Multi-source network risk information fusion and risk assessment method and system

Abstract

The invention belongs to the technical field of network security, and particularly relates to a multi-source network risk information fusion and risk assessment method, which comprises the following steps of: extracting nodes and edges of a real-time event through an entity extraction tool, and constructing a multi-source heterogeneous threat knowledge graph based on the nodes and the edges; calculating a random walk transition probability matrix of the edge, and calculating a time-sensitive personalized random walk value based on the random walk transition probability matrix; a graph neural network model is adopted for training, graph neural network embedding and prediction are carried out in combination with the features of the nodes, and the classification probability is output; and carrying out three-dimensional sub-graph segmentation on the predicted multi-source heterogeneous threat knowledge graph, constructing a mapping index, carrying out aggregation calculation to obtain a propagation path and path popularity of a high-risk node, analyzing a sub-graph evolution trend and carrying out early warning. The method is suitable for carrying out dynamic analysis and prediction on multi-dimensional attack risks, and trend attack analysis of the industry changing along with time is achieved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a network risk information fusion and risk assessment method and system. BACKGROUND

[0002] In the field of network security, threat intelligence refers to forming operable threat warning information by collecting and analyzing data related to internal and external threats, and is used to guide organizations to identify, defend and respond to potential attacks. Threat intelligence provides input for risk information assessment, and risk information assessment quantifies the occurrence probability and potential impact of threat events to support the priority allocation of security resources.

[0003] Existing risk information analysis technologies mostly use rule matching methods based on statistics, and mainly have the following problems: Lack of time sensitivity, and unable to fully reflect the decay and activity of attack behavior over time; Too fine granularity or lack of industry integration, mostly limited to IP, domain name, file and other indicators of compromise (IOC) level, and difficult to comprehensively assess industry or regional risks; Lack of cross-checking and triggering response mechanism with real intelligence events, and difficult to model events with strong timeliness such as large-scale conferences and defense exercises. SUMMARY

[0004] In view of the above problems, the purpose of the present application is to provide a multi-source network risk information fusion and risk assessment method; The purpose of the present application is also to provide a multi-source network risk information fusion and risk assessment system.

[0005] A multi-source network risk information fusion and risk assessment method, comprising: Step S1, extracting nodes and edges of real-time events by an entity extraction tool, and constructing a multi-source heterogeneous threat knowledge graph based on the nodes and the edges; Step S2, calculating a random walk transition probability matrix of the edges, and calculating a time-sensitive personalized random walk value based on the random walk transition probability matrix; Step S3, training by using a graph neural network model, and performing graph neural network embedding and prediction in combination with the features of the nodes, and outputting a classification probability; Step S4, performing three-dimensional subgraph segmentation on the multi-source heterogeneous threat knowledge graph after the prediction is completed, constructing a mapping index, aggregating and calculating to obtain a propagation path and path heat of a high-risk node, analyzing a subgraph evolution trend and performing early warning.

[0006] The multi-source network risk information fusion and risk assessment method described in the present invention comprises a compromise detection indicator node, an attack tactics and technology node, a vulnerability node, a background node, and an event node; The types of edges include utilization relationship, ownership relationship, time relationship, intelligence trigger relationship, and propagation path relationship.

[0007] In the multi-source network risk information fusion and risk assessment method of the present invention, step S2 includes: Step S21, calculate the time weight of the edge (i, j) at time time, and the calculation formula is: ; Among them, λ is the time decay coefficient, which controls the degree of forgetting of historical events by communication; is the first appearance time of edge (i, j), is the current analysis time; base_weight is the edge weight without considering time decay and event enhancement; In step S22, when the edge (i, j) is a specific event, the enhanced weight of the edge (i, j) is calculated based on the time weight, and the calculation formula is: ; is the event enhancement factor, Indicates whether the edge (i, j) is related to the event; Step S23, calculating the random walk transition probability matrix of edge (i, j) according to the enhanced weight of the edge (i, j): ; The denominator represents the sum of the propagation weights of all possible next-hop neighbors k starting from node i; Step S24: Calculate the time-sensitive personalized random walk value based on the random walk probability matrix. The calculation formula of the time-sensitive personalized random walk value of the node s is:

[0008] in, is a one-hot vector starting from s; is the probability of jumping back to the starting point; is a normalized transfer matrix obtained by normalizing the random transfer probability matrix.

