Method and device for generating early warning message

Abstract

The embodiment of the invention provides a method and device for generating an early warning message. The method comprises the following steps: determining a target sub-graph in a target knowledge graph according to a target time range; a target community is determined according to the target sub-atlas, the node in the target sub-atlas comprises at least one community label, the community label comprises a community identifier and a subordinate coefficient, the community label represents the community to which the node belongs, and the subordinate coefficient represents the probability of the community to which the node belongs; and generating an early warning message according to the target community. Through the method and the device, the technical problem of relatively low early warning accuracy caused by difficulty in discovering complex association modes and attack behaviors due to manual analysis of security events, behavior logs and alarm information in related technologies is solved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communications, and more specifically, to a method and apparatus for generating an early warning message. Background Art

[0002] As cybersecurity threats continue to evolve, businesses and organizations must not only respond to external attacks but also address potential internal threats. These internal threats can originate from internal employees, partners, suppliers, and other sources, potentially leading to security vulnerabilities or data leaks, either intentionally or unintentionally. Consequently, internal threat intelligence is gaining increasing attention. Through in-depth analysis of internal security events, behavior logs, and alerts, early warnings and intelligence on internal threats can be generated, helping companies better address these risks. Currently, manual analysis is often performed. However, manual analysis struggles to identify complex correlation patterns and attack behaviors, resulting in low alert accuracy and inefficiency.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] The embodiments of the present application provide a method and device for generating early warning messages to at least solve the technical problem in related technologies of low early warning accuracy due to the difficulty in discovering complex correlation patterns and attack behaviors through manual analysis of security events, behavior logs and alarm information.

[0005] According to one aspect of an embodiment of the present application, a method for generating a warning message is provided, comprising: determining a target subgraph in a target knowledge graph according to a target time range, wherein the target knowledge graph comprises: nodes, edges, node timestamps, and edge timestamps, wherein the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node timestamps represent the time of occurrence of the intelligence entities, and the edge timestamps represent the time when the relationships between the intelligence entities appear; determining a target community according to the target subgraph, wherein the nodes in the target subgraph include at least one community label, the community label includes a community identifier and a membership coefficient, the community label represents the community to which the node belongs, and the membership coefficient represents the probability of the community to which the node belongs; and generating a warning message according to the target community.

[0006] In an exemplary embodiment, determining a target community based on the target subgraph includes: assigning an initial community label to each node in the target subgraph; iteratively updating the initial community label; and stopping the iterative update when a preset condition is met, thereby obtaining the target community.

[0007] In an exemplary embodiment, iteratively updating the initial community label includes: determining neighbor nodes of the target node to obtain S neighbor nodes, where S is greater than or equal to 1, and the target subgraph includes the target node; and updating the community label of the target node according to the community label of each of the neighbor nodes.

[0008] In an exemplary embodiment, the community label of the target node is updated according to the community label of each of the neighboring nodes, including: determining the connection weight between the target node and each of the neighboring nodes to obtain S connection weights, wherein the connection weight is used to represent the number of times the relationship between the target node and the neighboring node occurs; and updating the community label of the target node according to the S connection weights and the community label of the neighboring nodes.

[0009] In an exemplary embodiment, the community label of the target node is updated based on the S connection weights and the community labels of the neighboring nodes, including: when the target node includes M community labels, determining the updated subordination coefficients of the M community labels based on the S connection weights and the community labels of the neighboring nodes to obtain M updated subordination coefficients, where M is an integer; and updating the community label of the target node based on the relationship between each of the updated subordination coefficients and a preset threshold.

[0010] In an exemplary embodiment, the community label of the target node is updated based on the relationship between each of the updated subordination coefficients and a preset threshold, including: determining an updated subordination coefficient greater than or equal to the preset threshold among the M updated subordination coefficients to obtain P first target subordination coefficients, where P is an integer less than or equal to M; and updating the community label of the target node based on the value of P.

