In the field of network security, reasoning about attack paths often requires relying on both graph structures (such as vulnerability exploitation chains) and textual semantics (such as attack pattern descriptions).

[0016] In one possible implementation, for each entity node in the network security knowledge graph, generating a corresponding structural embedding representation and a text description embedding representation for each entity node includes: According to the triple information of the entity node, the TransE algorithm is used to generate a structural feature vector as the structural embedding representation corresponding to the entity node; According to the text description of the entity node, the sentence vector is obtained through the word2vec model; based on the sentence vector, the convolution feature space is scanned through the convolutional neural network to generate a text feature vector as the text description embedding representation corresponding to the entity node.

[0017] In one possible implementation, the attention parameter between the entity node and the neighboring nodes obtained based on the connection vector includes: Based on the connection vector, the attention parameters between the entity node and the neighbor nodes are obtained through linear transformation, activation function operation and normalization operation.

[0018] In one possible implementation, GAT is trained based on the following loss function: ; Among them, h represents the head entity, t represents the tail entity, and r represents the relationship between the head entity and the tail entity. represents a valid triple in the valid triple set S, Indicates an invalid triple in the set of invalid triples, It is obtained by randomly replacing the head entity or tail entity in the valid triple. Represents GAT triples The prediction score of Represents GAT triples The prediction score of is a hyperparameter.

[0019] Specifically, during the training process, the loss value can be obtained according to the loss function, and then the parameters of GAT can be updated through back propagation based on the loss value.

[0020] In one possible implementation, the attack mode for obtaining network threat intelligence includes: Based on network threat intelligence, the semantic representation corresponding to the network threat intelligence is extracted through a pre-trained language model; Based on the semantic representation of network threat intelligence, the sentences in the network threat intelligence are classified into two categories to filter out attack description sentences from the network threat intelligence. Extract attack phrases from attack description sentences; By analyzing the similarity between attack phrases and various attack patterns in the attack pattern knowledge base ATT&CK, the attack pattern number ATT&CK ID corresponding to the network threat intelligence is determined. The ATT&CK ID represents the attack pattern of the network threat intelligence.

[0021] Specifically, this application uses natural language processing technology to accurately identify attack patterns (ATT&CK IDs) from cyber threat intelligence. First, a pre-trained language model (such as BERT) is used to semantically encode the threat intelligence text to generate a deep semantic representation. Next, a binary classification model (such as a deep neural network-based classifier) is trained to distinguish between attack descriptions and non-attack descriptions, filtering out text fragments containing attack behaviors. Then, using dependency parsing and named entity recognition techniques, key attack phrases (such as "exploiting vulnerabilities to escalate privileges") are extracted from the attack description sentences. Finally, the semantic similarity between the attack phrases and attack patterns in the ATT&CK knowledge base is calculated (for example, by comparing embedding vectors using cosine similarity), matching the most relevant attack patterns and returning the corresponding standardized ATT&CK IDs. This method achieves an intelligent mapping of unstructured threat intelligence to structured attack patterns, providing standardized input for subsequent knowledge graph construction.

[0022] In one possible implementation, the security vulnerability and attack pattern classification standard data includes the following security knowledge: Security knowledge related to common vulnerabilities and exposures (CVE); Security knowledge related to Common Weakness Enumeration (CWE); Attack pattern enumeration and classification CAPEC-related security knowledge; Among them, each security knowledge and each attack mode of network threat intelligence serves as the entity node in the network security knowledge graph.

[0023] Specifically, security knowledge related to Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE), and Capacitive Attack Pattern Enumeration and Classification (CAPEC) is first integrated. This security knowledge represents different types of security vulnerabilities and attack patterns, forming an important foundation for building a knowledge graph. Next, this security knowledge, along with attack patterns from cyber threat intelligence, is used as entity nodes in the cybersecurity knowledge graph. These entity nodes are interconnected through their corresponding attributes and relationships, forming a structured knowledge system. In this way, the cybersecurity knowledge graph effectively connects security information from different sources and types, supporting subsequent cybersecurity analysis and defense.

