Network information security dynamic early warning method and system based on knowledge graph

Abstract

The invention discloses a network information security dynamic early warning method and system based on a knowledge graph, and relates to the technical field of network information security. According to the method, network equipment logs, threat intelligence texts and flow metadata are acquired in real time through a multi-source heterogeneous data acquisition module, and a dynamic knowledge graph is constructed by adopting a streaming knowledge extraction technology. And predicting a threat propagation path by using a graph attention network and gating loop unit hybrid model, and generating a hierarchical defense strategy in combination with a three-dimensional risk assessment value. The system comprises a multi-modal data acquisition module, a dynamic knowledge graph construction module, a threat propagation dynamics modeling module, a self-adaptive strategy generation module, a digital twinborn verification module and the like, and the effectiveness of a defense strategy is verified by simulating an attack path. According to the method, dynamic early warning and automatic response of network security are realized, the network protection capability is effectively improved, and the method is suitable for scenes such as enterprise network security protection and cloud service provider security protection.

Description

Technical Field

[0001] The present invention belongs to the field of network information security technology, and in particular relates to a network information security dynamic early warning method and system based on knowledge graph. Background Art

[0002] In today's digital age, network information security is crucial. As cyberattacks become increasingly complex and diverse, traditional network security protection technologies face numerous challenges. However, traditional network security early warning methods rely on static rule bases or single data sources, making them difficult to handle complex and diverse attack methods (such as APT attacks and zero-day vulnerability exploits). Existing technologies have the following drawbacks: Inadequate processing of data heterogeneity: structured logs, unstructured threat intelligence, and time-series traffic data are not effectively integrated; Threat modeling limitations: Lack of spatiotemporal joint modeling capabilities, making it impossible to dynamically predict attack paths; Rigid defense strategies: Risk assessment and response strategies fail to incorporate multidimensional factors such as asset value and vulnerability scores.

[0003] Therefore, there is an urgent need for an innovative dynamic early warning technology for network information security that can integrate multi-source data, analyze and predict threats in real time, and take effective defense measures in a timely manner. Summary of the Invention

[0004] The purpose of the present invention is to provide a dynamic early warning method and system for network information security based on knowledge graphs. Through multi-source heterogeneous data collection, dynamic knowledge graph construction, threat propagation prediction and hierarchical defense strategy formulation, efficient and accurate dynamic early warning of network information security can be achieved, network security risks can be reduced, and the stable operation of the network system can be guaranteed.

[0005] To solve the above technical problems, the present invention is achieved through the following technical solutions: The present invention is a network information security dynamic early warning method based on knowledge graph, comprising: Step S1: acquiring network device logs, threat intelligence text, and traffic metadata in real time through a multi-source heterogeneous data acquisition module, wherein the data at least includes structured vulnerability numbers, unstructured attack tactic descriptions, and time-series traffic burst characteristics; Step S2: extracting entity relationships from the data using a streaming knowledge extraction technology based on a pre-trained language model to construct a dynamic knowledge graph; Step S3: Predict the threat propagation path based on a hybrid model of a graph attention network and a gated recurrent unit, where the graph attention network is used for spatial modeling and the gated recurrent unit is used for temporal modeling. The hybrid model satisfies: in is the Sigmoid function, 、 is a trainable parameter; Step S4: Generate a hierarchical defense strategy based on the three-dimensional risk assessment value R. The calculation formula of R is: in, is the environmental correction factor, Represents the value of the asset, represents the maximum asset value, Indicates the vulnerability score, is the number of hops in the attack path; Step S5: Simulate and verify the effectiveness of the defense strategy in the digital twin environment, and deploy it to the production environment after verification.

[0006] As a preferred technical solution of the present invention, in step S1, the multi-source heterogeneous data acquisition module includes: Structured data interface: parses CVE numbers and port numbers in Syslog logs; Unstructured data processing unit: uses the BERT-NER model to extract attack tactic descriptions from threat intelligence text; Time series data analysis unit: Calculates the variance threshold of NetFlow traffic to identify burst traffic.