[0009] In the multi-source network risk information fusion and risk assessment method of the present invention, step S3 includes: Step S31, obtain the node features, the feature vector of node v include: ; is one-hot coded for node type; is the degree of the node; is the node score obtained from time-sensitive personalized random walk propagation; is whether it belongs to a specific event; is the timestamp of the latest occurrence; Step S32, in combination with the node features and neighbor aggregation information, a graph neural network model is selected for embedding and prediction, ; wherein R is the type of edge; is the neighbor connected to v through relationship r; is the independent weight of each edge type, v,r is a normalization factor; and respectively represent the u-th industry dimension and the v-th industry dimension; Step S33, using a graph neural network learning function outputs the classification probability of each node.

[0010] The multi-source network risk information fusion and risk assessment method provided by the application, the step S4 comprises: Step S41, according to the region dimension r, the industry dimension h and the time dimension t, the multi-source heterogeneous threat knowledge graph after prediction is divided into three-dimensional subgraphs, and the following is obtained: ; ; ; Step S42, constructing a three-dimensional mapping index, ; Step S43, performing subgraph risk assessment index aggregation calculation to obtain the propagation path of high-risk nodes and the path heat score; Step S44, based on the curve of the average risk changing with time, analyzing the subgraph evolution trend and performing early warning; Step S45, based on the three-dimensional mapping index and the risk aggregation model, interactive query is performed.

[0011] The multi-source network risk information fusion and risk assessment method provided by the application, the step S43 comprises: Step S431, the risk level distribution of the node is counted, including the number and proportion of high-risk nodes, medium-risk nodes and low-risk nodes; Step S432, output the probability of the high-risk node based on the probability distribution conversion function of the graph neural network model, and calculate the average risk according to the following formula: ; Wherein, P (v) represents the probability of node v being judged as a high-risk node; Step S433, listing the attack node list with the highest predicted risk according to the average risk; step S434, extracting the propagation path P={v1→v2→⋯→vk} between the high-risk nodes in each subgraph, and calculating the path heat score: .

[0012] The multi-source network risk information fusion and risk assessment method provided by the application comprises the steps of S45, The risk level of the node in the subgraph is displayed, and the risk level is red, orange and yellow respectively; The propagation path, timeline and path heat of the high-risk node are displayed; The source point and the end point of the propagation path are highlighted.

[0013] The multi-source network risk information fusion and risk assessment method provided by the application, wherein the graph neural network model adopts a graph convolution network model or a graph attention network or a relation graph convolution network.

[0014] The application also provides a multi-source network risk information fusion and risk assessment system, comprising, A multi-source heterogeneous threat knowledge graph construction module extracts nodes and edges of real-time events through an entity extraction tool, and constructs a multi-source heterogeneous threat knowledge graph based on the nodes and the edges; A time-sensitive personalized random walk value calculation module is connected with the multi-source heterogeneous threat knowledge graph construction module, calculates a random walk transition probability matrix of the edge, and calculates a time-sensitive personalized random walk value based on the random walk transition probability matrix; A classification probability calculation module is connected with the time-sensitive personalized random walk value calculation module, adopts a graph neural network model for training, and performs graph neural network embedding and prediction in combination with the features of the nodes, and outputs a classification probability; The risk aggregation and early warning module is connected with the classification probability calculation module and the multi-source heterogeneous threat knowledge graph construction module, performs three-dimensional subgraph segmentation on the multi-source heterogeneous threat knowledge graph after prediction, constructs a mapping index, aggregates and calculates a propagation path and path heat of a high-risk node, analyzes a subgraph evolution trend, and performs early warning.