[0024] In a second aspect, the present application provides a network security knowledge graph construction and attack path prediction device, including: Acquisition module, used to obtain attack patterns of network threat intelligence; A building block for constructing a network security knowledge graph based on standard data on security vulnerability and attack pattern classification and attack patterns from network threat intelligence; The prediction module is used to predict entity relationships in the network security knowledge graph based on the text-enhanced graph attention network (GAT) and construct attack paths based on the predicted entity relationships. Text enhancement introduces the text information corresponding to the entity nodes into the multi-head attention mechanism layer of GAT.

[0025] In a third aspect, the present application provides an electronic device comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0026] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0027] It can be understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0028] In general, the above technical solutions conceived by this application have the following beneficial effects compared with the existing technologies: This application constructs a comprehensive cybersecurity knowledge graph by integrating attack patterns (ATT&CK IDs) from cyber threat intelligence with standard data on security vulnerability and attack pattern classifications (CVE, CWE, and CAPEC). This method utilizes a text-enhanced Graph Attention Network (GAT) to capture the relationships between entity nodes in the graph through its unique multi-head attention mechanism. The textual information corresponding to the entity nodes is then integrated into the GAT's multi-head attention layer to improve prediction accuracy. Ultimately, based on GAT's predictions of entity relationships, it can quickly integrate these relationships to construct possible attack paths, revealing the security vulnerabilities and attack patterns that attackers may exploit, and achieving accurate and efficient attack path prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flowchart of a method for constructing a network security knowledge graph and predicting attack paths provided by an embodiment of the present application; Figure 2 This is an attack pattern extraction architecture diagram provided by an embodiment of the present application; Figure 3 This is a schematic diagram of the Neo4j database storage provided in the embodiment of the present application; Figure 4 This is a framework diagram of a graph attention mechanism based on text enhancement provided by an embodiment of the present application; Figure 5This is a schematic diagram of the structure of the network security knowledge graph construction and attack path prediction device provided by the embodiment of the present application; Figure 6 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0031] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0032] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more, for example, multiple processing units means two or more processing units, etc.; multiple elements means two or more elements, etc.

[0033] To address the multi-source heterogeneity and large-scale nature of attack prediction data, this application proposes an innovative knowledge graph reasoning model with a text-enhanced graph attention mechanism. This model effectively leverages node text information to enhance the reasoning capabilities of the cybersecurity knowledge graph and applies it to attack path prediction, significantly reducing the search complexity, time, and space costs of attack prediction, and enabling efficient prediction of attack paths.

[0034] To address the problem of insufficient attack dimension information when building a cybersecurity knowledge graph, this paper proposes a novel approach that extracts hidden attack patterns from Cyber Threat Intelligence (CTI) and supplements this information with Common Attack Pattern Enumeration and Classification (CAPEC). By mining potential attack patterns from threat reports and applying them to knowledge graph construction, it is possible to establish connections with attack techniques from the Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework. This provides a knowledge foundation for attack prediction and attack path construction, enabling more complete and practical attack path formation.

[0035] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0036] Figure 1 This is a flow chart of the method for constructing a network security knowledge graph and predicting attack paths provided by the embodiment of the present application. Figure 1 As shown, the method includes the following steps S101, S102, and S103.

[0037] Step S101, obtaining attack patterns of network threat intelligence; Step S102: constructing a network security knowledge graph based on the security vulnerability and attack pattern classification standard data and the attack pattern of network threat intelligence; In step S103, the text-enhanced graph attention network (GAT) predicts the entity relationships in the network security knowledge graph and constructs attack paths based on the predicted entity relationships. Text enhancement introduces the text information corresponding to the entity nodes into the multi-head attention mechanism layer of GAT.

