APT knowledge graph generation method and device

Abstract

The invention provides a method and a device for generating an APT knowledge graph. The method comprises the following steps: acquiring APT original feature data from a plurality of APT feature information sources; dividing the APT original feature data into training data and standby data; performing entity marking and relation marking on the training data; training the initial entity recognition model and the initial relationship recognition model by adopting the training data, the entity information of each data in the training data and the relationship information among the data; performing entity identification and relation identification on the to-be-used data by adopting an entity identification model and a relation identification model; and generating an APT knowledge graph containing the APT feature information in the plurality of APT feature information sources for APT attack recognition. The APT original feature data obtained from each APT feature information source can be precisely integrated, the APT feature information integration precision is improved, query repetition is avoided, and the APT attack recognition efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method for generating an APT knowledge graph, an apparatus for generating an APT knowledge graph, a computer device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Advanced Persistent Threat (APT) attacks refer to long-term, covert and targeted cyber attacks launched by highly organized and well-resourced attackers (such as state-sponsored hacker groups, professional criminal groups, etc.).

[0003] Currently, APT attack detection is typically performed based on APT signature information, integrating multiple alerts and log data generated by security software. However, APT signature information often exists in a fragmented form. For example, Organization A may publicly disclose some APT signature information, while Organization B may disclose other information. To improve the accuracy of APT attack identification, it is necessary to integrate the APT signature information disclosed by different organizations. This integrated APT signature information allows security analysts to identify APT attacks more comprehensively and accurately.

[0004] However, the publicly available APT signature information from different organizations may be substantially the same or different. For substantially identical APT signature information, differences in the expression methods and data formats used by different organizations can lead to the misidentification of identical APT signature information as different. This leads to redundant information in the integrated APT signature information, reducing its accuracy. This, in turn, results in a large amount of APT signature information required for APT attack identification, reducing its efficiency. Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide a method for generating an APT knowledge graph, an apparatus for generating an APT knowledge graph, a computer device, a computer-readable storage medium, and a computer program product to improve the accuracy of APT feature information integration and thereby improve the efficiency of APT attack identification.

[0006] To solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0007] In a first aspect, the present application provides a method for generating an APT knowledge graph, the method comprising: obtaining APT original feature data from multiple APT feature information sources; dividing the APT original feature data into training data and standby data; performing entity labeling and relationship labeling on the training data to obtain entity information of each data and relationship information between each data in the training data; using the training data and the entity information of each data and the relationship information between each data therein to train an initial entity recognition model and an initial relationship recognition model to obtain an entity recognition model and a relationship recognition model; using the entity recognition model and the relationship recognition model to perform entity recognition and relationship recognition on the standby data to obtain entity information of each data and relationship information between each data in the standby data; based on the entity information of each data and the relationship information between each data in the training data and the entity information of each data and the relationship information between each data in the standby data, using the APT knowledge graph architecture to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources for use in APT attack identification.

[0008] Compared to the prior art, the APT knowledge graph generation method provided in the first aspect of this application, when integrating APT feature information, no longer directly integrates the various APT original feature data based on content. Instead, a portion of the APT original feature data is first used for entity tagging and relationship tagging, and then the labeled APT original feature data is substituted into the entity recognition model and relationship recognition model for training, so that the model can learn the relationship between the APT original feature data. The trained entity recognition model and relationship recognition model are then used to extract entities and relationships from the remaining APT original feature data, thereby establishing an APT knowledge graph based on the labeled and extracted entity information and relationship information. In this way, the APT original feature data obtained from various APT feature information sources can be accurately integrated, thereby improving the accuracy of APT feature information integration. Based on the accurately integrated APT knowledge graph, security analysts can avoid query duplication and improve the efficiency of APT attack identification.

[0009] In other embodiments provided in the present application, the APT original feature data includes structured data and unstructured data; entity labeling and relationship labeling are performed on the training data to obtain entity information of each data in the training data and relationship information between each data, including: obtaining entity identifiers from structured data; using entity identifiers to entity label the training data in the unstructured data to obtain entity information of each data in the training data.

[0010] In the process of entity labeling of training data, structured data can obtain entities based on its own structure, and unstructured data can be labeled based on the entity information in the structured data. This can effectively and accurately label unstructured data and improve the accuracy of entity labeling.

[0011] In other embodiments provided in the present application, entity identification is used to perform entity tagging on training data in unstructured data to obtain entity information of each data in the training data, including: performing word segmentation and formatting on the training data in the unstructured data in sequence to obtain formatted standard word segmentation data; and using entity identification to perform entity tagging on the formatted standard word segmentation data to obtain entity information of each data in the training data.

[0012] When performing entity tagging on unstructured data, we first perform word segmentation and formatting on the data to break it down into multiple standard word segments. Word segmentation can represent individual entities, so using multiple word segmentation for entity tagging can improve the accuracy of entity tagging.

[0013] In other embodiments provided in the present application, entity identification is used to perform entity tagging on training data in unstructured data to obtain entity information of each data in the training data, including: using entity identification to perform entity tagging on training data in unstructured data to obtain complete entity information of each data in the training data; splitting the complete entity information by Chinese characters and English words to obtain entity information of each data in the training data.

[0014] When performing entity tagging on unstructured data, after tagging the entity, split the entity into characters or words so that the characters or words are substituted into the entity recognition model for training. This allows the model to fully learn and thus improve the accuracy of the model in identifying entities.

[0015] In other embodiments provided in the present application, the initial entity recognition model and the initial relationship recognition model are trained using training data and the entity information of each data and the relationship information between each data to obtain an entity recognition model and a relationship recognition model, including: using the training data and the entity information of each data therein to train the initial entity recognition model to obtain an entity recognition model; using the entity information of each data in the training data and the relationship information between each data to train the initial relationship recognition model to obtain a relationship recognition model.

[0016] When training a relationship recognition model, using marked entity information and relationship information for training can avoid a large amount of training data from participating in model training. While ensuring the accuracy of model training, it can improve the training efficiency of the relationship recognition model.

[0017] In other embodiments provided in the present application, an entity recognition model and a relationship recognition model are used to perform entity recognition and relationship recognition on the data to be used to obtain entity information of each data in the data to be used and relationship information between each data, including: using an entity recognition model to perform entity recognition on the data to be used to obtain domain entity information of each data in the data to be used; using a general entity recognition model to perform entity recognition on the data to be used to obtain general entity information of each data in the data to be used; and determining the general entity information and domain entity information as the entity information of each data in the data to be used.

[0018] When acquiring entity information in the stand-by data, the domain entity information in the stand-by data is acquired through the trained entity recognition model, and the general entity information in the stand-by data is acquired through the general entity recognition model, thereby achieving the acquisition of entity information in the stand-by data and improving the accuracy and comprehensiveness of entity information acquisition.

