Method and apparatus for generating an early warning message

Abstract

Embodiments of the present application provide a method and device for generating an early warning message, comprising: determining a target sub-knowledge graph in a target knowledge graph according to a target time range; determining a target community according to the target sub-knowledge graph, wherein the nodes in the target sub-knowledge graph comprise at least one community label, the community label comprises a community identifier and a membership coefficient, the community label represents a community to which the node belongs, and the membership coefficient represents a probability of the node belonging to the community; and generating an early warning message according to the target community. Through the present application, the technical problem of low early warning accuracy caused by the difficulty of manually analyzing security events, behavior logs and alarm information to find complex correlation patterns and attack behaviors in the related art is solved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of communication, in particular, to a method and apparatus for generating an early warning message. BACKGROUND

[0002] With the continuous evolution of network security threats, enterprises and organizations not only need to deal with attacks from the outside, but also need to pay attention to potential security threats from the inside. Such endogenous threats may come from internal employees, partners, suppliers, etc., and may unintentionally or intentionally cause security vulnerabilities or data breaches. Therefore, endogenous threat intelligence is increasingly valued. By conducting in-depth analysis on security events, behavior logs and alarm information within an enterprise, early warning and intelligence on internal threats can be generated to help enterprises better cope with these risks. Currently, manual analysis is usually used. Manual analysis is difficult to find complex correlation patterns and attack behaviors, and the accuracy of early warning is low, and manual analysis is inefficient.

[0003] At present, there is no effective solution to the above problems. SUMMARY

[0004] Embodiments of the present application provide a method and apparatus for generating an early warning message to at least solve the technical problem of low accuracy of early warning due to the difficulty of manual analysis of security events, behavior logs and alarm information to find complex correlation patterns and attack behaviors in related technologies.

[0005] According to an aspect of an embodiment of the present application, a method for generating an early warning message is provided, comprising: determining a target sub-graph in a target knowledge graph according to a target time range, wherein the target knowledge graph comprises nodes, edges, node timestamps and edge timestamps, the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node timestamps represent the occurrence time of the intelligence entities, and the edge timestamps represent the time when the relationship between the intelligence entities occurs; determining a target community according to the target sub-graph, wherein the nodes in the target sub-graph include at least one community label, the community label includes a community identifier and a membership coefficient, the community label represents the community to which the node belongs, and the membership coefficient represents the probability of the community to which the node belongs; and generating an early warning message according to the target community.

[0006] In one exemplary embodiment, determining a target community according to the target sub-graph comprises: assigning an initial community label to each node in the target sub-graph; iteratively updating the initial community label; and stopping the iterative updating when a preset condition is met to obtain the target community.

[0007] In an example embodiment, the initial community label of the target node is iteratively updated, including: determining neighbor nodes of the target node to obtain S neighbor nodes, where S is greater than or equal to 1, and the target subgraph includes the target node; and updating the community label of the target node according to the community labels of the neighbor nodes.

[0008] In an example embodiment, the community label of the target node is updated according to the community labels of the neighbor nodes, including: determining connection weights between the target node and the neighbor nodes to obtain S connection weights, where the connection weights are used to represent the number of times that the target node and the neighbor nodes appear in the relationship; and updating the community label of the target node according to the connection weights and the community labels of the neighbor nodes.

[0009] In an example embodiment, the community label of the target node is updated according to the connection weights and the community labels of the neighbor nodes, including: in a case where the target node includes M community labels, determining update affiliation coefficients of the M community labels according to the connection weights and the community labels of the neighbor nodes to obtain M update affiliation coefficients, where M is an integer; and updating the community label of the target node according to the relationship between each update affiliation coefficient and a preset threshold.

[0010] In an example embodiment, the community label of the target node is updated according to the relationship between each update affiliation coefficient and a preset threshold, including: determining update affiliation coefficients greater than or equal to the preset threshold from the M update affiliation coefficients to obtain P first target affiliation coefficients, where P is an integer less than or equal to M; and updating the community label of the target node according to the value of P.

[0011] In an example embodiment, the community label of the target node is updated according to the value of P, including: in a case where P is zero, randomly selecting Y community labels from the M community labels included in the target node to determine the updated community label of the target node; and in a case where P is nonzero, performing normalization processing on the P first target affiliation coefficients to obtain P second target affiliation coefficients; and determining each second target affiliation coefficient and a corresponding community identifier as the updated community label of the target node.