[0038] Specifically, this application builds a comprehensive cybersecurity knowledge graph by integrating attack patterns (ATT&CK IDs) from cyber threat intelligence with standard data on vulnerability and attack pattern classifications (CVE, CWE, and CAPEC). This graph effectively links security information from different sources and types to form a structured knowledge system.

[0039] This method also utilizes a graph attention network (GAT) based on text augmentation. GAT, through its unique multi-head attention mechanism, effectively captures the relationships between entity nodes in a graph. The introduction of text augmentation further improves prediction accuracy. Specifically, it integrates the textual information corresponding to entity nodes into the GAT's multi-head attention layer, enabling the model to fully utilize this rich textual information when processing entity relationships, leading to a more accurate understanding of the connections between entities.

[0040] GAT can be used to predict the missing head entity or tail entity in the missing triple based on the network security knowledge graph. The complete triple is , h represents the head entity, t represents the tail entity, and r represents the relationship between the head entity and the tail entity. A type of missing triples is missing the tail entity, another type of missing triples The head entity is missing. , GAT can predict based on the network security knowledge graph The missing tail entity t in the prediction result Give a score (the higher the score, the more reliable the relationship). , GAT can predict based on the network security knowledge graph The missing head entity h in the prediction result Give a score.

[0041] Ultimately, based on GAT's predictions of entity relationships, we can quickly integrate these relationships and construct possible attack paths. These paths reveal potential security vulnerabilities and attack patterns that attackers might exploit. This approach enables accurate and efficient attack path prediction.

[0042] The following uses several examples to illustrate the network security knowledge graph construction and attack path prediction method provided by this application.

[0043] Example 1: Attack pattern extraction model based on network threat intelligence.

[0044] This application proposes an attack pattern extraction model based on network threat reports, using a natural language modeling approach. First, cybersecurity threat intelligence (CTI) is compiled and processed. Then, using binary classification techniques, sentences in the reports are classified as containing attack descriptions or not. This result is used to extract and fuse relevant entities from sentences containing attack descriptions to form attack pattern descriptions. Finally, using semantic correlation techniques, the extracted phrases are mapped to ATT&CK IDs, resulting in standardized ATT&CK technology.

[0045] Figure 2 This is the attack pattern extraction architecture diagram provided by the embodiment of the present application, such as Figure 2 As shown in the figure, the attack pattern extraction architecture consists of four parts: the Secure BERT model module, the relevant sentence extraction module, the attack phrase identification and extraction module (also known as the attack phrase extraction and fusion module), and the ATT&CK ID mapping module. The attack pattern extraction architecture uses the Secure BERT model to process threat reports step by step: from text classification to attack phrase extraction, and finally mapping to the ATT&CK framework. This overall process automatically extracts attack patterns from unstructured threat intelligence and standardizes them into ATT&CK IDs, providing dynamically updated attack dimension data for the cybersecurity knowledge graph, thereby supporting more efficient attack path prediction and defense strategy formulation.

[0046] Secure BERT model: This module is a pre-trained language model (SecureBERT) specifically tailored for the cybersecurity field. By improving the word segmenter (retaining common English vocabulary while adding security-related terminology) and targeted weight training (introducing noise to adjust weights to adapt to security-related semantics), the model's understanding of cybersecurity text is enhanced. Its core functions are to complete masked language modeling (MLM) and next sentence prediction (NSP) tasks, providing context-aware semantic representation for subsequent attack pattern extraction.

[0047] Here is a description of each network layer in the Secure BERT model: Embedding Layer: Embedding layer, converting text into vector representation; Mutil-Layer Encoder: Utility layer encoder, handles text encoding; Multi-Head Self Attention: Multi-head self-attention mechanism to capture contextual relationships in text; Feed Forward: Feedforward network layer, performing feature transformation; Layer Normalization: layer normalization to stabilize the training process; MLM and NSP: Masked language model and next sentence prediction tasks, the core pre-training tasks of BERT.