[0019] In other embodiments provided in the present application, the APT original feature data includes unstructured data; before entity tagging and relationship tagging of the training data, the method further includes: tagging the article titles of the training data for relevance, and obtaining the correlation results between each data in the training data and the APT; using the training data and the correlation results between each data therein and the APT to train an initial data filtering model, to obtain a data filtering model, so as to filter out data that is not relevant to the APT in the stand-alone data.

[0020] Before performing entity tagging and relationship tagging, a model that can filter unstructured data unrelated to APT is first trained through article title tagging. Then, the trained model is used to filter out unstructured data unrelated to APT, and the training data in the filtered unstructured data is used to train the entity recognition model and the relationship recognition model. This can improve the accuracy and efficiency of the entity recognition model and the relationship recognition model training.

[0021] In other embodiments provided in the present application, the APT original feature data includes structured data, semi-structured data and unstructured data, and the training data and the stand-by data are unstructured data; based on the entity information of each data in the training data and the relationship information between each data, as well as the entity information of each data in the stand-by data and the relationship information between each data, the APT knowledge graph architecture is used to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources, including: performing concept fusion on the structured data to obtain fused structured data; performing entity and attribute fusion on the semi-structured data to obtain fused semi-structured data; performing entity, attribute and relationship fusion on the unstructured data and the entity information of each data therein and the relationship information between each data to obtain fused structured data; based on the fused structured data, the fused semi-structured data and the fused structured data, the APT knowledge graph architecture is used to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources.

[0022] When performing data fusion, fusing data of different structures to different degrees can improve the accuracy of data fusion.

[0023] In other embodiments provided in the present application, before adopting the APT knowledge graph architecture to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources, the method also includes: constructing an initial APT knowledge graph architecture based on APT query requirements; obtaining target content related to the content in the initial APT knowledge graph architecture from known network security knowledge, and adding the target content to the initial APT knowledge graph architecture to obtain an APT knowledge graph architecture to be verified; using query requirements of multiple different users to search and verify the APT knowledge graph architecture to be verified, and adding content corresponding to the requirements that cannot be found to the APT knowledge graph architecture to obtain an APT knowledge graph architecture.

[0024] In the construction of the APT knowledge graph architecture, the initial architecture is first built based on the needs, and then the known graph is structured to supplement the architecture. It is then verified through actual needs and supplemented here. In this way, an APT knowledge graph architecture can be built that can meet the actual needs of users without being too complicated, thereby improving the accuracy of the APT knowledge graph architecture construction.

[0025] According to a second aspect of the present application, there is provided an apparatus for generating an APT knowledge graph, the apparatus comprising: an acquisition module for acquiring APT original feature data from a plurality of APT feature information sources; a division module for dividing the APT original feature data into training data and standby data; a labeling module for performing entity labeling and relationship labeling on the training data to obtain entity information of each data in the training data and relationship information between each data; a training module for training an initial entity recognition model and an initial relationship recognition model using the training data and the entity information of each data therein and the relationship information between each data to obtain an entity recognition model and a relationship recognition model; an identification module for performing entity recognition and relationship recognition on the standby data using the entity recognition model and the relationship recognition model to obtain entity information of each data in the standby data and relationship information between each data; a generation module for generating an APT knowledge graph containing APT feature information from a plurality of APT feature information sources based on the entity information of each data in the training data and the relationship information between each data and the entity information of each data in the standby data and the relationship information between each data, for use in APT attack identification.

[0026] A third aspect of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method in the first aspect.

[0027] A fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the method in the first aspect when the computer program is executed by a processor.

[0028] A fifth aspect of the present application provides a computer program product, comprising a computer program, which implements the steps of the method in the first aspect when the computer program is executed by a processor.

[0029] The APT knowledge graph generation device provided in the second aspect of this application, the computer device provided in the third aspect, the computer-readable storage medium provided in the fourth aspect, and the computer program product provided in the fifth aspect have the same or similar beneficial effects as the APT knowledge graph generation method provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The above and other objects, features and advantages of the exemplary embodiments of the present application will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0031] Figure 1 Schematic diagram of an application scenario of the method for generating an APT knowledge graph in an embodiment of the present application;

[0032] Figure 2 The process diagram of the method for generating the APT knowledge graph in the embodiment of this application is as follows: Figure 1 ;

[0033] Figure 3 The process diagram of the method for generating the APT knowledge graph in the embodiment of this application is as follows: Figure 2 ;

[0034] Figure 4 The structure of the device for generating the APT knowledge graph in the embodiment of this application is shown as follows: Figure 1 ;

[0035] Figure 5 The structure of the device for generating the APT knowledge graph in the embodiment of this application is shown as follows: Figure 2 ;

[0036] Figure 6 Schematic diagram of the structure of the computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0037] The following describes exemplary embodiments of the present application in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Instead, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0038] It should be noted that, unless otherwise specified, the technical or scientific terms used in this application should have the common meanings understood by those skilled in the art to which this application belongs.

[0039] Currently, when integrating APT signature information, due to varying degrees of discrepancies in how different data sources express and format APT signature information, the integrated APT signature information contains duplicate information, which in turn reduces the accuracy of the APT signature integration. Excessive duplication of APT signature information also causes security analysts to obtain duplicate information during queries, further reducing the efficiency of identifying APT attacks.

[0040] In view of this, the embodiments of the present application provide a method for generating an APT knowledge graph, an apparatus for generating an APT knowledge graph, a computer device, a computer-readable storage medium, and a computer program product. Instead of directly integrating APT feature information obtained from different data sources, a portion of the APT feature information is first entity-labeled and relationship-labeled, and then the labeled APT feature information is substituted into the entity recognition model and the relationship recognition model for model training. The trained entity recognition model and the relationship recognition model are then used to perform entity extraction and relationship extraction on the remaining APT feature information, and finally an APT knowledge graph is generated based on the labeled and extracted entity information and relationship information. The model can fully extract entity information and relationship information, and the knowledge graph can merge duplicate entities and relationships, ultimately improving the accuracy of APT feature information integration and thereby improving the efficiency of APT attack identification.

[0041] It should be noted here that all components, data and related processing methods involved in this application are authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions.

[0042] First, the application scenario of the APT knowledge graph generation method provided in the embodiment of the present application is described.

[0043] Figure 1 This is a schematic diagram of the application scenario of the method for generating the APT knowledge graph in the embodiment of this application, see Figure 1 As shown, the scenario may include: multiple APT feature information sources and target systems.

[0044] Each APT signature information source can provide corresponding APT signature information. APT signature information sources can include knowledge bases such as CVE, CPE, and ATT&CK, as well as WikiData, Baidu Encyclopedia, and various security vendors and intelligence communities. APT signature information refers to the raw APT signature data directly provided by the APT signature information source. In knowledge bases such as CVE, CPE, and ATT&CK, raw APT signature data can be every piece of stored knowledge. In WikiData, Baidu Encyclopedia, and other sources, raw APT signature data can be every query result. In various security vendors and intelligence communities, raw APT signature data can be every piece of information provided.