[0012] In an example embodiment, the target sub-knowledge graph is determined in the target knowledge graph according to a target time range, including: determining nodes in the target knowledge graph corresponding to node time stamps within the target time range as nodes in the target sub-knowledge graph; and determining edges in the target knowledge graph corresponding to edge time stamps within the target time range as edges in the target sub-knowledge graph.

[0013] In an example embodiment, after the target community is determined according to the target sub-knowledge graph, the method further includes: adding an abstract node in the target community, wherein the abstract node is used to represent an attack object; and establishing a relationship between each node in the target community and the abstract node.

[0014] According to another aspect of the embodiments of the present application, a device for generating an early warning message is also provided, including: a first determining module configured to determine a target sub-knowledge graph in a target knowledge graph according to a target time range, wherein the target knowledge graph includes nodes, edges, node time stamps, and edge time stamps, the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node time stamps represent occurrence times of the intelligence entities, and the edge time stamps represent times when the relationships between the intelligence entities occur; a second determining module configured to determine a target community according to the target sub-knowledge graph, wherein the nodes in the target sub-knowledge graph include community labels, and the community labels include community identifiers and affiliation coefficients; and a generating module configured to generate an early warning message according to the target community.

[0015] According to still another aspect of the embodiments of the present application, a computer readable storage medium is also provided, and the computer readable storage medium stores a computer program. The computer program is configured to execute the steps in any of the method embodiments when running.

[0016] According to still another aspect of the embodiments of the present application, a computer program product or a computer program is provided, and the computer program product or the computer program includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to execute the steps in any of the method embodiments.

[0017] According to still another aspect of the embodiments of the present application, an electronic device is also provided, and the electronic device includes a memory and a processor. The memory stores a computer program, and the processor is configured to execute the steps in any of the method embodiments through the computer program.

[0018] According to the application, a target sub-knowledge graph is determined in a target knowledge graph according to a target time range, the target knowledge graph includes nodes, edges, node time stamps and edge time stamps, the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node time stamps represent occurrence times of the intelligence entities, and the edge time stamps represent times when the relationships between the intelligence entities occur; a target community is determined in the target sub-knowledge graph, the nodes in the target knowledge graph include community labels, the community labels represent communities to which the nodes belong and probabilities of the communities; and an early warning message is generated according to the target community. Therefore, the problem of low early warning accuracy caused by the difficulty of discovering complex correlation patterns and attack behaviors by manually analyzing security events, behavior logs and alarm information can be solved, and the early warning accuracy can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 is an application scenario of a method for generating an early warning message according to an embodiment of the application;

[0020] Figure 2 is a flowchart of an optional method for generating an early warning message according to an embodiment of the application;

[0021] Figure 3 is a structural block diagram of a device for generating an early warning message. DETAILED DESCRIPTION

[0022] In order to enable persons skilled in the art to better understand the application scheme, the technical solutions in the embodiments of the application will be clearly and completely described below in conjunction with the drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, but not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by persons skilled in the art without creative labor should be within the protection scope of the application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the application and the above drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0024] According to an aspect of the embodiments of the present application, a method for generating an early warning message is provided. Optionally, in the embodiments, the method for generating an early warning message can be applied to, but is not limited to, a hardware environment as shown in Figure 1 The server 104 can be connected with the terminal device 102 through a network, and can be used to provide services (for example, application services, etc.) for the terminal device 102 or a client installed on the terminal device 102, and a database can be set on the server 104 or independently of the server 104, to provide data storage services for the server 104.

[0025] The network can include, but is not limited to, at least one of a wired network and a wireless network. The wired network can include, but is not limited to, at least one of a wide area network, a metropolitan area network, and a local area network, and the wireless network can include, but is not limited to, at least one of WIFI (Wireless Fidelity) and Bluetooth. The terminal device 102 can be, but is not limited to, a PC (Personal Computer), a mobile phone, a tablet computer, etc. The server 104 can be, but is not limited to, a cloud server, a server cluster, or other server types.

[0026] The method for generating an early warning message according to the embodiments of the present application can be executed by the server 104, or by the terminal device 102, or by both the server 104 and the terminal device 102. When the terminal device 102 executes the method for generating an early warning message according to the embodiments of the present application, the method can also be executed by a client installed on the terminal device 102.