[0015] The multi-source network risk information fusion and risk assessment system provided by the application, the time-sensitive personalized random walk value calculation module comprises, A time weight calculation module calculates the time weight of the edge; An enhanced weight calculation module is connected with the time weight calculation module, and the edge is a specific event, and the enhanced weight of the edge is calculated based on the time weight; A random walk transition probability matrix calculation module is connected with the enhanced weight calculation module, and the random walk transition probability matrix of the edge is calculated according to the enhanced weight of the edge; A time-sensitive personalized random walk value calculation module is connected with the random walk transition probability matrix calculation module, and the time-sensitive personalized random walk value is calculated based on the random walk probability matrix.

[0016] Beneficial effects: the application provides a network risk information fusion and risk assessment method combining personalized random walk (Personalized PageRank), time decay mechanism and graph neural network (Graph Neural Network, GNN), which is suitable for dynamic analysis and prediction of multi-dimensional attack risk, and realizes trend analysis of industry attack changing with time. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 It is a flow chart of a multi-source network risk information fusion and risk assessment method of the application.

[0018] Figure 2 It is a flow chart of a specific embodiment of step S2 of the application; Figure 3 It is a flow chart of a specific embodiment of step S3 of the application; Figure 4 It is a flow chart of a specific embodiment of step S4 of the application; Figure 5 It is a principle block diagram of a multi-source network risk information fusion and risk assessment system of the application; Figure 6 It is a principle block diagram of a time-sensitive personalized random walk value calculation module of the application; Figure 7 It is a principle block diagram of a risk aggregation and early warning module of the application. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work belong to the scope of protection of the present application.

[0020] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0021] The present application will be further described below with reference to the drawings and specific embodiments, but not as a limitation of the present application.

[0022] Referring to Figure 1 A multi-source network risk information fusion and risk assessment method, comprising: Step S1, extracting nodes and edges of real-time events by an entity extraction tool, and constructing a multi-source heterogeneous threat knowledge graph based on the nodes and the edges; Step S2, calculating a random walk transition probability matrix of the edges, and calculating a time-sensitive personalized random walk value based on the random walk transition probability matrix; Step S3, training by using a graph neural network model, and performing graph neural network embedding and prediction in combination with the features of the nodes, and outputting a classification probability; Step S4, performing three-dimensional subgraph segmentation on the multi-source heterogeneous threat knowledge graph after prediction, constructing a mapping index, and aggregating to obtain a propagation path and a path heat of a high-risk node, analyzing a subgraph evolution trend, and performing early warning.

[0023] The existing risk information analysis method has the problems of insufficient time sensitivity, unclear industry granularity, lack of graph reasoning and multi-modal event integration capability, and most technologies do not fully consider the timeliness of threat intelligence. Generally, a static graph structure or uniform weight is used, which cannot reflect the decay or evolution of threat influence over time, limiting the accuracy and real-time response capability of risk assessment. Few technologies have realized time series analysis of attack path frequency and its heat, which cannot capture the dynamic changes of threats in time, and it is difficult to realize early warning and trend prediction and other problems.

[0024] The application combines time-decay personalized random walk, event enhancement mechanism, graph neural network (GNN) classification modeling and multi-dimensional risk aggregation to perform network risk information fusion and risk assessment, is suitable for dynamic analysis and prediction of multi-dimensional attack risks such as industry, region, time and event, and realizes trend analysis of industry attack over time.

[0025] As a preferred embodiment, the application unifies nodes and edges from a risk information sharing system, real-time events into a heterogeneous graph structure. The nodes can include Indicator of Compromise (IOC) nodes, Tactics, Techniques, and Procedures (TTPs) nodes, vulnerability nodes, background nodes, event nodes, and can also include industry nodes, region nodes, attack drill events, etc. The types of edges can include exploitation relationships, belonging relationships, time relationships, intelligence trigger relationships, propagation path relationships, and also include communication relationships, exploitation relationships, time occurrence relationships, etc.

[0026] The application extracts entities by using common entity extraction tools (such as spaCy, LlamaIndex, etc.) and constructs a multi-source heterogeneous threat knowledge graph, and the following table shows entity examples of nodes: .