[0011] In an exemplary embodiment, the community label of the target node is updated according to the value of P, including: when P is zero, randomly selecting Y community labels from the M community labels included in the target node to determine the updated community label of the target node; when P is non-zero, normalizing the P first target subordination coefficients to obtain P second target subordination coefficients; and determining each of the second target subordination coefficients and the corresponding community identifier as the updated community label of the target node.

[0012] In an exemplary embodiment, a target subgraph is determined in a target knowledge graph according to a target time range, including: determining nodes corresponding to node timestamps in the target knowledge graph that are within the target time range as nodes in the target subgraph; and determining edges corresponding to edge timestamps in the target knowledge graph that are within the target time range as edges in the target subgraph.

[0013] In an exemplary embodiment, after determining the target community based on the target subgraph, the method further includes: adding an abstract node in the target community, wherein the abstract node is used to represent the attack target; and establishing a relationship between each node in the target community and the abstract node.

[0014] According to another aspect of an embodiment of the present application, a device for generating a warning message is also provided, including: a first determination module, used to determine a target subgraph in a target knowledge graph according to a target time range, wherein the target knowledge graph includes: nodes, edges, node timestamps, and edge timestamps, the nodes represent intelligence entities, the edges represent the relationships between the intelligence entities, the node timestamps represent the appearance time of the intelligence entities, and the edge timestamps represent the time when the relationships between the intelligence entities appear; a second determination module, used to determine a target community according to the target subgraph, wherein the nodes in the target subgraph include community labels, and the community labels include community identifiers and membership coefficients; a generation module, used to generate a warning message according to the target community.

[0015] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0016] According to another aspect of the embodiments of the present application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of any of the above-described method embodiments.

[0017] According to another aspect of the embodiments of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the steps of any of the above method embodiments through the computer program.

[0018] Through this application, since the target subgraph is determined in the target knowledge graph according to the target time range, the target knowledge graph includes: nodes, edges, node timestamps, edge timestamps, nodes represent intelligence entities, edges represent the relationship between the intelligence entities, node timestamps represent the appearance time of the intelligence entity, and edge timestamps represent the time when the relationship between the intelligence entities appears; the target community is determined in the target subgraph, and the nodes in the target knowledge graph include community labels, and the community labels represent the community to which the node belongs, as well as the probability of belonging to the community; and an early warning message is generated according to the target community. Therefore, the problem of low early warning accuracy caused by the difficulty in discovering complex correlation patterns and attack behaviors when manually analyzing security events, behavior logs, and alarm information can be solved, thereby achieving the effect of improving the accuracy of early warnings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a schematic diagram of an application scenario of a method for generating a warning message according to an embodiment of the present application;

[0020] Figure 2 This is a flowchart of an optional method for generating a warning message according to an embodiment of the present application;

[0021] Figure 3 It is a structural block diagram of a device for generating early warning messages. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] According to one aspect of the embodiment of the present application, a method for generating a warning message is provided. Optionally, in this embodiment, the method for generating a warning message can be applied to, but is not limited to, Figure 1 The hardware environment shown includes a terminal device 102 and a server 104. The server 104 can be connected to the terminal device 102 via a network and can be used to provide services (e.g., application services, etc.) for the terminal device 102 or a client installed on the terminal device 102. A database can be set on the server 104 or independently of the server 104 to provide data storage services for the server 104.

[0025] The aforementioned network may include, but is not limited to, at least one of the following: a wired network and a wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: a wide area network, a metropolitan area network, or a local area network. The aforementioned wireless network may include, but is not limited to, at least one of the following: Wi-Fi (Wireless Fidelity) and Bluetooth. The terminal device 102 may be, but is not limited to, a personal computer (PC), a mobile phone, a tablet computer, etc. The server 104 may be, but is not limited to, a cloud server, a server cluster, or other server types.