[0027] Taking the method for generating an early warning message according to the embodiments executed by the server 104 as an example, Figure 2 is a flowchart of an optional method for generating an early warning message according to the embodiments of the present application, as shown in Figure 2 The flowchart of the method can include the following steps:

[0028] In step S202, a target sub-knowledge graph is determined in a target knowledge graph according to a target time range, wherein the target knowledge graph includes nodes, edges, node time stamps, and edge time stamps, the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node time stamps represent the appearance times of the intelligence entities, and the edge time stamps represent the times when the relationships between the intelligence entities appear.

[0029] Before step S202, the target knowledge graph can be constructed in the following manner:

[0030] Threat intelligence is acquired, intelligence entities in the threat intelligence are determined, and the target knowledge graph is created according to relationships between the intelligence entities in the threat intelligence.

[0031] Specifically, various security event data, alarm logs and behavior analysis logs can be collected from security devices and systems inside the enterprise. Data sources include honeypots, which record attacker IP addresses, attack times, attack times, attack methods, etc.; desktop management software, which analyzes malware, malicious URLs, suspicious files, etc. information; antivirus software, which detects and generates malware, virus hash values, and other threat intelligence.

[0032] The collected threat intelligence data is represented as a graph structure to create a target knowledge graph:

[0033]

[0034] Node V: Various intelligence entities, such as: IP address, file hash, domain name, attack method, attacker, etc.

[0035] Edge E: represents the relationship between nodes (i.e. the relationship between intelligence entities), such as "the association between the IP address node and the file hash node", "the association between the attacker node and the attack method node used", etc.

[0036] Add a node timestamp (e.g. a linux timestamp attribute) to each node to represent the appearance or update time of the intelligence entity. Add an edge timestamp (e.g. a linux timestamp attribute) to each edge to represent the time when the relationship appears or updates.

[0037] For example, "a node address is identified as malicious in the database, and the node timestamp of the address node in the target knowledge graph is updated synchronously", "an attacker uses an attack method to attack at a certain attack time, and the edge timestamp between the attacker and the attack method in the target knowledge graph is updated synchronously".

[0038] The target sub-graph can be determined in the target knowledge graph by the following method: the nodes corresponding to the node timestamps within the target time range in the target knowledge graph are determined as the nodes in the target sub-graph; the edges corresponding to the edge timestamps within the target time range in the target knowledge graph are determined as the edges in the target sub-graph.

[0039] For example, a time window can be set to analyze threat intelligence in a historical time range (the size of the time window can be set according to actual conditions, for example, 30 days. Set the time window to 30 days to analyze threat intelligence in the past 30 days). Analysis is performed every pre-set time interval (the pre-set time interval can be determined according to actual conditions, for example, analysis is performed every 1 day or 1 week).

[0040] The nodes and edges in the selected target time range can be screened out according to the node timestamp and edge timestamp in the knowledge graph, and a target sub-graph is formed , a node subset only retains the nodes with the node timestamp in the selected target time range, and an edge subset only retains the edges with the edge timestamp in the selected target time range.

[0041] In the above embodiment, a target knowledge graph is created based on the relationship between intelligence entities, and a node timestamp and an edge timestamp are added in the target knowledge graph. The nodes and edges in the target time range in the target knowledge graph are screened out through the timestamp, and a target sub-graph is obtained. In this way, the active attack groups or attack activities in the target time range can be identified, and the intelligence graph can be dynamically expanded to capture potential threat changes.

[0042] In step S204, a target community is determined according to the target sub-graph, wherein the nodes in the target sub-graph include at least one community label, and the community label includes a community identifier and a membership coefficient.

[0043] Specifically, an initial community label is assigned to each node in the target sub-graph, and the iteration is updated. The iteration is stopped when the preset condition is met, and the target community is obtained.

[0044] An initial community label is assigned to each node in the target sub-graph, and the initial community label includes a community identifier and a membership coefficient. The community identifier represents the community to which the node belongs, and can be a community number or a community name. The membership coefficient represents the probability of the node belonging to the community. A node can have multiple community labels, indicating that the node can belong to different communities and the probability of belonging to each community.

[0045] In the initial case, the community identifiers assigned to different nodes can not be used, for example, a community identifier is assigned to each node, and the identifiers assigned to different nodes are different. The membership coefficient can be set to the same value.