[0027] The IOC nodes include IP, Domain, Hash, URL; the TTPs nodes include MITRE ATT&CK ID, behavior pattern, the vulnerability nodes include CVE number, CWE category; the background nodes include industry, region, device, organization, and the event nodes include risk information related events.

[0028] Exploitation relationship (exploit): vulnerability → IOC; Belonging relationship (belong_to): domain name → country / industry; Time relationship (occur_at): time label of occurrence of node pairs; Intelligence trigger relationship (triggered_by): whether the node appears in certain event intelligence; Propagation path (propagate_to): attack behavior flow path, such as phishing → cmd.exe → lateral_movement.

[0029] The multi-source network risk information fusion and risk assessment method described in the application is referred to Figure 2 , the step S2 comprises: Step S21, calculate the time weight of the edge (i, j) at time time, and the calculation formula is: ; Among them, λ is the time decay coefficient, which controls the degree of forgetting of historical events by communication; is the first appearance time of edge (i, j), is the current analysis time; base_weight is the edge weight without considering time decay and event enhancement, which is assigned a value of 1 or calculated by calling the package, such as based on credibility or centrality; In step S22, when the edge (i, j) is a specific event, the enhanced weight of the edge (i, j) is calculated based on the time weight, and the calculation formula is: ; β is the event enhancement factor, l eij=1 Indicates whether the edge (i, j) is related to the event, which is the event marking function; Step S23, calculating the random walk transition probability matrix of edge (i, j) according to the enhanced weight of the edge (i, j): ; The denominator represents the sum of the propagation weights of all possible next-hop neighbors k starting from node i; the random walk transition probability matrix is ​​the sum of the edge weights of the weighted graph Normalize and construct a random walk transition probability matrix P. The denominator refers to the sum of the propagation weights of all possible next-hop neighbors k starting from node i. In terms of understanding, for each node i, we list all its outgoing edges (i, k), and each outgoing edge has a propagation weight , the weights of all these outgoing edges are added up as a normalization factor, and the transition probability of each edge is its relative weight in this sum.

[0030] Step S24: Calculate the time-sensitive personalized random walk value based on the random walk probability matrix. The calculation formula of the time-sensitive personalized random walk value of the node s is: ; in, is a one-hot vector starting from s; The probability of jumping back to the starting point is generally set to 0.15; is the normalized transfer matrix obtained by normalizing the random transition probability matrix, Preferably, the normalized transfer matrix is ​​obtained by normalizing the adjacency matrix by rows.

[0031] The time-sensitive personalized random walk value represents the expected probability of returning to the node s during the random walk process starting from the initial node s, and the propagation iteration of the time-sensitive personalized random walk in step S24 is adopted, and the iteration is performed until convergence (or T times).

[0032] The time-sensitive personalized random walk calculation strategy of the application is to perform personalized random walk propagation with the known malicious node or important event node as the source point. The time weight of the edge attempts to show that the farther the time is, the smaller the influence of the edge is.

[0033] The multi-source network risk information fusion and risk assessment method described in the application refers to Figure 3 , the step S3 comprises: Step S31, acquiring the characteristics of the node, the feature vector of the node v comprises: ; The node type is one-hot coded; The node degree; The node score obtained from the time-sensitive personalized random walk propagation; Whether it belongs to a specific event; The timestamp of the latest occurrence; Step S32, combining the node characteristics and neighbor aggregation information, selecting a graph neural network model for embedding and prediction, ; Wherein, R is the type of the edge of all relationships; The neighbor connected to through the relationship ; The independent weight of each edge type, v,r The normalization factor, such as the number of neighbors; and represent the u-th industry dimension and the v-th industry dimension respectively; Step S33, using a graph neural network learning function Output the classification probability of each node.

[0034] The application combines node features and neighbor aggregation information, uses a graph neural network for training, and outputs node embedding and classification probability, the node features include type, degree, personalized random walk value, and whether related to recent events, the graph neural network model can adopt a graph convolution network model GCN or a graph attention network GAT or a relational graph convolution network R-GCN, preferably, a multi-variable type heterogeneous graph relational graph convolution network R-GCN.