[0007] The method for dynamic early warning of network information security based on knowledge graph according to claim 1 is characterized in that step S2 specifically comprises: Step S21: Identify attack entities in the text through the BiLSTM-CRF layer; Step S22: Generate entity relationship triples based on dependency syntax analysis; Step S23: Create new ontology nodes for unregistered entity types to incrementally expand the knowledge graph.

[0008] As a preferred technical solution of the present invention, the newly added ontology node in step S23 is created according to the following rules: When the frequency of unregistered entities ≥ F_threshold, the new ontology creation process is triggered; New ontology nodes are automatically associated with the nearest neighbor concept class; Generate a snapshot of the ontology version and push it to the knowledge graph governance platform.

[0009] As a preferred technical solution of the present invention, between steps S2 and S3, the following steps are further included: The knowledge distillation step compresses the dynamic knowledge graph into lightweight subgraphs; In the subgraph distribution step, the subgraph is deployed to the edge computing node through the P2P network.

[0010] As a preferred technical solution of the present invention, the hierarchical defense strategy in step S4 specifically includes: Level 1 response (R≥0.8): Automatically isolate the infected host and initiate traffic cleaning; Level 2 response (0.5≤R<0.8): Close high-risk ports and generate a work order; Level 3 response (R<0.5): Record the log and send an early warning notification.

[0011] As a preferred technical solution of the present invention, the digital twin environment verification in step S5 includes: Clone the real network topology based on LLDP protocol; Inject MITREAT&CKTTPs attack behavior data; Calculate the return on investment of your defense strategy.

[0012] The present invention also provides a network information security dynamic early warning system based on a knowledge graph for implementing the method described above, the system comprising: Multimodal data collection module, used to obtain network device logs, threat intelligence text and traffic metadata; Dynamic knowledge graph construction engine, used to extract entity relationships from collected data and build dynamic knowledge graphs; Threat propagation dynamics modeling module, integrating a hybrid model of graph neural network and time recursive network; Adaptive strategy generator, used to generate hierarchical defense strategies based on three-dimensional risk assessment values; The digital twin verification module verifies the effectiveness of the defense strategy by simulating the attack path.

[0013] As a preferred technical solution of the present invention, the dynamic knowledge graph construction engine includes: Stream processing unit, real-time analysis of structured data, unstructured text and time series traffic; Entity alignment module, which implements entity mapping across data sources based on the TransE algorithm; The version control module supports graph version rollback and incremental updates.

[0014] As a preferred technical solution of the present invention, the entity alignment module adopts an improved TransE-RS algorithm, and its loss function is: Among them, the first term is the traditional entity relationship embedding loss, and the second term is the relationship semantic constraint term, which is achieved through semantic vector similarity calculation; is the balance coefficient, is the regularization coefficient, is the model parameter regularization term.

[0015] The present invention has the following beneficial effects: The beneficial effects of this patent are significant: through multi-source heterogeneous data collection and dynamic knowledge graph construction, comprehensive perception and precise identification of network threats are achieved, significantly improving the accuracy and efficiency of threat detection. By using a hybrid model of graph attention networks and gated recurrent units to predict threat propagation paths, it is possible to predict attack trends in advance and provide strong support for the formulation of defense strategies. Combining three-dimensional risk assessment values ​​to generate hierarchical defense strategies realizes the automation and intelligence of defense measures, effectively reduces the cost of manual intervention, and improves response speed. In addition, the digital twin environment verification mechanism ensures the effectiveness of defense strategies before actual deployment, further enhancing the reliability of network security. This patent not only improves network protection capabilities, but also provides enterprises and cloud service providers with efficient and intelligent network security solutions, which have broad application prospects and significant economic benefits.

[0016] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 Schematic diagram of the process of the present invention; Figure 2 Construct a flow chart for the dynamic knowledge graph in the present invention; Figure 3 This is a diagram of the threat propagation path prediction model in the present invention; Figure 4 This is the digital twin environment verification flow chart of the present invention. DETAILED DESCRIPTION

[0019] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0020] like Figure 1-Figure 4As shown: This patented technology has broad application prospects in network security protection in multiple fields. The following uses the network environment of a large e-commerce enterprise as an example to describe a specific embodiment in detail. Large e-commerce enterprises have complex network architectures, covering numerous servers, databases, and user terminals, processing massive amounts of transaction data every day, and facing various network security threats, such as malicious attacks and data leakage risks. The implementation of the method and system of the present invention in the enterprise network can effectively protect network information security and ensure the stable operation of the business.