[0026] The method for generating a warning message according to the embodiment of the present application may be executed by the server 104, or by the terminal device 102, or jointly by the server 104 and the terminal device 102. The method for generating a warning message according to the embodiment of the present application may also be executed by the client installed on the terminal device 102.

[0027] Taking the method of generating a warning message in this embodiment executed by the server 104 as an example, Figure 2 This is a flow chart of an optional method for generating a warning message according to an embodiment of the present application, such as Figure 2 As shown, the process of the method may include the following steps:

[0028] Step S202: determining a target subgraph in a target knowledge graph according to a target time range, wherein the target knowledge graph includes: nodes, edges, node timestamps, and edge timestamps, wherein the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node timestamps represent the time when the intelligence entities appear, and the edge timestamps represent the time when the relationships between the intelligence entities appear;

[0029] Before step S202, the target knowledge graph can be constructed as follows:

[0030] Obtain threat intelligence, identify intelligence entities in the threat intelligence, and create the above-mentioned target knowledge graph based on the relationship between each intelligence entity in the threat intelligence.

[0031] Specifically, various security event data, alarm logs, and behavior analysis logs can be collected from internal enterprise security devices and systems. Data sources include honeypots, which record the attacker's IP address, attack time, number of attacks, and attack methods. Desktop management software analyzes malware, malicious URLs, suspicious files, and other information. Antivirus software detects and generates threat intelligence such as malware and virus hash values.

[0032] Represent the collected threat intelligence data as a graph structure and create a target knowledge graph:

[0033]

[0034] Node V: Various intelligence entities, such as IP addresses, file hashes, domain names, attack methods, attackers, etc.

[0035] Edge E: represents the relationship between nodes (i.e., the relationship between intelligence entities), such as "the association between IP address node and file hash node", "the attacker node and the used attack method node, etc."

[0036] Add a node timestamp (e.g., Linux timestamp attribute) to each node to indicate the time when the intelligence entity appears or is updated. Add an edge timestamp (e.g., Linux timestamp attribute) to each edge to indicate the time when the relationship appears or is updated.

[0037] For example, "if an address node is identified as malicious in the database, the node timestamp of the address node in the target knowledge graph will be updated synchronously", "if an attacker uses an attack method to attack at a certain attack time, the edge timestamp between the attacker and the attack method in the target knowledge graph will be updated synchronously".

[0038] The target subgraph can be determined in the target knowledge graph in the following manner: the nodes corresponding to the node timestamps in the target knowledge graph that are within the target time range are determined as nodes in the target subgraph; the edges corresponding to the edge timestamps in the target knowledge graph that are within the target time range are determined as edges in the target subgraph.

[0039] For example, you can set a time window to analyze threat intelligence within a historical time range (the time window size can be set based on actual conditions. For example, setting a time window of 30 days will analyze threat intelligence from the past 30 days). Analyze at preset intervals (the preset interval can be set based on actual conditions, such as once a day or once a week).

[0040] The nodes and edges within the selected target time range can be filtered out according to the node timestamps and edge timestamps in the knowledge graph to form a target subgraph , a subset of nodes Indicates that only the nodes and edge subsets whose node timestamps are within the selected target time range are retained Only edges with timestamps within the selected target time range are retained.

[0041] In the above embodiment, a target knowledge graph is created based on the relationships between intelligence entities, and node and edge timestamps are added to the target knowledge graph. Nodes and edges within the target time range are filtered using timestamps to obtain a target subgraph. This allows the identification of active attack groups or activities within the target time range, and the dynamic expansion of the intelligence graph allows for the capture of potential threat changes.

[0042] Step S204: determining a target community according to the target subgraph, wherein the node in the target subgraph includes at least one community label, and the community label includes a community identifier and a membership coefficient;

[0043] Specifically, an initial community label is assigned to each node in the target subgraph; the initial community label is iteratively updated; and the iterative update is stopped when a preset condition is met, thereby obtaining the target community.