[0048] Relevant Sentence Extraction Module: This module uses Secure BERT to perform binary classification on sentences in threat reports (attack descriptions vs. non-attack descriptions). Using a self-attention mechanism and a feedforward neural network, it generates a contextual representation of the sentences and outputs the classification results. This module is used to filter sentences containing attack behaviors from unstructured text, reduce noise interference, and provide a high-quality data source for subsequent attack phrase extraction.

[0049] Here is an explanation of each network layer in the related sentence extraction module: Input Layer: receives the original input text; Preprocessing Layer: preprocess the text; Feature Encoding Layer: extracts text features; Feed Forward: further process features; Output Layer: output processing results; Classifier Head: Classification head, determines the relevance of sentences.

[0050] Attack phrase identification and extraction module: This module uses a sequence tagging model (such as CRF) to identify attack phrases (such as "DDoS attack" and "remote code execution") from filtered attack description sentences. After Secure BERT generates word vectors, it combines a multi-head attention mechanism and a CRF layer to capture contextual dependencies and combine consecutive B-Attack and I-Attack tokens into complete attack phrases, providing key input for attack pattern standardization. Here is a description of each network layer in the attack phrase identification and extraction module: Feature Encoding Layer: Feature encoding layer; Tokenization Layer: Tokenization layer (labeled as "Attack Phrase Extraction and Fusion"); CRF Layer: Conditional Random Field layer, used for sequence labeling; Extraction Layer: Extraction layer, identifying key attack phrases; Phrase Fusion Layer: Phrase fusion layer, integrating related phrases.

[0051] ATT&CK ID Mapping Module: This module maps extracted attack phrases to standardized technical IDs in the MITRE ATT&CK framework (e.g., T1566.001 - Phishing Attacks). Using sentence embedding models (e.g., Sentence-BERT), it calculates the cosine similarity between attack phrases and ATT&CK ID titles / descriptions. Combined with a weighted matching strategy, this module accurately maps unstructured attack descriptions to the standard framework, providing structured data support for knowledge graph construction and attack path prediction.

[0052] Here is a description of each network layer in the ATT&CK ID mapping module: Embedding Attack Phrase: Converts the identified attack phrase into a vector representation (labeled as "ATT&CK ID Mapping"). Cal Semantic Similarity: Calculates semantic similarity to measure the similarity between attack phrases and ATT&CK techniques; Mapping Determination: Determine the best-matching ATT&CK technology ID. Output Layer: Output layer, generates the final mapping result.

[0053] It is understandable that by regularly extracting and analyzing attack patterns from the latest cyber threat intelligence (CTI) reports and integrating this information into the knowledge graph, this approach aims to ensure that the knowledge graph can reflect the current threat situation in real time, thereby significantly improving the accuracy and efficiency of attack prediction.

[0054] In this way, this application not only improves the dynamic update capability of the knowledge graph, but also enhances the ability to capture the latest attack tactics, thereby providing real-time and accurate threat intelligence support for network security defense.

[0055] Experimental results show that compared with traditional methods, the attack pattern extraction and knowledge graph integration method proposed in this application can more accurately predict potential attack paths, providing a more efficient and real-time strategy for network security defense.

[0056] Example 2: Building a network security knowledge graph based on Neo4j.

[0057] Use BeautifulSoup to crawl and parse web pages for CVE (Common Vulnerabilities and Exposures), CWE (Common Weakness Enumeration), and CAPEC (Common Attack Pattern Enumeration and Classification), as well as collect data based on ATT&CK IDs extracted from cyber threat intelligence. For each CVE webpage, collect its textual description and corresponding CWE-ID (Common Weakness Enumeration unique identifier). Because attack patterns are crucial in CAPEC, use textual descriptions of each CAPEC information and the relationships between them. The collection process can be broadly divided into several steps: determine the data collection strategy and scope, including the purpose, scope, and intended use; identify the asset types to be collected (e.g., hosts, services, versions); and define security elements (e.g., vulnerabilities, configurations, etc.). Select appropriate tools (e.g., Nmap, OpenVAS, Shodan, etc.) for data collection. Use these tools to conduct a comprehensive scan of network assets and store the data in a database. The collected data is then processed and analyzed to identify key information such as port status, vulnerability risks, asset relationships, etc.