[0046] In each iteration, the node updates its own community label according to the community label of the neighbor node and the connection weight.

[0047] Specifically, the neighbor nodes of the target node are determined, and S neighbor nodes are obtained, wherein S is greater than or equal to 1, and the target sub-graph includes the target node. The community label of the target node is updated according to the community label of each neighbor node.

[0048] determining a connection weight between the target node and each of the neighbor nodes, to obtain S connection weights, wherein the connection weight is used to represent a number of times that the target node and the neighbor node appear in the relationship;

[0049] updating the community label of the target node according to the S connection weights and the community labels of the neighbor nodes.

[0050] wherein, is a set of all neighbor nodes of the target node, including the S neighbor nodes, and S is greater than or equal to 1, and the target subgraph includes the target node. Wherein, represents a connection weight between node x and node y, and the connection weight is determined according to the number of node associations, for example, the node "IP address 111.111.111.11" and the node "place Shanghai" are associated twice in different threat intelligence, and the weight is 2, and the connection weight is 2.

[0051] The connection weight of each node and its neighbor node in the target subgraph can be represented by the following matrix:

[0052]

[0053] n represents the number of nodes.

[0054] In an exemplary embodiment, updating the community label of the target node according to the S connection weights and the community labels of the neighbor nodes includes:

[0055] In the case where the target node includes M community labels, determining an update subordinate coefficient of the M community labels according to the S connection weights and the community labels of the neighbor nodes, to obtain M update subordinate coefficients, wherein M is an integer;

[0056] updating the community label of the target node according to the relationship between each of the update subordinate coefficients and a preset threshold.

[0057] Determining an update subordinate coefficient of the M community labels according to the S connection weights and the community labels of the neighbor nodes, to obtain M update subordinate coefficients, includes:

[0058] determining an update subordinate coefficient of the i-th community label by the following formula, wherein the i-th community label is any one of the M community labels of the target node, and i is an integer:

[0059] determining a first target sum of the sum of the connection weights between the target node and each of the neighbor nodes; that is, the first target sum is as follows:

[0060]

[0061] wherein x represents a target node, y represents a neighbor node, N(x) is a set of all neighbor nodes of the target node, is a connection weight between the target node x and the neighbor node y, S1 is a first target sum.

[0062] The product sum of the subordinate coefficients in the community label of all neighbor nodes and the corresponding connection weight is determined as a second target sum, that is, the second target sum is as follows:

[0063]

[0064] wherein x represents a target node, y represents a neighbor node, N(x) is a set of all neighbor nodes of the target node, is a connection weight between the target node x and the neighbor node y, is a community identifier of the neighbor node y , S2 is a second target sum.

[0065] The ratio of the first target sum and the second target sum is determined as an updated subordinate coefficient of the i-th community label, that is:

[0066]

[0067] wherein, is a community identifier of the target node x , the i-th community label comprises: a community identifier and a subordinate coefficient of the community identifier .

[0068] wherein the preset threshold value can be:

[0069] The community label of the target node is filtered by using the threshold value, and v represents the maximum number of communities that a node can belong to (the specific value can be set according to actual conditions). If it is known that each node will be assigned to multiple communities, the value of v will be set as large as possible, and vice versa.

[0070] In an example embodiment, the community label of the target node is updated according to the relationship between each of the updated subordinate coefficients and the preset threshold value, comprising: determining the updated subordinate coefficients greater than or equal to the preset threshold value in the M updated subordinate coefficients, to obtain P first target subordinate coefficients, wherein P is an integer less than or equal to M; and updating the community label of the target node according to the value of P.

[0071] Specifically, in the case that P is zero, Y community labels are randomly selected from the M community labels included in the target node to determine the updated community labels of the target node; in the case that P is non-zero, the P first target affiliation coefficients are normalized to obtain P second target affiliation coefficients; each second target affiliation coefficient and the corresponding community identifier are determined as the updated community labels of the target node.

[0072] The filtering rule is as follows: if the updated affiliation coefficient of a certain community label is lower than the threshold value, the label is deleted. If all are lower than the threshold value, Y (for example, 1) can be randomly retained, and the remaining community labels are deleted.