[0044] Assign an initial community label to each node in the target subgraph. The initial community label consists of a community identifier and a membership coefficient. The community identifier represents the community to which the node belongs, which can be a community number or community name. The membership coefficient represents the probability that the node belongs to the community. A node can have multiple community labels, indicating that the node can belong to different communities and the probability of belonging to each community.

[0045] In the initial case, the community identifiers assigned to different nodes may be different. For example, each node is assigned a community identifier, and the identifiers assigned to different nodes are different. The membership coefficients may be set to the same value.

[0046] In each iteration, a node updates its own community label based on the community labels and connection weights of its neighboring nodes.

[0047] Specifically, the neighbor nodes of the target node are determined to obtain S neighbor nodes, where S is greater than or equal to 1, and the target subgraph includes the target node; and the community label of the target node is updated according to the community label of each of the neighbor nodes.

[0048] Determine a connection weight between the target node and each of the neighbor nodes to obtain S connection weights, wherein the connection weight is used to represent the number of times the relationship between the target node and the neighbor node occurs;

[0049] The community label of the target node is updated according to the S connection weights and the community labels of the neighboring nodes.

[0050] in, is the set of all neighbor nodes of the target node, including the above S neighbor nodes, S is greater than or equal to 1, and the target subgraph includes the target node. Indicates the connection weight between node x and node y. The connection weight is determined by the number of node associations. For example, if the node "IP address 111.111.111.11" and the node "Location Shanghai" are associated twice in different threat intelligence, the weight is 2, and the connection weight is 2.

[0051] The connection weights between each node in the target subgraph and its neighboring nodes can be represented by the following matrix:

[0052]

[0053] n represents the number of nodes.

[0054] In an exemplary embodiment, updating the community label of the target node according to the S connection weights and the community labels of the neighboring nodes includes:

[0055] In a case where the target node includes M community labels, determining updated membership coefficients of the M community labels according to the S connection weights and the community labels of the neighboring nodes to obtain M updated membership coefficients, where M is an integer;

[0056] The community label of the target node is updated according to the relationship between each updated membership coefficient and a preset threshold.

[0057] Determining updated membership coefficients of the M community labels according to the S connection weights and the community labels of the neighboring nodes to obtain the M updated membership coefficients includes:

[0058] The updated membership coefficient of the i-th community label is determined by the following formula, where the i-th community label is any one of the M community labels of the target node, and i is an integer:

[0059] The sum of the connection weights between the target node and each of the neighboring nodes is determined as a first target sum; that is, the first target sum is the following formula:

[0060]

[0061] Among them, x represents the target node, y represents the neighbor node, N(x) is the set of all neighbor nodes of the target node, is the connection weight between the target node x and the neighbor node y, and S1 is the first target sum.

[0062] The product sum of the membership coefficients in the community labels of all neighbor nodes and the corresponding connection weights is determined as the second target sum, that is, the second target sum is as follows:

[0063]

[0064] Among them, x represents the target node, y represents the neighbor node, N(x) is the set of all neighbor nodes of the target node, is the connection weight between the target node x and the neighbor node y, is the community identifier of neighbor node y The membership coefficient of , S2 is the second objective and .

[0065] The ratio of the first target sum to the second target sum is determined as the updated membership coefficient of the i-th community label, that is:

[0066]

[0067] in, is the community identifier of the target node x The membership coefficient of the i-th community label includes: community identifier and community identifiers The membership coefficient of .

[0068] The preset threshold value may be:

[0069] This threshold is used to filter the target node's community label. v represents the maximum number of communities a node can belong to (the specific value can be set according to the actual situation). If it is known that each node will be assigned to multiple communities, then the v value will be set as large as possible, otherwise it will be set as small as possible.

[0070] In an exemplary embodiment, the community label of the target node is updated based on the relationship between each of the updated subordination coefficients and a preset threshold, including: determining an updated subordination coefficient greater than or equal to the preset threshold among the M updated subordination coefficients to obtain P first target subordination coefficients, where P is an integer less than or equal to M; and updating the community label of the target node based on the value of P.