[0021] 1. System Deployment Deployment of a multimodal data collection module: Deploy a multimodal data collection module at key nodes in the e-commerce enterprise network, such as core routers, web servers, and database servers. Configure the Syslog logging function for the core routers, enabling them to send log data containing information such as CVE vulnerability numbers, IP addresses, and port numbers in real time to a structured data interface. Intelligence text collected from professional threat intelligence platforms and the enterprise's internal security team is connected to the unstructured data processing unit. Install NetFlow traffic collection devices at network traffic monitoring points to transmit the collected traffic data to the time series data analysis unit.

[0022] Core processing module deployment: The dynamic knowledge graph construction engine, threat propagation dynamics modeling module, adaptive policy generator, and digital twin verification module are deployed on a high-performance server cluster. These servers are equipped with multi-core high-performance CPUs, large memory (256GB or above), and high-speed, high-capacity storage devices (high-performance solid-state drive arrays) to meet the system's performance requirements for data processing and model operations.

[0023] Edge computing node deployment: Deploy edge computing nodes, such as small servers or network devices with computing capabilities, in local computer rooms at enterprise branches and at the edge of data centers. Through a P2P network configuration, edge computing nodes can receive lightweight subgraph data distributed from core servers, enabling rapid local processing and response on edge devices.

[0024] 2. Method Execution Multi-source heterogeneous data collection (step S1) Structured Data Collection: The structured data interface continuously monitors Syslog logs. When a new log arrives, the parser extracts information such as the CVE vulnerability number and port number according to the pre-set log format specifications, using regular expressions or a specific log parsing library. For example, if the log record reads "[CVE-2024-5678][IP:10.0.0.1][Port:443]...", the parser accurately extracts the CVE number "CVE-2024-5678", the IP address "10.0.0.1", and the port number "443", and stores this data in a temporary data buffer.

[0025] Unstructured data collection: The unstructured data processing unit regularly pulls the latest threat intelligence text from the threat intelligence platform and collects intelligence compiled by the company's internal security team. The text is analyzed sentence by sentence using the BERT-NER model. The BERT-NER model is based on the pre-trained BERT language model and is fine-tuned and trained on a large amount of text data containing attack tactic descriptions. The model input is a piece of threat intelligence text, which is extracted through a multi-layer Transformer architecture. After passing through the named entity recognition (NER) layer, the attack tactic description entities in the text are output. For example, given the input text "Recently, an attack method targeting e-commerce platforms has emerged, in which attackers tamper with user order information through malicious scripts," the model can identify attack tactic descriptions such as "Malicious scripts tamper with user order information" and store them in a structured format in a temporary data cache.

[0026] Time series data collection: The time series data analysis unit collects NetFlow traffic data at fixed intervals (e.g., 10 seconds). Using a sliding window algorithm, the variance of traffic data over a period of time (e.g., the past 60 seconds) is calculated. Assuming the traffic data in the current window is [80Mbps, 90Mbps, 110Mbps, 130Mbps, ...], the variance calculation formula is: Where n is the number of data points, For the data points, is the average value of the data. When the calculated variance exceeds a set threshold (e.g., 600 Mbps² / second, set based on the actual traffic fluctuations of the e-commerce enterprise network), a traffic burst is detected and the relevant traffic data and timestamp are recorded in a temporary data buffer.

[0027] Dynamic knowledge graph construction (step S2) Attack Entity Identification (Step S21): Text data is retrieved from the temporary data buffer and input into the BiLSTM-CRF layer. The BiLSTM consists of a forward LSTM and a backward LSTM. The forward LSTM processes from the beginning of the text sequence, while the backward LSTM processes from the end. Together, these two layers fully capture the context of the text. For example, for the text "Hackers exploit SQL injection to attack e-commerce databases," the forward LSTM can learn the semantic association between "hacker" and "exploit," while the backward LSTM can learn the semantic association between "attack" and "e-commerce database." After BiLSTM processing, feature representations are obtained for each word. Based on these feature representations, the CRF layer uses the Viterbi algorithm to find the most likely entity label sequence, considering the constraints between adjacent labels, thereby identifying attack entities such as "hacker," "SQL injection," and "e-commerce database."