[0045] The target system is used to obtain APT original feature data from various APT feature information sources and integrate the obtained APT original feature data to output an APT knowledge graph so that security analysts can use the APT knowledge graph to query and realize APT attack analysis.

[0046] Below, the method for generating the APT knowledge graph provided in the embodiment of the present application is described in detail.

[0047] Figure 2 The process diagram of the method for generating the APT knowledge graph in the embodiment of this application is as follows: Figure 1 , see Figure 2 As shown, the method may include:

[0048] S21: Acquire APT original feature data from multiple APT feature information sources.

[0049] Each APT feature information source stores a large amount of data. For each APT feature information source, all data can be retrieved, and then APT-related data can be filtered from the retrieved data. Each filtered data item is then identified as a piece of APT raw feature data. This ensures that APT raw feature data is fully captured in the APT feature information source, thereby improving the integrity of the APT knowledge graph content.

[0050] Of course, it is also possible to directly search for APT-related fields in the APT feature information source, and then determine each piece of data corresponding to the search result as a piece of APT original feature data.

[0051] Raw APT signature data refers to data from an APT signature information source that describes the characteristics of an APT, such as a detailed description of the behavior of a currently discovered APT attack. Security analysts can use this data to analyze APT attacks. However, the varying descriptions of raw APT signature data in different APT signature information sources hinder unified query and analysis.

[0052] S22: Divide the APT original feature data into training data and standby data.

[0053] Each piece of APT raw feature data obtained needs to be subjected to entity recognition and relationship recognition. If entity recognition and relationship recognition are performed based on rule matching for each piece of APT raw feature data, the accuracy and efficiency of recognition will be reduced. In this case, the neural network model can be used for post-training recognition, and the recognition accuracy and efficiency can be improved by the model's ability to learn potential features.

[0054] If all APT raw feature data is used as training data for model training, the trained model will not have any APT raw feature data to identify. If only a small amount of APT raw feature data is used for model training, the trained model may not be accurate enough. Therefore, it is necessary to divide the acquired APT raw feature data into training data and standby data in an appropriate ratio. The training data is used to train the model, while the standby data is used by the trained model to identify entities and relationships.

[0055] In the specific division, the division may be performed according to a ratio, for example, 2:8, or according to a quantity, for example, 20:x-20, where x is the total number of the acquired APT original feature data.

[0056] S23: Perform entity labeling and relationship labeling on the training data to obtain entity information of each data in the training data and relationship information between each data.

[0057] The training data contains multiple pieces of APT raw feature data. Each piece of APT raw feature data needs to be entity- and relationship-labeled. Specifically, entities within each piece of APT raw feature data are identified and labeled. Connections are established between entities within each piece of APT raw feature data, and relationship-labeled for these connections. Furthermore, connections are established between two entities that are related within each piece of APT raw feature data, and relationship-labeled for these connections.

[0058] Entities and relationships can be labeled manually or through tools that can recognize entities and relationships. The tools here can refer to tools that use rule matching to identify entities and relationships and can automatically label them.

[0059] S24: Using the training data and the entity information of each data and the relationship information between each data, the initial entity recognition model and the initial relationship recognition model are trained to obtain the entity recognition model and the relationship recognition model.

[0060] The entities in each APT raw feature data in the training data are labeled, the relationships between entities in each APT raw feature data in the training data are labeled, and the relationships between entities in multiple APT raw feature data in the training data are labeled. The initial entity recognition model and the initial relationship recognition model can adopt the architecture of a known recognition model. The initial entity recognition model and the initial relationship recognition model are also prepared. At this point, model training can begin.

[0061] First, the original feature data of each APT in the training data and its corresponding entity information are substituted into the initial entity recognition model for training to obtain the entity recognition model.

[0062] Then, the entity information corresponding to each APT's raw feature data in the training data, as well as the relationship information corresponding to each entity information, are substituted into the initial relationship recognition model for training to obtain the relationship recognition model. Using entity information and relationship information to train the relationship recognition model can reduce the model's data processing load, while ensuring the accuracy of the relationship recognition model training and improving its training efficiency.

[0063] In the training of the relationship recognition model, the original feature data of each APT in the training data and its corresponding entity information and relationship information can also be input into the initial relationship recognition model for training, and the relationship recognition model can also be obtained.

[0064] The specific training method of the training data in each model is the same as the training method of the conventional artificial neural network model and will not be repeated here.

[0065] S25: Perform entity recognition and relationship recognition on the data to be used using the entity recognition model and the relationship recognition model to obtain entity information of each data in the data to be used and relationship information between each data.

[0066] In other words, each APT raw feature data in the unused data is input into the entity recognition model, and the entity recognition model outputs the entity information in the corresponding APT raw feature data. The individual entity information in each APT raw feature data is associated with each other, thereby generating relationship information between the individual entity information in each APT raw feature data. Next, the entity information corresponding to the multiple APT raw feature data is input into the relationship recognition model, and the relationship recognition model outputs the relationship information between the individual entity information (some entity information is associated with each other, while some entity information is not associated with each other).

[0067] Of course, in the processing of the relationship recognition model, multiple APT original feature data and their corresponding entity information can also be input into the relationship recognition model, and the relationship recognition model can also output the relationship information between entities in each APT original feature data.

[0068] S26: Based on the entity information of each data in the training data and the relationship information between each data, as well as the entity information of each data in the stand-by data and the relationship information between each data, an APT knowledge graph architecture is adopted to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources for use in APT attack identification.

[0069] The entity information of each APT original feature data in the training data and the relationship information between the entity information are obtained through labeling, and the entity information of each APT original feature data in the stand-by data and the relationship information between the entity information are obtained through model recognition. So far, the entity information of all APT original feature data obtained from multiple APT feature information sources and the relationship information between each entity information have been obtained, that is, which entities are in all APT original feature data and whether these entities are associated with each other have been obtained.

[0070] The APT knowledge graph architecture organizes entities, attributes, and relationships related to APT attacks in a graph structure, supporting the analysis and sharing of threat intelligence. The APT knowledge graph architecture consists of an entity layer, a relationship layer, and an attribute layer. The entity layer can include: attacker entities (hacker groups, nation-state support teams, etc.), attack tools (malware, vulnerability exploits, etc.), attack targets (industries, organizations, systems, etc.), attack behaviors (attack phases, techniques, tactics, etc.), and infrastructure (IP addresses, domain names, C2 servers, etc.). The relationship layer can include: attacker-use-tool relationships, tool-exploit-vulnerability relationships, attack-target-target relationships, behavior-belong-to-phase relationships, and infrastructure-association-attacker relationships. The attribute layer can include: time attributes (first discovery time, active time period), technical attributes (TTPs - tactics, techniques, and procedures), confidence indicators (intelligence credibility level), and source attributes (intelligence source, report links).