[0058] Neo4j is a graph-based database that uses a graphical structure to represent data and relationships. This structure makes connections between data more intuitive and easier to understand. Neo4j provides a rich API and tool set that enables developers to easily build, query, and operate graph databases. It can quickly process and analyze large datasets and support complex queries and operations. This enables knowledge graphs to be accessed and updated in real time or near real time, providing highly flexible data modeling capabilities and allowing users to define their own data types and relationships. This allows knowledge graphs to be customized to meet the needs of different industries.

[0059] In this application, Neo4j Desktop 1.4.15 was selected as the software platform for building the knowledge graph, and the Python programming language was combined with the py2neo library to implement interaction with the Neo4j graph database. Through py2neo, data addition, deletion, modification and query operations can be performed, and the visual display of the knowledge graph is supported. The research first involves the initialization of the database, including configuring the account and password on the local server to ensure that the structure of the knowledge graph and its dynamic changes can be intuitively observed through the browser interface. Then, various entity nodes (Node) and their mutual relationships (relationships) are imported in batches, and attributes are assigned to these entity nodes to better map concepts and relationships in the real world. This application constructs a knowledge graph containing 5416 entities based on the shooting range assets and the data collected above. The attributes can be viewed by observing and clicking on the nodes in the database through Neo4jDesktop. Figure 3 This is a schematic diagram of the Neo4j database storage provided in the embodiment of the present application.

[0060] Example 3: Attack path prediction based on knowledge graph.

[0061] Figure 4 This is a diagram of the graph attention mechanism framework based on text enhancement provided by the embodiment of the present application, such as Figure 4 As shown, the attack path prediction model adopts a link prediction framework based on the graph attention mechanism, aiming to map the attack path by predicting the potential relationships between entities in the knowledge graph. Faced with entities from different data sources and their complex interrelationships, this model innovatively introduces the use of text information corresponding to the entities to enhance the accuracy and depth of relationship predictions between different nodes. Specifically, the model first uses structural embedding technology and text description generation methods to construct vectorized representations of nodes and their related text. Subsequently, by introducing the attention mechanism layer, the model is able to focus on key information and generate connection vectors that represent entity relationships, thereby effectively achieving relationship prediction.

[0062] Relationship prediction is the underlying technology behind attack path prediction. It constructs a complete attack path by inferring relationships between entities layer by layer. Attack path prediction is a higher-level application of relationship prediction, aiming to provide interpretable threat scenario analysis for network security defense through multi-hop relationship reasoning. The combination of the two enables the model to expand from local relationship inference to global path analysis, significantly improving the proactiveness and accuracy of network security defenses.

[0063] This process not only optimizes the identification of entity relationships but also, by combining structured and textual data, enhances the model's understanding of potential threats in complex cybersecurity environments. This approach accurately reveals and predicts the strategies and attack sequences likely to be employed by attackers, providing a new and more efficient approach to cybersecurity protection. The following describes the detailed workflow of the attack path prediction model, including data preprocessing, generation of vectorized representations, application of the attention mechanism, and the final relationship prediction process.

[0064] The structural embeddings of the knowledge graph are trained using the Translating Embeddings (TransE) algorithm (a classic knowledge graph embedding method). This algorithm effectively encodes the structural information of entities and relationships, such as CVE, CWE, CAPEC, and ATT&CK IDs extracted from cyber threat intelligence. The textual descriptions of these entities are vectorized using the Word2Vec model and converted into numerical information to capture the semantic characteristics of the entities. These textual feature vectors are then combined with the structural feature vectors generated by TransE to form a rich entity representation that comprehensively considers both structural and textual information. Furthermore, the model introduces an attention mechanism layer that assigns weights to potential connections between entities, focusing on the most critical information during prediction. In this way, the text-enhanced Graph Attention Network (GAT) model can effectively predict possible entity relationships in the knowledge graph, providing strong technical support for uncovering links that are not directly observed.