[0028] Generating entity-relationship triples (step S22): Based on dependency parsing techniques, sentences containing attack entities are parsed. For example, for the sentence "Malware infects servers through network vulnerabilities," dependency parsing identifies "malware" as the agent of "infection," "server" as the object of "infection," and "network vulnerability" as the method of "infection," thereby generating the entity-relationship triples (malware, infection, server) and (malware, exploit, network vulnerability).

[0029] Knowledge graph expansion (step S23): When the identified attack entity does not exist in the knowledge graph, the new ontology creation process is initiated. If the new entity's frequency of occurrence reaches F_threshold (for example, set to 6 occurrences per hour), a new ontology node is created. The new ontology node uses a semantic similarity algorithm (such as the cosine similarity algorithm) to calculate its semantic similarity with existing concept classes in the knowledge graph and automatically associates it with the nearest neighbor concept class. For example, the newly emerged attack entity "New e-commerce promotion fake order attack script" is found to have a high semantic similarity with "malicious fake order script" by calculating its semantic similarity with existing entities in the "attack script" concept class. It is then associated with the "attack script - e-commerce fake order related" concept class. At the same time, an ontology version snapshot is generated, recording the creation information and association relationships of the new ontology node, and pushing it to the knowledge graph governance platform for management and maintenance.

[0030] (3) The detailed workflow of the dynamic knowledge graph construction engine is as follows: 1. Stream processing unit In the network environments of large e-commerce companies, data is continuously generated, and the streaming processing unit undertakes the important task of real-time parsing of structured data, unstructured text, and time-series traffic. For structured data such as Syslog logs obtained from core routers, it can quickly parse key information such as CVE vulnerability numbers, IP addresses, and port numbers, converting and storing them according to a preset data format. For unstructured text from threat intelligence platforms, it utilizes natural language processing technology combined with the BERT-NER model to efficiently extract entity information such as descriptions of attack tactics. For NetFlow traffic data, a sliding window algorithm is used to calculate traffic variance in real time to promptly detect traffic bursts. For example, during major e-commerce promotions, network traffic surges. The streaming processing unit can rapidly process massive amounts of data, providing a timely and accurate data foundation for subsequent knowledge graph construction.

[0031] 2. Entity Alignment Module The entity alignment module uses the TransE algorithm to map entities across data sources. To improve alignment accuracy and semantic consistency, it employs a modified TransE-RS algorithm. In large e-commerce companies, different data sources (such as internal security system logs and external threat intelligence platforms) may describe the same entity differently. The entity alignment module accurately maps these different entity descriptions.

[0032] The loss function of the improved TransE-RS algorithm is: , where the first term is the traditional entity relationship embedding loss, which aims to make the vector representation of entities and relationships in the knowledge graph meet the basic requirements of the TransE algorithm, that is, the head entity vector h plus the relationship vector r is as close as possible to the tail entity vector t; the second term is the relationship semantic constraint term, which is achieved by calculating the similarity of semantic vectors. h', r', and t' are the semantic vectors related to h, r, and t respectively. This constraint term ensures that in the entity alignment process, not only the relationship structure between entities is considered, but also the semantic consistency is guaranteed; It is a balance coefficient used to adjust the weights of traditional loss items and semantic constraint items. In the actual application of e-commerce enterprises, it can be adjusted according to the data characteristics and alignment requirements. For example, when the semantic accuracy requirements are high, it can be appropriately increased. The value of is the regularization coefficient, This is a model parameter regularization term used to prevent overfitting and ensure model stability and generalization when processing large amounts of data. For example, when aligning the entity "e-commerce payment server," the representation from internal logs and external intelligence may differ. The entity alignment module uses this algorithm to accurately identify and establish the mapping between them, making the knowledge graph more complete and accurate.