[0071] The entity information identified from each APT raw feature data is written to the corresponding node in the entity layer of the APT knowledge graph architecture. The nodes in the relationship layer of the APT knowledge graph architecture are associated based on the relationship information between the entity information. Furthermore, the attribute information of the entity information identified from each APT raw feature data is added to the corresponding node in the attribute layer of the APT knowledge graph architecture. The specific method for identifying attribute information can use rule matching or a trained model, which is not limited here.

[0072] At this point, an APT knowledge graph containing network-wide APT signature information is generated. Security analysts can query the APT knowledge graph based on the content in the alarm data or log data output by the security analysis software. If no relevant knowledge is found, it indicates that the corresponding alarm data or log data does not contain APT attack issues. If relevant knowledge is found, it indicates that the corresponding alarm data or log data does contain APT attack issues. In this case, the APT attack needs to be blocked based on the retrieved knowledge to ensure user information security.

[0073] As can be seen from the above content, the APT knowledge graph generation method provided by the embodiment of the present application no longer directly integrates the various APT original feature data based on content when integrating APT feature information. Instead, a portion of the APT original feature data is first used for entity labeling and relationship labeling, and then the labeled APT original feature data is substituted into the entity recognition model and relationship recognition model for training, so that the model can learn the relationship between the APT original feature data, and then the trained entity recognition model and relationship recognition model are used to extract entities and relationships from the remaining APT original feature data, thereby establishing an APT knowledge graph based on the labeled and extracted entity information and relationship information. In this way, the APT original feature data obtained from various APT feature information sources can be accurately integrated, thereby improving the accuracy of APT feature information integration. Based on the accurately integrated APT knowledge graph, security analysts can avoid query duplication and improve the efficiency of APT attack identification.

[0074] Furthermore, as a Figure 2 As a refinement and extension of the method shown, the embodiment of the present application also provides a method for generating an APT knowledge graph.

[0075] Figure 3 The process diagram of the method for generating the APT knowledge graph in the embodiment of this application is as follows: Figure 2 , see Figure 3 As shown, the method may include:

[0076] S31: Build APT knowledge graph architecture.

[0077] Specifically, S31 may include:

[0078] S31a: Build the initial APT knowledge graph architecture based on APT query requirements.

[0079] APT query requirements can refer to what kind of information the current user needs to query in the APT knowledge graph. For example, if you need to query attackers, attack targets, and attack behaviors, then the query of attackers, attack targets, and attack behaviors is the APT query requirement.

[0080] Based on the information in the APT query, corresponding nodes can be established, and then connections between nodes can be established. For example, attacker nodes, target nodes, and attack behavior nodes can be created and then connected. In this way, the established nodes and the connections between nodes form the initial APT knowledge graph architecture.

[0081] S31b: Obtain target content related to the content in the initial APT knowledge graph architecture from known network security knowledge, and add the target content to the initial APT knowledge graph architecture to obtain the APT knowledge graph architecture to be verified.

[0082] The nodes and their relationships in the initial APT knowledge graph architecture may be insufficient for actual query needs. Based on the initial APT knowledge graph architecture, relevant content can be found in known network security knowledge to improve the APT knowledge graph architecture.

[0083] Known cybersecurity knowledge may include various security report materials and existing cybersecurity knowledge graphs in the field of cybersecurity.

[0084] In the known network security knowledge, search for content related to each node in the initial APT knowledge graph architecture, so as to create new nodes in the initial APT knowledge graph architecture with the found content, and establish an association relationship between the new node and the existing related nodes to obtain the APT knowledge graph architecture to be verified.

[0085] S31c: Use query requirements of multiple different users to search and verify the APT knowledge graph architecture to be verified, and add the content corresponding to the requirements that cannot be found to the APT knowledge graph architecture to be verified to obtain the APT knowledge graph architecture.

[0086] The scale of the APT knowledge graph architecture to be verified is initially able to meet the query needs of different users. In order to further improve the query capability of the APT knowledge graph and provide more users with effective queries, multiple actual query demand instances of different users can also be used to query in the APT knowledge graph architecture for verification and supplementation.

[0087] During specific query, verification and supplement, multiple keywords can be obtained from a user's query needs, and then multiple keywords can be used to query in the nodes of the APT knowledge graph architecture to be verified. If a keyword is not found in the APT knowledge graph architecture to be verified, it means that the APT knowledge graph architecture to be verified still lacks the node corresponding to the keyword. At this time, the node of the keyword is added to the APT knowledge graph architecture to be verified, and the association relationship between the node and other queried keywords is established. If the keywords are all found in the APT knowledge graph architecture to be verified, but there is no association between the nodes corresponding to the queried keywords, it means that the APT knowledge graph architecture to be verified still lacks the association relationship between the nodes corresponding to the keywords. At this time, the association relationship is added between the nodes of the keywords found in the APT knowledge graph architecture to be verified.

[0088] The keyword here can be a field directly extracted from the user's query requirements, such as "attacker", or it can be a field that is conceptualized from the query requirements. For example, if the user's query requirement is "query the targets attacked by the xx organization", the keyword is "attack target".

[0089] The nodes in the APT knowledge graph architecture for matching can be the names of the nodes, such as attackers, attack targets, attack tools, attack behaviors, etc.

[0090] Based on the APT query requirements, the initial APT knowledge graph architecture is generated, and the initial APT knowledge graph architecture is expanded based on the known network security knowledge to obtain the APT knowledge graph architecture to be verified. The APT knowledge graph architecture to be verified is then verified and expanded based on the user query requirements, and finally a complete APT knowledge graph architecture is obtained.

[0091] It should be noted here that the above steps S31b and S31c can be performed iteratively, that is, as known network security knowledge and user query needs are continuously updated, the APT knowledge graph architecture is also continuously expanded and improved.

[0092] After the APT knowledge graph architecture is constructed, we can then obtain APT original feature data from multiple APT feature information sources and extract entities, attributes, and relationships from them to fill in the APT knowledge graph architecture and generate an APT knowledge graph.

[0093] S32: Acquire APT original feature data from multiple APT feature information sources.

[0094] Different APT feature information sources have different data structures, so the structures of APT original feature data obtained from different APT feature information sources are also different.

[0095] In general, the acquired APT raw feature data includes structured data, semi-structured data and unstructured data.

[0096] When the APT feature information source is an open knowledge base, domain knowledge base, domain knowledge graph, or general vocabulary, the raw APT feature data obtained from it is structured data. When the APT feature information source is encyclopedia data, open source data in the security field, or security field materials, the raw APT feature data obtained from it is semi-structured data. When the APT feature information source is reports from various security-related vertical websites, intelligence community data, etc., the raw APT feature data obtained from it is unstructured data.