[0073] After each filtering is completed, normalization processing is performed on all remaining affiliation coefficients to ensure that the sum is 1. The normalization is to divide the affiliation coefficient of each remaining label by the sum of the affiliation coefficients of all remaining labels, that is, the normalization processing is performed by the following formula:

[0074]

[0075] The normalized affiliation coefficient, is the affiliation coefficient before normalization, is the remaining label, and the sum of the affiliation coefficients of all remaining labels.

[0076] The above iteration process is repeated until the community labels of all nodes no longer change, that is, a convergence state is reached, or a certain maximum number of iterations is reached.

[0077] In step S206, an early warning message is generated according to the target community.

[0078] Through the embodiments provided in the present application, various intelligence entities (such as IP addresses, file hashes, attack methods, etc.) are connected through association relationships to construct a threat intelligence graph (knowledge graph). Complex association patterns and attack behaviors can be discovered, and endogenous threats can be more effectively analyzed and understood. The efficiency of threat intelligence analysis is further improved.

[0079] The target sub-graph is analyzed to identify attack gangs and activity patterns that are active in the target time range in the target sub-graph, for example, identifying a high-risk IP address, a malicious file hash, and an attack method related to a certain gang belong to the same community. For example, many IP addresses in a community are associated with the same geographic location, which may indicate that the activities of the attack gang are concentrated in a certain area or through a certain transit server. For example, the following entity nodes exist in the original target knowledge graph:

[0080] IP address: 111.111.111.11;

[0081] File hash: abc123;

[0082] Malware: malware.exe;

[0083] Attack method: DDoS;

[0084] Location: Shanghai;

[0085] After iterative updating of community labels, it is determined that these nodes belong to a target community .

[0086] In an example embodiment, after determining the target community according to the target sub-graph, the method further comprises: adding an abstract node in the target community, wherein the abstract node is used to represent an attack object; and establishing a relationship between each node in the target community and the abstract node.

[0087] If multiple nodes belong to a target community , all exist in the target sub-graph connected in the expanded graph, an abstract node is added , which maps to the original target community, and then is connected to the nodes belonging to the target community in the target graph through edges:

[0088] ->111.111.111.11

[0089] ->abc123

[0090] ->malware.exe

[0091] ->DDoS

[0092] ->Shanghai

[0093] The newly expanded abstract representation is a certain attack gang or a certain activity pattern, and the timestamp of the abstract node is calculated as the average of the timestamps of its connected nodes. The original node representation remains unchanged, and the connection between the community node and the original node helps to reveal the tools, targets and technologies used in gang activities, thereby achieving the expansion of the endogenous threat intelligence graph.

[0094] Through the above-mentioned embodiments, the detection accuracy of threat intelligence is improved, and by adding a community label to the knowledge graph, intelligence entities with close correlations can be more accurately identified, and more meaningful intelligence communities are formed. The generation of community nodes helps enterprises better understand attack gangs and attack behavior patterns. The community division and expansion function effectively reduces the workload of manual analysis, enhances the expansion capability of the threat intelligence graph, helps enterprises capture more potential attack behaviors, and improves the automation level of security analysis.

[0095] It should be noted that, for the foregoing method embodiments, in order to simply describe, they are all expressed as a combination of a series of actions, but those skilled in the art should know that the present application is not limited to the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the present application.

[0096] Through the above description of the embodiments, those skilled in the art can clearly understand that the method according to the above-mentioned embodiments can be realized by means of software and a necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM (Read-Only Memory), a RAM (Random Access Memory), a magnetic disk, or an optical disk), and includes a plurality of instructions for causing an end device (which can be a mobile phone, a computer, a server, or a network device) to execute the method described in the embodiments of the present application.

[0097] According to another aspect of the embodiments of the present application, a device for generating an early warning message is also provided, which can be used to implement the method for generating an early warning message provided in the above-mentioned embodiments, which has been described and will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware is also possible and is contemplated.

[0098] Figure 3 is a structural block diagram of an optional device for generating an early warning message according to the embodiments of the present application, as shown in Figure 3 The device for generating an early warning message comprises:

[0099] The first determining module 302 is configured to determine a target sub-knowledge graph in a target knowledge graph according to a target time range, wherein the target knowledge graph comprises nodes, edges, node time stamps, and edge time stamps, the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node time stamps represent occurrence times of the intelligence entities, and the edge time stamps represent times when the relationships between the intelligence entities occur.