[0065] (1) Structural embedding and description embedding generation; Embedding is performed through two strategies: structural embedding strategy, which performs structural embedding based on the TransE (TranslatingEmbeddings) model; and description embedding strategy, which generates text description embedding based on Word2Vec+CNN (convolutional neural network).

[0066] First, perform structural embedding: Based on the triple information of the node, TransE is used to train the triple as the initial structural embedding, avoiding the negative impact of ignoring the structural information in random initialization, effectively acquiring cross-database relational knowledge, and setting the dimension of this structural embedding vector to 100.

[0067] Then, description-embedding generation is performed to represent the text description of each CVE, CWE, and CAPEC, and to extract as many semantic knowledge features as possible. The text sentences are first processed and stemmed using NLTK, and the tokens (words) are sent to the widely used word2vec model. Each word x is converted into a vector of dimension 100, and all word vectors in each entity description are concatenated. The sentence length is set to 375 (maximum sentence length). If it is less than this value, 0 is appended as a replacement, and the relevant vector is initialized to 0, with a latitude of 100, and 375 is added. The sentence vectors of 100 are fed into a two-layer convolutional neural network (CNN) with a kernel width of 100 to scan the convolutional feature space and apply ReLU activation. The first CNN layer is followed by a k-max (k = 20) pooling layer to better represent frequent features and obtain location information in the feature space. The convolutional neural features are then sent to the second CNN layer. After ReLU activation, an average pooling layer is used to compress the neural features and obtain their average features across the entire series.

[0068] Finally, the structural feature vector (100 dimensions) generated by TransE and the text feature vector (100 dimensions) generated by CNN are concatenated into a 200-dimensional feature vector.

[0069] (2) (multi-head) attention layer; like Figure 4 As shown, the input of the multi-head attention layer includes the initial embedding vector of the head entity h, the relation r, and the tail entity t; the 2-hop neighbor entities of the head entity h and their relations. The output of the multi-head attention layer is the connection vector .

[0070] Specifically, after obtaining the vector representation of the combination of two vector representations, since entities play different roles through the relationships they link to, and 2-hop between entities accounts for the vast majority, an entity is used to obtain additional entity and relationship knowledge from its 2-hop neighbors. Based on this view, a multi-head attention neural network layer is proposed to extract those extended entity and relationship features to generate a connection vector , where h represents the head entity, t represents the tail entity, and r represents the relationship between the head entity and the tail entity. Inspired by the attention mechanism, a single-layer feedforward neural network is used, and the activation function LeakyReLU is used to calculate the attention weight of each neighbor node of entity h in the triple before normalization. .

[0071] ; W is the linear transformation matrix. In order to obtain the normalized attention value, a softmax layer is applied to update the attention parameters. .

[0072] ; in, represents the set of neighbor nodes of entity h, is the set of relationships between entity h and its neighbor nodes, so the embedding value of the entity is updated by the sum of the attention of all neighbor nodes after the normalization operation in the above formula.

[0073] Finally, a linear transformation is performed on the updated entity embedding values. The initial embedding value of the entity is added to the embedding values after other linear transformations to avoid losing its initial embedding information during the learning process, and the deeper neural features of entities and relations are learned through the multi-head attention neural network.

[0074] (3) Entity link prediction; like Figure 4 As shown, the entity link prediction part generates a connection vector through the multi-head attention mechanism , combined with the scoring function, predict the missing entities or relations in the knowledge graph (such as predicting the tail entity t or relation r). The input of the entity link prediction part is the connection vector , the output is the prediction result (such as the predicted tail entity or relationship ).