[0097] Different data structures require different approaches to extracting entities, attributes, and relationships. For structured and semi-structured data, entities, attributes, and relationships can be directly extracted using methods such as rule matching. For unstructured data, however, model training and model recognition are required to extract entities, attributes, and relationships.

[0098] S33: Divide the APT original feature data into training data and standby data.

[0099] Here, the unstructured APT original feature data is mainly divided into training data and standby data. The specific division method has been described in detail in step S22 of the above embodiment and will not be repeated here.

[0100] S34: Training a data filtering model to filter data irrelevant to the APT in the stand-by data.

[0101] The training data may contain APT raw feature data that is not related to APTs. Given that the amount of APT raw feature data in the training data is not particularly large, a data filtering model can be trained based on the training data to pre-filter APT raw feature data that is not related to APTs in the larger amount of unused data.

[0102] Specifically, S34 may include:

[0103] S34a: Relevance marking is performed on the article titles of the training data to obtain the correlation results between each data in the training data and the APT.

[0104] Since the APT original feature data in the training data is unstructured data, and unstructured data is generally expressed in the form of articles, and the title of the article can represent the main content of the article, therefore, the article title of each APT original feature data in the training data can be used to determine whether it is related to APT. If it is related, it will be marked as related; if not, it will be marked as irrelevant, thereby obtaining each APT original feature data in the training data and the label of whether it is related to APT.

[0105] In the process of determining whether an article title is related to an APT, the article title can be matched with relevant fields of the APT. If a match is successful with a certain field, the article title is determined to be related to the APT. If a match fails with all fields, the article title is determined to be unrelated to the APT.

[0106] Of course, manual methods can also be used to determine whether an article is related to APT based on the article title.

[0107] S34b: The initial data filtering model is trained using the training data and the correlation results between each data and the APT to obtain a data filtering model to filter data that is not related to the APT in the stand-by data.

[0108] The original feature data of each APT in the training data and the identification of whether it is related to the APT are input into the initial data filtering model for model training. After the training is completed, the data filtering model is obtained.

[0109] The trained data filtering model is used before extracting entities, attributes, and relationships from the data to be used. First, the raw feature data of each APT in the data to be used is input into the data filtering model. The data process model can output a label indicating whether each raw feature data is related to the APT. Based on the label, the raw feature data of APT that is not related to the APT is deleted. The remaining raw feature data in the data to be used is the raw feature data related to the APT, so that entities, attributes, and relationships can be extracted. This can improve the efficiency and accuracy of the extraction of entities, attributes, and relationships.

[0110] S35: Perform entity labeling and relationship labeling on the training data to obtain entity information of each data in the training data and relationship information between each data.

[0111] Since the APT original feature data in the training data is unstructured data, unstructured data has greater flexibility in expression. In order to achieve accurate expression of APT feature information, the entity information of structured data in the APT original feature data can be used for entity extraction.

[0112] Specifically, S35 may include:

[0113] S35a: Obtain entity identifiers from structured data.

[0114] In structured data, the content of APT raw feature data exists in the form of key-value pairs. The information corresponding to the "key" in each APT raw feature data in the structured data is obtained, and the information corresponding to the "key" is used as the entity identifier.

[0115] For example, suppose the raw signature data for an APT in structured data is a table. This table includes the attacker and their specific names, the target and their specific names, and the attack behavior and their specific details. In this table, the "keys" are attacker, target, and attack behavior. Therefore, there are three entity identifiers: attacker, target, and attack behavior.

[0116] S35b: Use entity identification to perform entity labeling on the training data in the unstructured data to obtain entity information of each data in the training data.

[0117] That is, entity recognition is performed on each APT original feature data in the training data according to the entity identifier, and the entity information corresponding to the entity identifier is identified.

[0118] In order to accurately identify entity information in APT original feature data, the APT original feature data can be segmented, formatted, and processed in advance so that based on the entity identification, it can be judged more quickly and accurately whether the corresponding content is entity information.

[0119] Specifically, S35b may include:

[0120] Step A1: perform word segmentation and formatting on the training data in the unstructured data in sequence to obtain formatted standard word segmentation data.

[0121] For each data in the training data of the unstructured data in the acquired APT original feature data (which can be considered as each article), the data is first segmented. When segmenting, it can be performed according to conventional segmentation methods such as semantics and phrases. Then, each field after segmentation is formatted. The formatting here can refer to converting the field into a preset standard format, for example: converting "April 1, 25" to "20250401", or it can refer to converting the field into another expression, for example: converting "send the query command first, then send the write command" to "SELECT * FROM table_name WHERE condition; INSERT INTO table_name (column1, column2) VALUES (value1, value2)". In this way, each unstructured APT original feature data in the training data is processed into multiple standard segmentation data.

[0122] Step A2: Use entity identification to perform entity tagging on the formatted standard word segmentation data to obtain entity information of each data in the training data.

[0123] Specifically, the features corresponding to the entity tag can be used to determine whether each standard segmentation data item conforms to the entity tag. If so, the conforming standard segmentation data is the content corresponding to the entity tag, and the conforming standard segmentation data is then used as the extracted entity information. If not, the non-conforming standard segmentation data is not the content corresponding to the entity tag, and the non-conforming standard segmentation data is discarded and not used as entity information.

[0124] Of course, it is also possible to manually determine whether each standard word segmentation is entity information based on entity identification.

[0125] In addition, in order to improve the accuracy of model training, the extracted entity information can be segmented more carefully so that the model can learn more fully.

[0126] Specifically, S35b may include:

[0127] Step B1: Use entity identification to perform entity labeling on the training data in the unstructured data to obtain complete entity information of each data in the training data.

[0128] That is, for each piece of data (which can be considered as each article) in the training data of the unstructured data in the acquired APT raw feature data, the corresponding entity information is searched in the article according to the entity identifier. In each article, for each entity identifier, the entity information may not be found, but one or more entity information may be found. Each entity information found in the article based on each entity identifier is a complete entity information.

[0129] Step B2: Split the complete entity information by Chinese characters or English words to obtain the entity information of each data in the training data.

[0130] Since complete entity information is generally composed of multiple characters, in order to enable the model to learn more thoroughly, each complete entity information can be annotated in BIO format according to Chinese characters and English words. In this way, each entity information in each piece of training data in the unstructured data of the acquired APT raw feature data is split into multiple Chinese characters and English words (which can be used as a set to avoid confusion between different entity information in different APT raw feature data during model learning, thereby ensuring the accuracy of model training).

[0131] Now that entity information has been extracted, we can proceed to extract relationship information. Relationship extraction can include both open and specified relationship extraction. Dependency syntax can be used to analyze the relationship between entity information corresponding to unstructured APT raw feature data in the training data. Relationship information between entity information corresponding to structured and semi-structured APT raw feature data in the training data can be determined through the relationships between their structures.