[0035] The multi-source network risk information fusion and risk assessment method provided in the application refers to Figure 4 , and the step S4 comprises: Step S41, the full graph G = (V, E) completed by prediction is divided into three-dimensional subgraphs according to the region dimension r, the industry dimension h and the time dimension t, and the following is obtained: ; ; ; represents a node, represents an edge of an association relationship.

[0036] The threat knowledge knowledge graph is huge in scale and dynamically changes, and if not reasonably divided and indexed, it is difficult to support real-time risk detection, fast query and interactive visualization. The region dimension r is divided according to the regional information of the node belonging to the country, province and city, etc., the industry dimension h is divided according to the industry label of the node, for example, finance, government, medical treatment, manufacturing, etc.; the time dimension t is based on the latest appearance timestamp of the node, and the node is classified into the corresponding time period (for example: the sliding window is divided by week, month, etc.).

[0037] Step S42, a three-dimensional mapping index is constructed, ; The three-dimensional mapping index allows the system to support any combination of

region + industry + time

[0038] Step S43, subgraph risk assessment index aggregation calculation is performed to obtain the propagation path of the high-risk node and the path heat score; Step S44, based on the curve of the average risk changing with time, the evolution trend of the subgraph is analyzed and early warning is performed; Step S45, interactive query is performed based on the three-dimensional mapping index and the risk aggregation model.

[0039] In the step S44 of the application, whether the risk of a certain industry or region is in an upward channel is analyzed based on the curve of the average risk changing with time. The calculation method is If the calculated value is positive for three consecutive times, an early warning will be issued.

[0040] In step S45 of the present invention, the system supports the following interactive query and traceability capabilities, including support for structured multi-dimensional queries. Users can combine queries in the following ways: Query the attack paths for a certain month, industry, or region; Query the average risk trend of an industry over the past six months; Query the attack path patterns that have reappeared in multiple regions in the past two months. For example, "time_range": ["2025-04", "2025-05"], "industry": "finance", "regions": ["Beijing", "Shanghai", "Guangzhou"], "query_type": "attack_path" / / optional attack_path / risk_trend / recurrent_patterns } In the multi-source network risk information fusion and risk assessment method of the present invention, step S43 includes: Step S431: Count the risk level distribution of nodes, including the number and proportion of high-risk nodes, medium-risk nodes, and low-risk nodes; Step S432: Output the probability of the high-risk node based on the probability distribution conversion function of the graph neural network model, and calculate the average risk according to the following formula: ; in, Representation node the probability of being judged as high risk; Step S433: List attack nodes with the highest predicted risk based on the average risk; Step S434: In

[15] , the propagation path P = {v1 → v2 → ⋯ → vk} between high-risk nodes is extracted, and the path heat score is calculated: .

[0041] The path heat score indicates whether the attack path frequently recurs in other subgraphs. The top K paths with the highest heat scores are directly output as warnings, where K is a set value and can be 5 or 10.

[0042] Each subgraph The subgraph representing the region r, the industry h, and the time period t, the risk assessment indicators such as the aggregation node risk distribution statistics and the average risk score, and the probability score of the "high risk" dimension in the output result of the softmax function of the graph neural network model. The number of nodes in each risk level is counted to generate a table similar to the following table: .

[0043] Step S433 lists the attack node list with the highest predicted risk according to the average risk, including: IOCs (malicious IP, domain name, URL, etc.); vulnerability numbers (such as CVE numbers); suspicious risk programs or command chains (such as cmd.exe, powershell, lateral_movement); frequently triggered TTP risk information labels (technology numbers in MITRE ATT&CK).

[0044] The multi-source network risk information fusion and risk assessment method described in the application, the step S45 further comprises, The risk level of the node in the subgraph is displayed, and the risk level is red, orange, and yellow, respectively. The propagation path, timeline, and path heat of the high-risk node are displayed. The source point and the end point of the propagation path are highlighted.