[0033] 3. Version Control Module In the network security protection of large e-commerce companies, the network environment and threat situation are constantly changing, and the knowledge graph also needs to be continuously updated. The version control module supports graph version rollback and incremental update to ensure the traceability and stability of the knowledge graph. When the knowledge graph is updated, whether it is adding an ontology node, modifying the entity relationship or updating the entity attribute, the version control module will record these operations and generate a new version snapshot. Once a problem is discovered during subsequent use, such as the incorrect addition of an entity relationship resulting in a logical error in the knowledge graph, security operations personnel can use the version rollback function to restore the knowledge graph to the previous correct version; and the incremental update function can efficiently add new entity and relationship information without affecting the existing knowledge graph structure and function. For example, when a new e-commerce attack method appears, the relevant information is updated to the knowledge graph in a timely manner to ensure that the knowledge graph can always accurately reflect the network security situation.

[0034] Threat propagation path prediction (step S3): Data input and preprocessing: The constructed dynamic knowledge graph is used as input data. Nodes in the knowledge graph represent various entities in the network, such as network devices, users, vulnerabilities, and attack types. Edges represent relationships between entities, such as device connections, vulnerability exploitation, and attack propagation. Before input into the prediction model, the knowledge graph needs to be preprocessed to convert it into a format suitable for model processing. For example, node and edge features can be vectorized. Node features can include node type and attributes (such as the device's IP address, port number, and vulnerability severity); edge features can include edge type and weight (such as connection stability and the likelihood of attack propagation).

[0035] Graph Attention Network (GAT) processing: GAT is used to spatially model knowledge graphs and capture the relationships between nodes. Through the attention mechanism, GAT allows each node to dynamically assign attention weights based on its relationship with neighboring nodes, thereby better learning node feature representations.

[0036] Calculate attention score: For each node in the knowledge graph and its neighboring nodes , the unnormalized attention score under the kth attention head , the formula is in is a trainable attention vector, is a trainable weight matrix, and Node and The eigenvector of Represents the vector concatenation operation, and LeakyReLU is the activation function.

[0037] Normalized attention weight: The attention score Perform Softmax normalization to obtain attention weight , the formula is ,in is a node The set of neighbor nodes.

[0038] Update node features: according to attention weight , for nodes The features are updated, and the formula is ,in is the activation function. Through multiple iterations, GAT can learn the spatial feature representation of nodes in the knowledge graph.

[0039] Gated Recurrent Unit (GRU) processing: GRU is used to model time series data and capture the temporal characteristics of threat propagation. The node features output by the GAT are input into the GRU in chronological order.

[0040] Initialize hidden state: At the initial time t=0, initialize the hidden state of GRU , which is usually set to an all-zero vector.

[0041] Calculate the update gate and reset gate: For each time step , calculate the update gate and reset gate , the formulas are and ,in and is a trainable weight matrix, Indicates that the hidden state of the previous moment and the node features output by GAT at the current moment Perform splicing.

[0042] Calculate candidate hidden states: According to the reset gate , calculate the candidate hidden state , the formula is , where W is the trainable weight matrix, Represents an element-wise multiplication operation.

[0043] Update hidden state: according to the update gate , update the hidden state of GRU , the formula is ,Through GRU processing, the time series characteristics of threat propagation can be learned.

[0044] Hybrid model output: The output of GAT and GRU are fused, the formula is in is the Sigmoid function, 、 are trainable parameters. The final output represents the possible paths and probabilities of threat propagation, providing a basis for subsequent risk assessment and defense strategy formulation.

[0045] Hierarchical defense strategy formulation (step S4): Calculate the three-dimensional risk assessment value R: According to the formula Calculate the risk assessment value. It is an environmental correction factor, which is set according to the characteristics of the network environment and historical data. For example, in a high-risk network environment, Can be set to 0.9; Indicates asset value, which is determined by evaluating the assets in the network, such as the importance of the server, the sensitivity of the stored data, etc. Represents the maximum asset value, that is, the value of the most valuable asset in the network; Indicates the vulnerability score, which scores the discovered vulnerabilities according to the Common Vulnerability Scoring System (CVSS); is the number of attack path hops, obtained by predicting the threat propagation path.