[0132] Before inputting the training data into the model for model training, the brat format annotation system can also be used to annotate entity information and relationship information so that the model can identify more accurately and improve the accuracy of model training.

[0133] S36: Using the training data and the entity information of each data therein to train the initial entity recognition model to obtain an entity recognition model.

[0134] The entity information in each APT original feature data in the training data has been extracted. Each APT original feature data in the training data and the entity information extracted therefrom are input into the initial entity recognition model for model training. The model obtained after training is the entity recognition model.

[0135] The above entity tagging and entity recognition model training can be summarized as follows: (1) By establishing a word segmenter, the original training data is split into Chinese characters and English words; (2) a training data category mapping is established to digitally identify the domain entity type; (3) the data generator code is implemented to process the training data into the model input format; (4) the build_transformer_model method in the bert4keras module is called, the electra model is specified, the CRF structure is defined to connect the output of the last fully connected layer in electra, and the model is compiled; (5) the training data generated in step (3) is passed to the model in step (4) for entity recognition model training and the model weights and the CRF transition probability matrix weights are saved.

[0136] S37: The initial relationship recognition model is trained using the entity information of each data and the relationship information between each data in the training data to obtain a relationship recognition model.

[0137] When training the relationship recognition model, instead of using the individual APT original feature data in the training data, the entity information marked in each APT original feature data in the training data and the relationship information marked between the entity information (including the relationship information between different entity information in the same APT original feature data, and also the relationship information between entity information in different APT original feature data) can be used.

[0138] The entity information marked in each APT original feature data in the training data and the relationship information marked between the entity information are input into the initial relationship recognition model for model training. The model obtained after training is the relationship recognition model.

[0139] S38: Use the entity recognition model and the relationship recognition model to perform entity recognition and relationship recognition on the data to be used, and obtain the entity information of each data in the data to be used and the relationship information between each data.

[0140] When identifying the data to be used, given that relationship identification can use the results of entity recognition, in order to improve the efficiency of overall recognition, entity recognition can be performed first, and then relationship recognition can be performed based on the entity information of entity recognition.

[0141] Specifically, S38 may include:

[0142] S38a: Use the entity recognition model to perform entity recognition on the data to be used, and obtain the domain entity information of each data in the data to be used.

[0143] That is, each unstructured APT original feature data in the unused data is input into the entity recognition model, and the output of the entity recognition model is each entity information extracted from the APT original feature data.

[0144] Since the entity recognition model is trained based on actual APT original feature data, and the actual APT original feature data has a strong professional field, the entity information extracted by the entity recognition model is domain entity information.

[0145] Common entity information in APT original feature data can be extracted through common entity recognition models or related regular expressions.

[0146] To improve the accuracy of general entity information extraction, you can use a general entity recognition model for entity extraction. To improve the efficiency of general entity information extraction, you can use regular expressions for entity extraction. The choice of extraction method, or a combination of the two, can be determined based on actual needs.

[0147] S38b: Use the general entity recognition model to perform entity recognition on the data to be used, and obtain general entity information of each data in the data to be used.

[0148] Each unstructured APT original feature data in the unused data is input into the universal entity recognition model, and the output of the universal entity recognition model is each universal entity information extracted from the APT original feature data.

[0149] In practical applications, general entity information, as the name implies, refers to general entity information, such as names of people, places, organizations, dates, etc. Domain entity information, as the name implies, refers to entity information unique to a specific professional field or vertical industry. Examples include disease names (diabetes, hypertension) and symptoms (headache, fever) in the medical field; legal provisions (Article 232 of the Criminal Law) and case types (civil litigation, criminal litigation) in the legal field; and technical terms (blockchain, machine learning) and programming languages ​​(Python, Java) in the technology field.

[0150] S38c: Determine the general entity information and the domain entity information as the entity information of each data in the to-be-used data.

[0151] General entity information and domain entity information constitute relatively comprehensive entity information. The general entity information and domain entity information extracted from each unstructured APT raw feature data in the waiting data is the entity information corresponding to the APT raw feature data.

[0152] For the structured and semi-structured APT original feature data in the stand-by data, conventional rule matching and other methods can be used to perform entity extraction to obtain the entity information corresponding to each structured and semi-structured APT original feature data in the stand-by data.

[0153] The entity information corresponding to the unstructured APT raw feature data in the training data is obtained through labeling. The entity information corresponding to the structured and semi-structured APT raw feature data in the training data can be obtained through conventional rule matching and other methods. At this point, the entity information corresponding to each piece of APT raw feature data obtained from multiple APT feature information sources has been obtained.

[0154] S38d: Using a relationship recognition model to perform relationship recognition based on the entity information corresponding to the stand-by data, and obtain relationship information between the entity information corresponding to the stand-by data.

[0155] The entity information corresponding to each unstructured APT original feature data in the stand-by data is input into the relationship recognition model, and the output of the relationship recognition model is the relationship information between each entity information.

[0156] For the structured and semi-structured APT original feature data in the stand-by data, conventional rule matching and other methods can be used to extract the relationship between the entity information corresponding to the structured and semi-structured APT original feature data, and obtain the relationship information between the entity information corresponding to each structured and semi-structured APT original feature data in the stand-by data.

[0157] The relationship information between the entity information corresponding to the unstructured APT raw feature data in the training data is obtained through labeling. The relationship information between the entity information corresponding to the structured and semi-structured APT raw feature data in the training data can be obtained through conventional rule matching and other methods. At this point, the relationship information between the entity information corresponding to each piece of APT raw feature data obtained from multiple APT feature information sources has also been obtained.

[0158] To extract attribute information corresponding to each piece of raw APT feature data obtained from multiple APT feature information sources, conventional attribute extraction methods can be used directly from the raw APT feature data. Alternatively, based on the extracted entity information, manual extraction can be performed for training data, while a trained attribute recognition model can be used for extraction of standby data. The specific attribute labeling and model training methods are the same as those for relationship extraction and will not be further described here.

[0159] In summary, raw APT feature data obtained from multiple APT feature information sources includes structured, semi-structured, and unstructured data. Structured and semi-structured data can be directly used to extract entity, attribute, and relationship information. Unstructured data requires training a model (using training data) and then applying the trained model to the unused data to extract entity, attribute, and relationship information.

[0160] S39: Based on the entity information and attribute information of each data in the training data and the relationship information between each entity information, as well as the entity information and attribute information of each data in the stand-by data and the relationship information between each entity information, an APT knowledge graph architecture is adopted to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources for use in APT attack identification.

[0161] In the process of generating the APT knowledge graph, the entity information, attribute information and relationship information corresponding to the structured data, semi-structured data and unstructured data in the APT original feature data need to be integrated into the APT knowledge graph.

[0162] Since structured data, semi-structured data, and unstructured data have different data structures, in order to correctly integrate them in the APT knowledge graph, it is necessary to first integrate the relevant content within the structured data, semi-structured data, and unstructured data.