[0045] The step S45 of the application can also support graph visualization support, and provide dynamic display of the subgraph : the risk level of the node is color-coded (red, orange, and yellow); support for clicking nodes to view detailed information of IOCs / CVEs / TTPs; dynamically display the attack path flow direction, timeline, and path heat; highlight the risk source point and the end of the propagation path to assist in intervention strategy design.

[0046] The application combines graph neural networks with time-sensitive personalized random walks, embeds multi-dimensional features such as time, events, and structure in a multi-source heterogeneous threat graph, realizes node-level risk prediction and trend perception, effectively distinguishes hot attack behaviors and historical noise by fusing event enhancement and time decay weights, and has dynamic adaptability; in addition, by event labeling and propagation path backtracking, the dominant mode of attack behavior, typical IOCs, and related vulnerabilities in a certain time period and industry are identified; it can also dynamically predict and output risk drift detection.

[0047] The application also provides a multi-source network risk information fusion and risk assessment system, which is described with reference to Figure 5 , comprising, A multi-source heterogeneous threat knowledge graph construction module 1 extracts nodes and edges of real-time events through an entity extraction tool, and constructs a multi-source heterogeneous threat knowledge graph based on the nodes and edges. The time-sensitive personalized random walk value calculation module 2 is connected with the multi-source heterogeneous threat knowledge graph construction module 1, a random walk transition probability matrix of an edge is calculated, and a time-sensitive personalized random walk value is calculated based on the random walk probability matrix; The classification probability calculation module 3 is connected with the time-sensitive personalized random walk value calculation module 2, is trained by using a graph neural network model, and carries out graph neural network embedding and prediction in combination with features of nodes, and outputs a classification probability. The risk aggregation early warning module 4 is connected with the classification probability calculation module 3 and the multi-source heterogeneous threat knowledge graph construction module 1, a three-dimensional subgraph is cut from the multi-source heterogeneous threat knowledge graph after prediction, a mapping index is constructed, a propagation path and a path heat degree of a high-risk node are calculated by aggregation, a subgraph evolution trend is analyzed, and early warning is performed.

[0048] The prior art fails to fully consider the timeliness of threat intelligence, usually adopts a static graph structure or uniform weight, and cannot reflect the decay or evolution of threat influence with time, thereby limiting the accuracy and real-time response capability of risk assessment. The application realizes time series analysis of attack path frequency and heat degree, timely captures dynamic changes of threats, and realizes early warning and trend prediction. The application solves the problem that traditional graph-based risk propagation models are mostly static, cannot reasonably reflect the timeliness and historical influence decrease of threat intelligence, and lead to lagging and inaccurate risk assessment.

[0049] The multi-source heterogeneous threat knowledge graph construction module of the application constructs a multi-source heterogeneous threat knowledge graph by graph construction and propagation modeling, carries out graph neural network embedding prediction, and has structure propagation semantics and prediction capability, which surpasses traditional statistical / rule-based IOC analysis. Through the time-sensitive personalized random walk value calculation module, the activity change of attack activities with time can be dynamically reflected, and the attack path that is still active at present can be identified.

[0050] In one preferred embodiment of the application, with reference to Figure 6 The time-sensitive personalized random walk value calculation module 2 comprises, A time weight calculation module 21 calculates a time weight of an edge. An enhanced weight calculation module 22 is connected with the time weight calculation module 21, and calculates an enhanced weight of the edge based on the time weight of the edge when the edge is a specific event. A random walk transition probability matrix calculation module 23 is connected with the enhanced weight calculation module 22, and calculates a random walk transition probability matrix of the edge according to the enhanced weight of the edge. A time-sensitive personalized random walk value calculation module 24 is connected with the random walk transition probability matrix calculation module 23, and calculates a time-sensitive personalized random walk value based on the random walk probability matrix.