[0046] Determine the defense strategy level: Determine the corresponding defense strategy level based on the calculated risk assessment value R.

[0047] Level 1 Response (R ≥ 0.8): When the risk assessment reaches the level 1 response threshold, the network faces a serious security threat. At this point, the infected host is automatically isolated, disconnecting it from the network to prevent further spread of the threat. Traffic scrubbing services are also activated to filter network traffic and remove malicious traffic.

[0048] Level 2 Response (0.5 ≤ R < 0.8): In this level 2 response range, the risk level is higher but lower than level 1. High-risk ports are closed to prevent unauthorized external access. A work order is generated and assigned to security operations personnel for further processing, including in-depth threat analysis and targeted remediation measures.

[0049] Level 3 Response (R<0.5): When the risk assessment falls within the Level 3 response range, while the threat is relatively minor, it still warrants attention. Detailed log information is recorded, including relevant threat data such as the time of discovery, threat type, and affected devices. Warning notifications are also sent to security managers, alerting them to potential security risks so they can take timely measures to prevent them from escalating.

[0050] Defense strategy verification (step S5) Digital twin environment construction Network topology cloning: Based on LLDP (Link Layer Discovery Protocol), real networks are scanned to obtain information such as the connection relationships between network devices, device types, and IP addresses, thereby building a digital twin network that is completely consistent with the real network topology. For example, the LLDP protocol can be used to discover that Router A and Router B are connected through specific ports and that their IP addresses are 192.168.1.1 and 192.168.1.2, respectively. This connection relationship and device configuration are precisely replicated in the digital twin environment.

[0051] Attack injection: Attack behavior data related to current cybersecurity threats is selected from the MITREAT&CK TTPs (Tactics, Techniques, and Procedures) database and injected into the digital twin environment. For example, if the primary threat facing the network is ransomware attacks, relevant ransomware attack techniques can be selected from the database, such as exploiting vulnerabilities to spread and encrypting files, and these attack processes can be simulated in the digital twin environment.

[0052] Defense strategy application and effectiveness monitoring: Apply the developed defense strategy to the digital twin environment to observe its effectiveness. For example, for a Level 1 response defense strategy, the digital twin environment simulates the process of automatically isolating the infected host and initiating traffic scrubbing, monitoring changes in network traffic, the status of the infected host, and whether other devices are affected.

[0053] Calculate the return on investment (ROI): Calculate the return on investment (ROI) based on the effectiveness of the defense strategy in the digital twin environment. Defense costs include equipment procurement, software licensing, and manpower investment required to implement the defense strategy; potential losses are estimated based on business interruption losses, data leakage losses, reputation losses, etc. caused by the attack. The ROI calculation formula is If the ROI is greater than the set threshold (such as 100%), the defense strategy is considered effective and can be deployed in the actual production environment. If the ROI does not reach the threshold, the defense strategy needs to be adjusted and optimized, such as adjusting the priority of defense measures, increasing defense resource investment, etc., and then verified again in the digital twin environment.

[0054] Knowledge distillation and subgraph distribution (optional): The knowledge distillation step is performed periodically (for example, in the early morning hours when network traffic is low). A pruning algorithm is used to remove redundant nodes and edges from the dynamic knowledge graph, compressing the knowledge graph into lightweight subgraphs, reducing the number of nodes by approximately 80%. The lightweight subgraphs are distributed to edge computing nodes via the P2P network. After receiving the subgraphs, the edge computing nodes store them in a local cache. When edge devices detect anomalies in local network traffic, they use the subgraphs to perform local threat analysis, quickly determine whether there are potential security threats, and provide timely warnings and preliminary processing. This reduces reliance on core servers, reduces network transmission pressure, and keeps edge device memory usage below 500MB.