[0071] Specifically, when P is zero, Y community labels are randomly selected from the M community labels included in the target node to determine the updated community label of the target node; when P is non-zero, the P first target subordination coefficients are normalized to obtain P second target subordination coefficients; each of the second target subordination coefficients and the corresponding community identifier is determined as the updated community label of the target node.

[0072] The filtering rule is as follows: if the update membership coefficient of a community tag is lower than the threshold, the tag is deleted. If all tags are lower than the threshold, Y tags (for example, 1) can be randomly retained and the remaining community tags are deleted.

[0073] After each filtering is completed, all remaining subordinate coefficients are normalized to ensure that the sum is 1. Normalization is to normalize each remaining label The membership coefficient of is divided by the sum of the membership coefficients of all remaining labels, that is, normalized by the following formula:

[0074]

[0075] The normalized membership coefficient, is the membership coefficient before normalization, are the remaining tags, is the sum of the membership coefficients of all remaining labels.

[0076] The above iterative process is repeated until the community labels of all nodes no longer change, that is, the convergence state is reached, or a custom maximum number of iterations is reached.

[0077] Step S206: Generate an early warning message according to the target community.

[0078] Through the embodiments provided in this application, various intelligence entities (such as IP addresses, file hashes, attack methods, etc.) are connected through associations to construct a threat intelligence graph (knowledge graph). This allows the discovery of complex association patterns and attack behaviors, allowing for more effective analysis and understanding of endogenous threats, further improving the efficiency of threat intelligence analysis.

[0079] Analyze the target sub-graph to identify the attack groups and activity patterns that are active in the target sub-graph within the target time range. For example, identify the high-risk IP addresses, malicious file hashes, and attack methods related to a certain group that belong to the same community. For example, if many IP addresses in a community are associated with the same geographic location, it may indicate that the attack group's activities are concentrated in a specific area or through a transit server. For example, the following entity nodes exist in the original target knowledge graph:

[0080] IP address: 111.111.111.11;

[0081] File hash: abc123;

[0082] Malware: malware.exe;

[0083] Attack method: DDoS;

[0084] Location: Shanghai;

[0085] After iterative updates of community labels, it is determined that these nodes belong to a target community .

[0086] In an exemplary embodiment, after determining the target community based on the target subgraph, the method further includes: adding an abstract node in the target community, wherein the abstract node is used to represent the attack target; and establishing a relationship between each node in the target community and the abstract node.

[0087] If multiple nodes belong to a target community , there are connections in the target subgraph. In the extended graph, a new abstract node is added. , mapping represents the original target community, and then Connect to the nodes belonging to the target community in the target graph through edges:

[0088] ->111.111.111.11

[0089] ->abc123

[0090] ->malware.exe

[0091] ->DDoS

[0092] ->Shanghai

[0093] This newly expanded The abstract representation represents a specific attack group or activity pattern. The timestamp of the extracted node is calculated as the average of the timestamps of its connected nodes. This ensures that the original node representation remains unchanged. The connection between the community node and the original node helps reveal the tools, targets, and techniques used in the group's activities, thereby expanding the endogenous threat intelligence map.

[0094] The above-described embodiments improve the accuracy of threat intelligence detection. By adding community tags to the knowledge graph, closely related intelligence entities can be more accurately identified, forming more meaningful intelligence communities. The generation of community nodes helps enterprises better understand attack groups and attack behavior patterns. The community segmentation and expansion capabilities effectively reduce the workload of manual analysis, enhance the scalability of the threat intelligence graph, help enterprises capture more potential attack behaviors, and improve the automation level of security analysis.

[0095] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

[0096] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, or of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as ROM (Read-Only Memory, Read-Only Memory) / RAM (Random Access Memory, Random Access Memory), a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the method described in each embodiment of the present application.