[0163] Specifically, S39 may include:

[0164] S39a: Perform concept fusion on the structured data to obtain fused structured data.

[0165] Concept fusion refers to integrating different data into a hierarchical structure. This means reorganizing each APT's original feature data (which can be considered a table) in the structured data into a hierarchical structure based on the table header, ultimately creating a complete big data table, which is the fused structured data.

[0166] S39b: Fusing entities and attributes of the semi-structured data to obtain fused semi-structured data.

[0167] Since the correlation between semi-structured APT raw feature data is not strong, in order to ensure the accuracy of the knowledge in the APT knowledge graph, the entity information and attribute information corresponding to each APT raw feature data in the semi-structured data can be fused. The fusion here can be understood as de-duplication and merging to obtain the fused semi-structured data.

[0168] S39c: Fusing the unstructured data and the entity information of each data and the relationship information between each data in terms of entities, attributes and relationships to obtain fused structured data.

[0169] The entity information, attribute information, and relationship information of each unstructured APT raw feature data are accurately obtained through labeling or model processing. Therefore, the entity information, attribute information, and relationship information corresponding to each APT raw feature data in the unstructured data can be fused. Fusion here can also be understood as de-duplication merging to obtain the fused unstructured data.

[0170] S39d: Based on the fused structured data, the fused semi-structured data and the fused structured data, an APT knowledge graph architecture is adopted to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources.

[0171] That is, the entity information, attribute information and relationship information in the fused structured data, fused semi-structured data and fused structured data are filled into the corresponding positions of the entity layer, attribute layer and relationship layer in the APT knowledge graph architecture, and finally the APT knowledge graph is generated.

[0172] After the APT knowledge graph is generated, it can be evaluated based on the context, attributes, and logic of triples (entity, attribute, and relationship) knowledge. Based on the evaluation results, the final APT knowledge graph can be determined or adjusted before being put into use.

[0173] When using the APT knowledge graph, it can be stored in RDF format on Jena's fuseki server, making the storage of the APT knowledge graph more secure and convenient, improving the security and ease of use of the APT knowledge graph. Furthermore, when querying the APT knowledge graph, the user's query can be converted into a SPARQL statement for querying the APT knowledge graph, which can improve the efficiency and accuracy of the query.

[0174] At this point, the method for generating the APT knowledge graph provided in the embodiments of the present application has been fully explained.

[0175] Based on the same inventive concept, an embodiment of the present application also provides a device for generating an APT knowledge graph.

[0176] Figure 4 The structure of the device for generating the APT knowledge graph in the embodiment of this application is shown as follows: Figure 1 , see Figure 4 As shown, the apparatus may include: an acquisition module 41 , a division module 42 , a marking module 43 , a training module 44 , a recognition module 45 and a generation module 46 .

[0177] The acquisition module 41 is configured to acquire APT original feature data from multiple advanced persistent threat (APT) feature information sources.

[0178] The division module 42 is used to divide the APT original feature data into training data and standby data.

[0179] The labeling module 43 is used to perform entity labeling and relationship labeling on the training data to obtain entity information of each data in the training data and relationship information between each data.

[0180] The training module 44 is used to train the initial entity recognition model and the initial relationship recognition model using the training data and the entity information of each data and the relationship information between each data to obtain the entity recognition model and the relationship recognition model.

[0181] The recognition module 45 is configured to perform entity recognition and relationship recognition on the data to be used by using the entity recognition model and the relationship recognition model, so as to obtain entity information of each data in the data to be used and relationship information between each data.

[0182] A generation module 46 is used to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources based on the entity information of each data in the training data and the relationship information between each data, as well as the entity information of each data in the stand-by data and the relationship information between each data, using an APT knowledge graph architecture for APT attack identification.

[0183] Further, as Figure 4 As a refinement and extension of the device shown, an embodiment of the present application also provides a device for generating an APT knowledge graph.

[0184] Figure 5 The structure of the device for generating the APT knowledge graph in the embodiment of this application is shown as follows: Figure 2 , see Figure 5 As shown, the device may include:

[0185] The architecture module 51 is used to construct an initial APT knowledge graph architecture based on APT query requirements; obtain target content related to the content in the initial APT knowledge graph architecture from known network security knowledge, and add the target content to the initial APT knowledge graph architecture to obtain the APT knowledge graph architecture to be verified; use the query requirements of multiple different users to search and verify the APT knowledge graph architecture to be verified, and add the content corresponding to the requirements that cannot be found to the APT knowledge graph architecture to obtain the APT knowledge graph architecture.

[0186] The acquisition module 52 is configured to acquire APT original feature data from multiple advanced persistent threat (APT) feature information sources.

[0187] The division module 53 is used to divide the APT original feature data into training data and standby data.

[0188] The filtering module 54 is used to tag the article titles of the training data for relevance, and obtain the correlation results between each data in the training data and the APT; the training data and the correlation results between each data therein and the APT are used to train the initial data filtering model to obtain a data filtering model to filter out data that is not relevant to the APT in the stand-by data.

[0189] The marking module 55 is used to obtain entity identification from the structured data when the APT original feature data includes structured data and unstructured data; use the entity identification to perform entity marking on the training data in the unstructured data to obtain entity information of each data in the training data.

[0190] The tagging module 55 is specifically used to perform word segmentation and formatting on the training data in the unstructured data in sequence to obtain formatted standard word segmentation data; and use entity identification to perform entity tagging on the formatted standard word segmentation data to obtain entity information of each data in the training data.

[0191] The marking module 55 is specifically used to use entity identification to mark the training data in the unstructured data to obtain the complete entity information of each data in the training data; the complete entity information is split by Chinese characters and English words to obtain the entity information of each data in the training data.

[0192] The training module 56 is used to train the initial entity recognition model using the training data and the entity information of each data therein to obtain the entity recognition model; and to train the initial relationship recognition model using the entity information of each data in the training data and the relationship information between each data to obtain the relationship recognition model.

[0193] The recognition module 57 is configured to perform entity recognition and relationship recognition on the stand-by data using the entity recognition model and the relationship recognition model, and obtain entity information of each data in the stand-by data and relationship information between each data.

[0194] The identification module 57 is specifically used to use the entity recognition model to perform entity recognition on the waiting data to obtain domain entity information of each data in the waiting data; use the general entity recognition model to perform entity recognition on the waiting data to obtain general entity information of each data in the waiting data; and determine the general entity information and domain entity information as the entity information of each data in the waiting data.

[0195] The generation module 58 is used to perform concept fusion on the structured data to obtain fused structured data when the APT original feature data includes structured data, semi-structured data and unstructured data, and the training data and the stand-by data are unstructured data; perform entity and attribute fusion on the semi-structured data to obtain fused semi-structured data; perform entity, attribute and relationship fusion on the unstructured data and the entity information of each data therein and the relationship information between each data to obtain fused structured data; and based on the fused structured data, the fused semi-structured data and the fused structured data, adopt the APT knowledge graph architecture to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources.