[0075] (4) Model training; Hinge-loss is used as the loss function for optimization. The formula is as follows: ; Where (h, r, t) represents a valid triple in the valid triple set S, Indicates an invalid triple in which the head entity or tail entity in the invalid triple set is randomly replaced. In addition, The form is: ; Where E represents the embedding matrix, h represents the head entity embedding vector, and t represents the tail entity embedding vector. Defines the L2 norm dissimilarity measure to be minimized for optimization Hyperparameters is a margin hyperparameter that determines the boundaries between correct and incorrect triplets and is set greater than 0.

[0076] The resulting 200-dimensional combined vector is passed through the attention layer, revealing that "EternalBlue" is associated with CVE-2017-0144, which in turn is associated with CAPEC-31. The attention weight indicates the importance of CAPEC-31 in predicting the attack path for the "EternalBlue" vulnerability. The attention value, normalized by the softmax function, is then used to update the embedding of "EternalBlue," resulting in a new embedding that combines structural information and information from multiple neighbors, reflecting the context of "EternalBlue" within the knowledge graph.

[0077] The following describes the network security knowledge graph construction and attack path prediction device provided by this application. The network security knowledge graph construction and attack path prediction device described below and the network security knowledge graph construction and attack path prediction method described above can be referenced to each other.

[0078] Figure 5 This is a schematic diagram of the structure of the network security knowledge graph construction and attack path prediction device provided by the embodiment of the present application. Figure 5 As shown, the device includes: an acquisition module 10, a construction module 20 and a prediction module 30. Among them: An acquisition module 10 is used to acquire attack patterns of network threat intelligence; A construction module 20 is used to construct a network security knowledge graph based on the security vulnerability and attack pattern classification standard data and the attack pattern of the network threat intelligence; The prediction module 30 is used to predict the entity relationships in the network security knowledge graph based on the text-enhanced graph attention network GAT, and to construct the attack path based on the predicted entity relationships. Text enhancement is to introduce the text information corresponding to the entity node into the multi-head attention mechanism layer of GAT.

[0079] It is understandable that the detailed functional implementation of each of the above units / modules can be found in the introduction of the aforementioned method embodiment, and will not be repeated here.

[0080] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method and will not be repeated here.

[0081] Based on the method in the above embodiment, an embodiment of the present application provides an electronic device, Figure 6 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 6As shown, the electronic device may include: a processor (Processor) 810, a communication interface (Communications Interface) 820, a memory (Memory) 830, and a communication bus 840. The processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the method in the above embodiment.

[0082] In addition, the logic instructions in the aforementioned memory 830 can be implemented in the form of a software functional unit and, when sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the portion that contributes to the prior art, or the portion of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application.

[0083] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.

[0084] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method in the above embodiment.

[0085] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0086] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and storage medium can be located in an ASIC.

[0087] The above embodiments can be implemented in whole or in part using software, hardware, firmware, or any combination thereof. When implemented using software, they can be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions. When loaded and executed on a computer, the computer program instructions fully or partially produce the processes or functions described in the embodiments of this application. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted via the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disk, hard disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state drive (SSD)).

[0088] It will be understood that the various numerical numbers involved in the embodiments of the present application are merely distinctions for the convenience of description and are not intended to limit the scope of the embodiments of the present application.

[0089] It is easy for those skilled in the art to understand that the above is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A network security knowledge graph construction and attack path prediction method, characterized in that: include: Attack patterns to obtain cyber threat intelligence; Build a network security knowledge graph based on security vulnerability and attack pattern classification standard data and attack patterns of network threat intelligence; The text-enhanced graph attention network (GAT) predicts entity relationships in the network security knowledge graph and constructs attack paths based on the predicted entity relationships. Text enhancement introduces the text information corresponding to the entity nodes into the multi-head attention mechanism layer of GAT.