[0097] According to another aspect of the embodiments of the present application, a device for generating a warning message is also provided. The device for generating a warning message can be used to implement the method for generating a warning message provided in the above-mentioned embodiment, and will not be repeated hereafter. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0098] Figure 3 This is a structural block diagram of an optional device for generating a warning message according to an embodiment of the present application, such as Figure 3 As shown in , the device for generating an early warning message includes:

[0099] A first determination module 302 is configured to determine a target subgraph in a target knowledge graph according to a target time range, wherein the target knowledge graph includes nodes, edges, node timestamps, and edge timestamps, wherein the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node timestamps represent the time when the intelligence entities appear, and the edge timestamps represent the time when the relationships between the intelligence entities appear;

[0100] A second determination module 304 is configured to determine a target community based on the target subgraph, wherein the nodes in the target subgraph include community labels, and the community labels include a community identifier and a membership coefficient;

[0101] The generating module 306 is configured to generate an early warning message according to the target community.

[0102] In an exemplary embodiment, the apparatus is further configured to assign an initial community label to each node in the target subgraph; iteratively update the initial community label; and stop the iterative update when a preset condition is met, thereby obtaining the target community.

[0103] In an exemplary embodiment, the above-mentioned device is also used to determine the neighbor nodes of the target node, obtaining S neighbor nodes, where S is greater than or equal to 1, and the target subgraph includes the target node; and the community label of the target node is updated according to the community labels of each of the neighbor nodes.

[0104] In an exemplary embodiment, the above-mentioned device is also used to determine the connection weight between the target node and each of the neighbor nodes to obtain S connection weights, wherein the connection weight is used to represent the number of times the relationship between the target node and the neighbor node occurs; and the community label of the target node is updated according to the S connection weights and the community label of the neighbor node.

[0105] In an exemplary embodiment, the above-mentioned device is also used to determine the updated subordination coefficients of the M community labels based on the S connection weights and the community labels of the neighboring nodes when the target node includes M community labels, so as to obtain M updated subordination coefficients, where M is an integer; and update the community label of the target node based on the relationship between each updated subordination coefficient and a preset threshold.

[0106] In an exemplary embodiment, the above-mentioned device is also used to determine an updated subordination coefficient greater than or equal to the preset threshold among the M updated subordination coefficients to obtain P first target subordination coefficients, where P is an integer less than or equal to M; and update the community label of the target node according to the value of P.

[0107] In an exemplary embodiment, the above-mentioned device is also used to randomly select Y community tags from the target node including M community tags when P is zero to determine the updated community tag of the target node; when P is non-zero, normalize the P first target subordination coefficients to obtain P second target subordination coefficients; and determine each of the second target subordination coefficients and the corresponding community identifier as the updated community tag of the target node.

[0108] In an exemplary embodiment, the above-mentioned device is also used to determine the nodes corresponding to the node timestamps within the target time range in the target knowledge graph as nodes in the target sub-graph; and determine the edges corresponding to the edge timestamps within the target time range in the target knowledge graph as edges in the target sub-graph.

[0109] In an exemplary embodiment, the above-mentioned device is further used to, after determining the target community based on the target subgraph, add an abstract node in the target community, wherein the abstract node is used to represent the attack target; and establish a relationship between each node in the target community and the abstract node.

[0110] It should be noted that the above modules can be implemented through software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0111] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein the program executes the steps of any of the above method embodiments when it is run.

[0112] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, a ROM, a RAM, a mobile hard disk, a magnetic disk, or an optical disk.

[0113] According to another aspect of the embodiments of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor is configured to execute the steps of any of the above-described method embodiments through the computer program. In an exemplary embodiment, the electronic device may further comprise a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0114] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0115] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0116] According to another aspect of the embodiments of the present application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of any of the above-described method embodiments.

[0117] According to another aspect of the embodiments of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the steps of any of the above method embodiments through the computer program.