[0196] It should be noted that the description of the above device embodiment is similar to the description of the above method embodiment and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0197] Based on the same inventive concept, an embodiment of the present application also provides a computer device.

[0198] Figure 6 This is a schematic diagram of the structure of the computer device in the embodiment of the present application, see Figure 6 As shown, the computer device may include: a memory 61, a processor 62 and a computer program stored in the memory 61, and the processor 62 executes the computer program to implement the method in the above embodiment.

[0199] It should be noted that the description of the above computer device embodiment is similar to the description of the above method embodiment and has similar beneficial effects as the method embodiment. For technical details not disclosed in the computer device embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0200] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the method of the aforementioned embodiment when executed by a processor.

[0201] It should be noted that the description of the above computer-readable storage medium embodiment is similar to the description of the above method embodiment and has similar beneficial effects as the method embodiment. For technical details not disclosed in the computer-readable storage medium embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0202] Based on the same inventive concept, an embodiment of the present application further provides a computer program product, which includes a computer program that implements the method in the aforementioned embodiment when executed by a processor.

[0203] It should be noted that the description of the above computer program product embodiment is similar to the description of the above method embodiment and has similar beneficial effects as the method embodiment. For technical details not disclosed in the computer program product embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0204] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for generating an APT knowledge graph, characterized in that: The method comprises: Obtain APT raw feature data from multiple advanced persistent threat (APT) feature information sources; Dividing the APT original feature data into training data and standby data; Performing entity labeling and relationship labeling on the training data to obtain entity information of each data in the training data and relationship information between each data; Using the training data and the entity information of each data and the relationship information between each data therein to train an initial entity recognition model and an initial relationship recognition model to obtain an entity recognition model and a relationship recognition model; Using the entity recognition model and the relationship recognition model to perform entity recognition and relationship recognition on the data to be used, to obtain entity information of each data in the data to be used and relationship information between each data; Based on the entity information of each data in the training data and the relationship information between each data, as well as the entity information of each data in the stand-by data and the relationship information between each data, an APT knowledge graph architecture is adopted to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources for use in APT attack identification.

2. The method according to claim 1, characterized in that The APT original feature data includes structured data and unstructured data; the entity tagging and relationship tagging of the training data to obtain entity information of each data in the training data and relationship information between each data include: Obtaining an entity identifier from the structured data; The entity identifier is used to perform entity marking on the training data in the unstructured data to obtain entity information of each data in the training data.

3. The method according to claim 2, characterized in that The step of using the entity identifier to perform entity tagging on the training data in the unstructured data to obtain entity information of each data in the training data includes: Performing word segmentation and formatting processing on the training data in the unstructured data in sequence to obtain formatted standard word segmentation data; The entity identifier is used to perform entity tagging on the formatted standard word segmentation data to obtain entity information of each data in the training data.

4. The method according to claim 2, characterized in that The step of using the entity identifier to perform entity tagging on the training data in the unstructured data to obtain entity information of each data in the training data includes: Using the entity identifier to perform entity tagging on the training data in the unstructured data to obtain complete entity information of each data in the training data; The complete entity information is split by Chinese characters or English words to obtain entity information of each data in the training data.

5. The method according to claim 1, wherein The initial entity recognition model and the initial relationship recognition model are trained using the training data and the entity information of each data and the relationship information between each data to obtain the entity recognition model and the relationship recognition model, including: Using the training data and entity information of each data therein to train an initial entity recognition model to obtain an entity recognition model; The initial relationship recognition model is trained using the entity information of each data and the relationship information between each data in the training data to obtain a relationship recognition model.

6. The method according to claim 1, characterized in that The adopting the entity recognition model and the relationship recognition model to perform entity recognition and relationship recognition on the stand-by data to obtain entity information of each data in the stand-by data and relationship information between each data includes: Performing entity recognition on the data to be used using the entity recognition model to obtain domain entity information of each data in the data to be used; Performing entity recognition on the data to be used using a universal entity recognition model to obtain universal entity information of each data in the data to be used; The general entity information and the domain entity information are determined as entity information of each data in the to-be-used data.

7. The method according to claim 1, characterized in that The APT original feature data includes unstructured data; before performing entity tagging and relationship tagging on the training data, the method further includes: Marking the article titles of the training data for relevance, and obtaining the relevance results of each data in the training data and APT; The training data and the correlation results between each data and APT are used to train the initial data filtering model to obtain a data filtering model for filtering data irrelevant to APT in the standby data.

8. The method according to claim 1, characterized in that The APT original feature data includes structured data, semi-structured data and unstructured data, and the training data and the standby data are unstructured data; based on the entity information of each data in the training data and the relationship information between each data, and the entity information of each data in the standby data and the relationship information between each data, an APT knowledge graph architecture is adopted to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources, including: Performing concept fusion on the structured data to obtain fused structured data; fusing the semi-structured data into entities and attributes to obtain fused semi-structured data; fusing the unstructured data and the entity information of each data and the relationship information between each data by entity, attribute and relationship to obtain fused structured data; Based on the fused structured data, the fused semi-structured data and the fused structured data, an APT knowledge graph architecture is adopted to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources.

9. The method according to any one of claims 1 to 8, characterized in that Before using the APT knowledge graph architecture to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources, the method further includes: Build the initial APT knowledge graph architecture based on APT query requirements; Acquire target content related to the content in the initial APT knowledge graph architecture from known network security knowledge, and add the target content to the initial APT knowledge graph architecture to obtain an APT knowledge graph architecture to be verified; The APT knowledge graph architecture to be verified is searched and verified using query requirements of multiple different users, and the content corresponding to the requirements that cannot be found is added to the APT knowledge graph architecture to be verified to obtain the APT knowledge graph architecture.

10. A device for generating an APT knowledge graph, characterized in that: The device comprises: An acquisition module is used to obtain APT raw feature data from multiple advanced persistent threat (APT) feature information sources; A division module, configured to divide the APT original feature data into training data and standby data; A labeling module is used to perform entity labeling and relationship labeling on the training data to obtain entity information of each data in the training data and relationship information between each data; A training module, configured to train an initial entity recognition model and an initial relationship recognition model using the training data and the entity information of each data and the relationship information between each data, to obtain an entity recognition model and a relationship recognition model; an identification module, configured to perform entity identification and relationship identification on the data to be used using the entity identification model and the relationship identification model, and obtain entity information of each data in the data to be used and relationship information between each data; A generation module is used to generate an APT knowledge graph containing APT feature information from multiple APT feature information sources based on the entity information of each data in the training data and the relationship information between each data and the entity information of each data in the stand-by data and the relationship information between each data, using an APT knowledge graph architecture, for APT attack identification.

Images