2. The network security knowledge graph construction and attack path prediction method according to claim 1 is characterized in that: Text enhancement is achieved through the following steps: For each entity node in the network security knowledge graph, generate the corresponding structural embedding representation and text description embedding representation of each entity node; Based on the structural embedding representation and text description embedding representation corresponding to each entity node, a connection vector representing the entity relationship is generated through a multi-head attention mechanism layer, and the attention parameter between the entity node and its neighboring nodes is obtained based on the connection vector; Among them, the attention parameter is used to characterize the contribution of neighboring nodes in the process of aggregating the features of neighboring nodes. The aggregated neighbor information obtained by aggregating the features of neighboring nodes is used to update the representation of entity nodes to achieve text enhancement of GAT.

3. The network security knowledge graph construction and attack path prediction method according to claim 2 is characterized in that: The method of generating a structural embedding representation and a text description embedding representation corresponding to each entity node in the network security knowledge graph includes: According to the triple information of the entity node, the TransE algorithm is used to generate a structural feature vector as the structural embedding representation corresponding to the entity node; According to the text description of the entity node, the sentence vector is obtained through the word2vec model; based on the sentence vector, the convolution feature space is scanned through the convolutional neural network to generate a text feature vector as the text description embedding representation corresponding to the entity node.

4. The network security knowledge graph construction and attack path prediction method according to claim 2 is characterized in that: The method of obtaining the attention parameter between the entity node and the neighboring nodes based on the connection vector includes: Based on the connection vector, the attention parameters between the entity node and the neighbor nodes are obtained through linear transformation, activation function operation and normalization operation.

5. The network security knowledge graph construction and attack path prediction method according to claim 1 is characterized in that: GAT is trained based on the following loss function: ； Among them, h represents the head entity, t represents the tail entity, and r represents the relationship between the head entity and the tail entity. represents a valid triple in the valid triple set S, Indicates an invalid triple in the set of invalid triples, It is obtained by randomly replacing the head entity or tail entity in the valid triple. Represents GAT triples The prediction score of Represents GAT triples The prediction score of is a hyperparameter.

6. The network security knowledge graph construction and attack path prediction method according to claim 1 is characterized in that: The attack modes for obtaining network threat intelligence include: Based on network threat intelligence, the semantic representation corresponding to the network threat intelligence is extracted through a pre-trained language model; Based on the semantic representation of network threat intelligence, the sentences in the network threat intelligence are classified into two categories to filter out attack description sentences from the network threat intelligence. Extract attack phrases from attack description sentences; By analyzing the similarity between attack phrases and various attack patterns in the attack pattern knowledge base ATT&CK, the attack pattern number ATT&CK ID corresponding to the network threat intelligence is determined. The ATT&CK ID represents the attack pattern of the network threat intelligence.

7. The network security knowledge graph construction and attack path prediction method according to claim 1 is characterized in that: The security vulnerability and attack pattern classification standard data includes the following security knowledge: Security knowledge related to common vulnerabilities and exposures (CVE); Security knowledge related to Common Weakness Enumeration (CWE); Attack pattern enumeration and classification CAPEC-related security knowledge; Among them, each security knowledge and each attack mode of network threat intelligence serve as entity nodes in the network security knowledge graph.

8. A network security knowledge graph construction and attack path prediction device, characterized in that: include: Acquisition module, used to obtain attack patterns of network threat intelligence; A building block for constructing a network security knowledge graph based on standard data on security vulnerability and attack pattern classification and attack patterns from network threat intelligence; The prediction module is used to predict entity relationships in the network security knowledge graph based on the text-enhanced graph attention network (GAT) and construct attack paths based on the predicted entity relationships. Text enhancement introduces the text information corresponding to the entity nodes into the multi-head attention mechanism layer of GAT.

9. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed on a processor, the processor is caused to execute the method according to any one of claims 1 to 7.

Images