[0118] Obviously, those skilled in the art should understand that the modules or steps of the present application described above can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices, they can be implemented using program code executable by the computing device, and thus, they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than herein, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0119] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for generating an early warning message, characterized in that: include: Determine a target subgraph in a target knowledge graph according to a target time range, wherein the target knowledge graph includes: nodes, edges, node timestamps, and edge timestamps, wherein the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node timestamps represent the time when the intelligence entities appear, and the edge timestamps represent the time when the relationships between the intelligence entities appear; Determining a target community according to the target subgraph, wherein the node in the target subgraph includes at least one community label, the community label includes a community identifier and a membership coefficient, the community label indicates the community to which the node belongs, and the membership coefficient indicates the probability that the node belongs to the community; An early warning message is generated based on the target community.

2. The method according to claim 1, characterized in that Determining a target community according to the target subgraph includes: Assigning an initial community label to each node in the target subgraph; Iteratively updating the initial community label; When a preset condition is met, the iterative update is stopped to obtain the target community.

3. The method according to claim 2, characterized in that Iteratively updating the initial community labels includes: Determine neighbor nodes of the target node to obtain S neighbor nodes, where S is greater than or equal to 1, and the target subgraph includes the target node; The community label of the target node is updated according to the community labels of each of the neighboring nodes.

4. The method according to claim 3, characterized in that Updating the community label of the target node according to the community labels of each of the neighboring nodes includes: Determine a connection weight between the target node and each of the neighbor nodes to obtain S connection weights, wherein the connection weight is used to represent the number of times the relationship between the target node and the neighbor node occurs; The community label of the target node is updated according to the S connection weights and the community labels of the neighboring nodes.

5. The method according to claim 4, characterized in that Updating the community label of the target node according to the S connection weights and the community labels of the neighboring nodes includes: In a case where the target node includes M community labels, determining updated membership coefficients of the M community labels according to the S connection weights and the community labels of the neighboring nodes to obtain M updated membership coefficients, where M is an integer; The community label of the target node is updated according to the relationship between each updated membership coefficient and a preset threshold.

6. The method according to claim 5, characterized in that Updating the community label of the target node according to the relationship between each updated membership coefficient and a preset threshold includes: Determining, from the M updated membership coefficients, updated membership coefficients that are greater than or equal to the preset threshold, to obtain P first target membership coefficients, where P is an integer less than or equal to M; The community label of the target node is updated according to the value of P.

7. The method according to claim 6, characterized in that The community label of the target node is updated according to the value of P, including: When P is zero, Y community labels are randomly selected from the M community labels of the target node to determine the updated community label of the target node; When P is non-zero, the P first target membership coefficients are normalized to obtain P second target membership coefficients; each of the second target membership coefficients and the corresponding community identifier is determined as the updated community label of the target node.

8. The method according to claim 1, characterized in that Determine the target subgraph in the target knowledge graph based on the target time range, including: Determine the nodes corresponding to the node timestamps within the target time range in the target knowledge graph as nodes in the target subgraph; The edges corresponding to the edge timestamps in the target knowledge graph that are within the target time range are determined as the edges in the target subgraph.

9. The method according to claim 1, characterized in that After determining the target community according to the target subgraph, the method further includes: Adding an abstract node in the target community, wherein the abstract node is used to represent an attack target; A relationship between each node in the target community and the abstract node is established.

10. A device for generating an early warning message, characterized in that: include: A first determination module is configured to determine a target subgraph in a target knowledge graph according to a target time range, wherein the target knowledge graph includes: nodes, edges, node timestamps, and edge timestamps, wherein the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node timestamps represent the time when the intelligence entities appear, and the edge timestamps represent the time when the relationships between the intelligence entities appear; a second determination module, configured to determine a target community according to the target subgraph, wherein the nodes in the target subgraph include community labels, and the community labels include a community identifier and a membership coefficient; A generation module is used to generate an early warning message according to the target community.

11. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method according to any one of claims 1 to 9 when executed by a processor.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

Images