[0051] In one preferred embodiment of the present application, with reference to Figure 7 The risk aggregation early warning module 4 comprises, The three-dimensional subgraph segmentation module 41 performs three-dimensional subgraph segmentation on the completed prediction full graph according to the region dimension r, the industry dimension h and the time dimension t. The three-dimensional mapping index module 42 is connected with the three-dimensional subgraph segmentation module 41 and is configured to construct a three-dimensional mapping index. The aggregation calculation module 43 is connected with the three-dimensional subgraph segmentation module 41 and performs subgraph risk evaluation index aggregation calculation to obtain a propagation path of a high-risk node and a path heat score. The trend early warning module 44 is connected with the aggregation calculation module 43 and analyzes a subgraph evolution trend and performs early warning based on a curve of average risk change over time. The interactive query module 45 is connected with the three-dimensional mapping index module 42, the aggregation calculation module 43 and the trend early warning module 44 and performs interactive query based on the three-dimensional mapping index and the risk aggregation model.

[0052] The present application performs industry-time-region risk aggregation through subgraph construction and risk statistics, supports trend view construction according to industry, region and time granularity, uses a propagation path scoring mechanism and path frequency statistics, can mine high-risk propagation links (such as phishing->cmd->C2), assists in formulating key defense strategies, in addition, supports attack type inference under time+industry conditions, can automatically output “the most common attack mode in a certain industry in a certain month”, and meets the security operation needs in real combat scenes.

[0053] Based on the spirit of the present application, other conversions can be made through the description and the drawings, which give typical embodiments of the specific structure of the specific implementation. Although the above-mentioned application proposes the preferred embodiment, however, these contents are not as limitations.

[0054] For those skilled in the art, various changes and modifications will undoubtedly be apparent after reading the above description. Therefore, the appended claims should be considered as covering all changes and modifications within the true intent and scope of the present application. Any and all equivalent ranges and contents within the scope of the claims should be considered as still within the intent and scope of the present application.

Claims

1. A multi-source network risk information fusion and risk assessment method, characterized by: include: Step S1: extracting nodes and edges of real-time events through an entity extraction tool, and constructing a multi-source heterogeneous threat knowledge graph based on the nodes and edges; Step S2, calculating the random walk transition probability matrix of the edge, and calculating the time-sensitive personalized random walk value based on the random walk transition probability matrix; Step S3: Use the graph neural network model for training, and combine the node features to perform graph neural network embedding and prediction, and output the classification probability; Step S4: perform three-dimensional sub-graph segmentation on the predicted multi-source heterogeneous threat knowledge graph, construct a mapping index, aggregate and calculate the propagation path and path heat of high-risk nodes, analyze the sub-graph evolution trend, and issue an early warning.

2. The multi-source network risk information fusion and risk assessment method according to claim 1 is characterized in that: The nodes include compromise detection indicator nodes, attack tactics and technology nodes, vulnerability nodes, background nodes, and event nodes; The types of edges include utilization relationship, ownership relationship, time relationship, intelligence trigger relationship, and propagation path relationship.

3. The multi-source network risk information fusion and risk assessment method according to claim 1, characterized in that: The step S2 comprises: Step S21, calculate the time weight of the edge (i, j) at time time, and the calculation formula is: ； Among them, λ is the time decay coefficient, which controls the degree of forgetting of historical events by communication; is the first appearance time of edge (i, j), is the current analysis time; base_weight is the edge weight without considering time decay and event enhancement; In step S22, when the edge (i, j) is a specific event, the enhanced weight of the edge (i, j) is calculated based on the time weight, and the calculation formula is: ； β is the event enhancement factor, Indicates whether the edge (i, j) is related to the event; Step S23, calculating the random walk transition probability matrix of edge (i, j) according to the enhanced weight of the edge (i, j): ； The denominator represents the sum of the propagation weights of all possible next-hop neighbors k starting from node i; Step S24: Calculate the time-sensitive personalized random walk value based on the random walk probability matrix. The calculation formula of the time-sensitive personalized random walk value of the node s is: ； in, is a one-hot vector starting from s; is the probability of jumping back to the starting point; is a normalized transfer matrix obtained by normalizing the random transfer probability matrix.