[0100] The second determining module 304 is configured to determine a target community according to the target sub-knowledge graph, wherein the nodes in the target sub-knowledge graph comprise community labels, and the community labels comprise community identifiers and affiliation coefficients.

[0101] The generating module 306 is configured to generate an early warning message according to the target community.

[0102] In an example embodiment, the apparatus is further configured to assign an initial community label to each node in the target sub-knowledge graph, iteratively update the initial community label, and stop the iterative update when a preset condition is met, to obtain the target community.

[0103] In an example embodiment, the apparatus is further configured to determine neighbor nodes of the target node, to obtain S neighbor nodes, wherein S is greater than or equal to 1, and the target sub-knowledge graph comprises the target node, and update the community label of the target node according to the community labels of the neighbor nodes.

[0104] In an example embodiment, the apparatus is further configured to determine connection weights between the target node and each of the neighbor nodes, to obtain S connection weights, wherein the connection weights are used to represent the number of times when the target node and the neighbor nodes have the relationship, and update the community label of the target node according to the connection weights and the community labels of the neighbor nodes.

[0105] In an example embodiment, the apparatus is further configured to, when the target node comprises M community labels, determine updated affiliation coefficients of the M community labels according to the connection weights and the community labels of the neighbor nodes, to obtain M updated affiliation coefficients, wherein M is an integer, and update the community label of the target node according to the relationship between each of the updated affiliation coefficients and a preset threshold.

[0106] In an example embodiment, the apparatus is further configured to determine, from the M updated affiliation coefficients, updated affiliation coefficients that are greater than or equal to the preset threshold, to obtain P first target affiliation coefficients, wherein P is an integer less than or equal to M, and update the community label of the target node according to the value of P.

[0107] In an example embodiment, the apparatus is further configured to, when P is zero, determine the updated community label of the target node by randomly selecting Y community labels from the M community labels included in the target node; and when P is non-zero, normalize the P first target affiliation coefficients to obtain P second target affiliation coefficients, and determine each of the second target affiliation coefficients and a corresponding community identifier as the updated community label of the target node.

[0108] In an example embodiment, the apparatus is further configured to determine, as the nodes in the target sub-knowledge graph, the nodes in the target knowledge graph corresponding to the node time stamps within the target time range; and determine, as the edges in the target sub-knowledge graph, the edges in the target knowledge graph corresponding to the edge time stamps within the target time range.

[0109] In an example embodiment, the apparatus is further configured to, after determining the target community according to the target sub-knowledge graph, add an abstract node to the target community, wherein the abstract node is used to represent an attack object; and establish a relationship between each node in the target community and the abstract node.

[0110] It should be noted that each of the above modules can be implemented by software or hardware, and for the latter, the following implementation manners can be used, but are not limited thereto: all of the above modules are located in the same processor; or the above modules are located in different processors in any combination.

[0111] According to another aspect of the embodiments of the present application, a computer readable storage medium is provided, which includes a stored program, wherein the program performs the steps in any of the above method embodiments when executed.

[0112] In an example embodiment, the computer readable storage medium can include, but is not limited to, a U disk, a ROM, a RAM, a mobile hard disk, a magnetic disk or an optical disk, and various computer program storage media.

[0113] According to another aspect of the embodiments of the present application, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor is configured to execute the steps in any of the above method embodiments by the computer program. In an example embodiment, the electronic device can further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0114] The specific examples in the present embodiment can refer to the examples described in the above embodiments and example embodiments, which will not be described herein again.

[0115] According to still another aspect of the embodiments of the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is configured to perform the steps of any of the method embodiments described above when executed by a computer device.

[0116] According to still another aspect of the embodiments of the present application, a computer program product or computer program is provided, and the computer program product or computer program comprises computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the steps of any of the method embodiments described above.

[0117] According to still another aspect of the embodiments of the present application, an electronic device is provided, and the electronic device comprises a memory and a processor. The memory stores a computer program, and the processor is configured to execute the steps of any of the method embodiments described above by using the computer program.

[0118] Obviously, a person skilled in the art should appreciate that each module or step of the present application described above can be implemented by a general purpose computing device. They can be concentrated on a single computing device, or distributed on a network composed of a plurality of computing devices. They can be implemented by program codes executable by a computing device, so that they can be stored in a storage device and executed by a computing device. In some cases, the steps shown or described can be executed in an order different from the one shown, or they can be made into individual integrated circuit modules respectively, or a plurality of modules or steps can be made into a single integrated circuit module. Therefore, the present application is not limited to any particular combination of hardware and software.