[0055] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0056] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the content of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network information security dynamic early warning method based on knowledge graph, characterized in that: include: Step S1: acquiring network device logs, threat intelligence text, and traffic metadata in real time through a multi-source heterogeneous data acquisition module, wherein the data at least includes structured vulnerability numbers, unstructured attack tactic descriptions, and time-series traffic burst characteristics; Step S2: extracting entity relationships from the data using a streaming knowledge extraction technology based on a pre-trained language model to construct a dynamic knowledge graph; Step S3: Predict the threat propagation path based on a hybrid model of a graph attention network and a gated recurrent unit, where the graph attention network is used for spatial modeling and the gated recurrent unit is used for temporal modeling. The hybrid model satisfies: in is the Sigmoid function, 、 is a trainable parameter; Step S4: Generate a hierarchical defense strategy based on the three-dimensional risk assessment value R. The calculation formula of R is: in, is the environmental correction factor, Represents the value of the asset, represents the maximum asset value, Indicates the vulnerability score, is the number of hops in the attack path; Step S5: Simulate and verify the effectiveness of the defense strategy in the digital twin environment, and deploy it to the production environment after verification.

2. A network information security dynamic early warning method based on knowledge graph according to claim 1, characterized in that: In step S1, the multi-source heterogeneous data acquisition module includes: Structured data interface: parses CVE numbers and port numbers in Syslog logs; Unstructured data processing unit: uses the BERT-NER model to extract attack tactic descriptions from threat intelligence text; Time series data analysis unit: Calculates the variance threshold of NetFlow traffic to identify burst traffic.

3. A network information security dynamic early warning method based on knowledge graph according to claim 1, characterized in that: The step S2 specifically includes: Step S21: Identify attack entities in the text through the BiLSTM-CRF layer; Step S22: Generate entity relationship triples based on dependency syntax analysis; Step S23: Create new ontology nodes for unregistered entity types to incrementally expand the knowledge graph.

4. A network information security dynamic early warning method based on knowledge graph according to claim 3, characterized in that: In step S23, the newly added ontology node is created according to the following rules: When the frequency of unregistered entities ≥ F_threshold, the new ontology creation process is triggered; New ontology nodes are automatically associated with the nearest neighbor concept class; Generate a snapshot of the ontology version and push it to the knowledge graph governance platform.

5. The network information security dynamic early warning method based on knowledge graph according to claim 1 is characterized in that: Also included between steps S2 and S3: The knowledge distillation step compresses the dynamic knowledge graph into lightweight subgraphs; In the subgraph distribution step, the subgraph is deployed to the edge computing node through the P2P network.

6. A network information security dynamic early warning method based on knowledge graph according to claim 1, characterized in that: The hierarchical defense strategy in step S4 specifically includes: Level 1 response (R≥0.8): Automatically isolate the infected host and initiate traffic cleaning; Level 2 response (0.5≤R<0.8): Close high-risk ports and generate a work order; Level 3 response (R<0.5): Record the log and send an early warning notification.

7. The method for dynamic early warning of network information security based on knowledge graph according to claim 1 is characterized in that: The digital twin environment verification in step S5 includes: Clone the real network topology based on LLDP protocol; Inject MITREAT&CKTTPs attack behavior data; Calculate the return on investment of your defense strategy.

8. A network information security dynamic early warning system based on knowledge graph for implementing the method described in any one of claims 1 to 7, characterized in that: The system includes: Multimodal data collection module, used to obtain network device logs, threat intelligence text and traffic metadata; Dynamic knowledge graph construction engine, used to extract entity relationships from collected data and build dynamic knowledge graphs; Threat propagation dynamics modeling module, integrating a hybrid model of graph neural network and time recursive network; Adaptive strategy generator, used to generate hierarchical defense strategies based on three-dimensional risk assessment values; The digital twin verification module verifies the effectiveness of the defense strategy by simulating the attack path.

9. A network information security dynamic early warning system based on knowledge graph according to claim 8, characterized in that: The dynamic knowledge graph construction engine includes: Stream processing unit, real-time analysis of structured data, unstructured text and time series traffic; Entity alignment module, which implements entity mapping across data sources based on the TransE algorithm; The version control module supports graph version rollback and incremental updates.

10. A network information security dynamic early warning system based on knowledge graph according to claim 9, characterized in that: The entity alignment module adopts the improved TransE-RS algorithm, and its loss function is: Among them, the first term is the traditional entity relationship embedding loss, and the second term is the relationship semantic constraint term, which is achieved through semantic vector similarity calculation; is the balance coefficient, is the regularization coefficient, is the model parameter regularization term.

Images