4. The multi-source network risk information fusion and risk assessment method according to claim 1, characterized in that: The step S3 comprises: Step S31, obtain the node features, the feature vector of node v include: ； One-hot encoding for node types; is the node degree; is the node score obtained from the time-sensitive personalized random walk propagation; Whether it is a specific event; The timestamp of the latest occurrence; Step S32: Combine the node features and neighbor aggregation information and select a graph neural network model for embedding and prediction. ； Where R is the type of edge; is a neighbor connected to v through relationship r; is the independent weight for each edge type, is the normalization factor; and They represent the u-th industry dimension and the v-th industry dimension respectively; Step S33, using graph neural network to learn function Output the classification probability of each node.

5. The multi-source network risk information fusion and risk assessment method according to claim 4 is characterized in that: The step S4 comprises: Step S41: The predicted multi-source heterogeneous threat knowledge graph is divided into three-dimensional subgraphs according to the regional dimension r, industry dimension h, and time dimension t to obtain: ； ； ； Step S42: construct a three-dimensional mapping index. ； Step S43: performing aggregate calculation of subgraph risk assessment indicators to obtain the propagation paths and path heat scores of high-risk nodes; Step S44: analyzing the subgraph evolution trend and issuing an early warning based on the curve of the average risk changing over time; Step S45: performing interactive query based on the three-dimensional mapping index and the risk aggregation model.

6. The multi-source network risk information fusion and risk assessment method according to claim 1, characterized in that: The step S43 includes: Step S431: Count the risk level distribution of nodes, including the number and proportion of high-risk nodes, medium-risk nodes, and low-risk nodes; Step S432: Output the probability of the high-risk node based on the probability distribution conversion function of the graph neural network model, and calculate the average risk according to the following formula: ； in, represents the probability that node v is judged as high risk; In step S433, a list of attack nodes with the highest predicted risk is listed based on the average risk. In step S434, in each subgraph, a propagation path P = {v1 → v2 → ⋯ → vk} between high-risk nodes is extracted, and the path heat score is calculated: 。 7. The multi-source network risk information fusion and risk assessment method according to claim 6, characterized in that: The step S45 further includes: Display the risk levels of the nodes in the subgraph, the risk levels are red, orange, and yellow respectively; Display the propagation path, timeline, and path heat of the high-risk nodes; The source and end points of the propagation path are highlighted.

8. The multi-source network risk information fusion and risk assessment method according to claim 6, characterized in that: The graph neural network model adopts a graph convolutional network model or a graph attention network or a relational graph convolutional network.

9. Multi-source network risk information fusion and risk assessment system, characterized by: include, A multi-source heterogeneous threat knowledge graph construction module extracts nodes and edges of real-time events through an entity extraction tool, and constructs a multi-source heterogeneous threat knowledge graph based on the nodes and edges; A time-sensitive personalized random walk value calculation module is connected to the multi-source heterogeneous threat knowledge graph construction module, calculates the random walk transition probability matrix of the edge, and calculates the time-sensitive personalized random walk value based on the random walk transition probability matrix; A classification probability calculation module is connected to the time-sensitive personalized random walk value calculation module, uses a graph neural network model for training, and performs graph neural network embedding and prediction based on node features to output classification probabilities; The risk aggregation warning module is connected to the classification probability calculation module and the multi-source heterogeneous threat knowledge graph construction module, performs three-dimensional sub-graph segmentation on the predicted multi-source heterogeneous threat knowledge graph, constructs a mapping index, aggregates and calculates the propagation path and path heat of high-risk nodes, analyzes the sub-graph evolution trend and issues warnings.

10. The multi-source network risk information fusion and risk assessment system according to claim 9, characterized in that: The time-sensitive personalized random walk value calculation module includes: Time weight calculation module, calculates the time weight of the edge; an enhanced weight calculation module, connected to the time weight calculation module, and calculating the enhanced weight of the edge based on the time weight when the edge is a specific event; A random walk transition probability matrix calculation module is connected to the enhancement weight calculation module and calculates the random walk transition probability matrix of the edge according to the enhancement weight of the edge; The time-sensitive personalized random walk value calculation module is connected to the random walk transition probability matrix calculation module and calculates the time-sensitive personalized random walk value based on the random walk probability matrix.

Images