[0119] The preferred embodiments of the present application have been described above with the specific details. Obviously, the present application can be modified and altered in various ways by those skilled in the art without departing from the principle and characteristics of the present application. Any modification, equivalent replacement, improvement, etc. made within the principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for generating an early warning message, characterized in that: include: Determine a target subgraph in a target knowledge graph according to a target time range, wherein the target knowledge graph includes: nodes, edges, node timestamps, and edge timestamps, wherein the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node timestamps represent the time when the intelligence entities appear, and the edge timestamps represent the time when the relationships between the intelligence entities appear; Determining a target community according to the target subgraph, wherein the node in the target subgraph includes at least one community label, the community label includes a community identifier and a membership coefficient, the community label indicates the community to which the node belongs, and the membership coefficient indicates the probability that the node belongs to the community; An early warning message is generated based on the target community.

2. The method according to claim 1, characterized in that Determining a target community according to the target subgraph includes: Assigning an initial community label to each node in the target subgraph; Iteratively updating the initial community label; When a preset condition is met, the iterative update is stopped to obtain the target community.

3. The method according to claim 2, characterized in that Iteratively updating the initial community labels includes: Determine neighbor nodes of the target node to obtain S neighbor nodes, where S is greater than or equal to 1, and the target subgraph includes the target node; The community label of the target node is updated according to the community labels of each of the neighboring nodes.

4. The method according to claim 3, characterized in that Updating the community label of the target node according to the community labels of each of the neighboring nodes includes: Determine a connection weight between the target node and each of the neighbor nodes to obtain S connection weights, wherein the connection weight is used to represent the number of times the relationship between the target node and the neighbor node occurs; The community label of the target node is updated according to the S connection weights and the community labels of the neighboring nodes.

5. The method according to claim 4, characterized in that Updating the community label of the target node according to the S connection weights and the community labels of the neighboring nodes includes: In a case where the target node includes M community labels, determining updated membership coefficients of the M community labels according to the S connection weights and the community labels of the neighboring nodes to obtain M updated membership coefficients, where M is an integer; The community label of the target node is updated according to the relationship between each updated membership coefficient and a preset threshold.

6. The method according to claim 5, characterized in that Updating the community label of the target node according to the relationship between each updated membership coefficient and a preset threshold includes: Determining, from the M updated membership coefficients, updated membership coefficients that are greater than or equal to the preset threshold, to obtain P first target membership coefficients, where P is an integer less than or equal to M; The community label of the target node is updated according to the value of P.

7. The method according to claim 6, characterized in that The community label of the target node is updated according to the value of P, including: When P is zero, Y community labels are randomly selected from the M community labels of the target node to determine the updated community label of the target node; When P is non-zero, the P first target membership coefficients are normalized to obtain P second target membership coefficients; each of the second target membership coefficients and the corresponding community identifier is determined as the updated community label of the target node.

8. The method according to claim 1, characterized in that Determine the target subgraph in the target knowledge graph based on the target time range, including: Determine the nodes corresponding to the node timestamps within the target time range in the target knowledge graph as nodes in the target subgraph; The edges corresponding to the edge timestamps in the target knowledge graph that are within the target time range are determined as the edges in the target subgraph.

9. The method according to claim 1, characterized in that After determining the target community according to the target subgraph, the method further includes: Adding an abstract node in the target community, wherein the abstract node is used to represent an attack target; A relationship between each node in the target community and the abstract node is established.

10. A device for generating an early warning message, characterized in that: include: A first determination module is configured to determine a target subgraph in a target knowledge graph according to a target time range, wherein the target knowledge graph includes: nodes, edges, node timestamps, and edge timestamps, wherein the nodes represent intelligence entities, the edges represent relationships between the intelligence entities, the node timestamps represent the time when the intelligence entities appear, and the edge timestamps represent the time when the relationships between the intelligence entities appear; a second determination module, configured to determine a target community according to the target subgraph, wherein the nodes in the target subgraph include community labels, and the community labels include a community identifier and a membership coefficient; A generation module is used to generate an early warning message according to the target community.

11. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method according to any one of claims 1 to 9 when executed by a processor.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

Images