Domain knowledge-driven threat intelligence characteristic index generation method

Abstract

The invention discloses a domain knowledge-driven threat intelligence characteristic index generation method, and belongs to the field of network security. Aiming at the problems of domain knowledge deficiency, insufficient interpretability, poor dynamic adaptability and the like existing in a traditional data driving method, the invention provides a framework fusing expert knowledge and data driving through domain knowledge graph construction, multi-modal feature fusion and dynamic weight optimization; comprising the steps of domain knowledge modeling, multi-modal feature fusion and index generation and verification. According to the method, the interpretable indexes conforming to the ST IX format are generated, practice verifies that the defects of a traditional method are effectively overcome, and the accuracy, interpretability and dynamic adaptability of threat intelligence analysis are improved.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, and in particular to a domain knowledge-driven method for generating threat intelligence feature indicators. This method integrates domain knowledge with multimodal data to generate interpretable and dynamically adaptable threat intelligence feature indicators, supporting cybersecurity threat detection and analysis. Background Technology

[0002] As cyberattacks become more complex and covert, traditional data-driven threat intelligence feature extraction methods have significant limitations:

[0003] Domain knowledge gap: Over-reliance on statistical models and lack of integration with knowledge from vertical domains such as cybersecurity and industrial control;

[0004] Insufficient interpretability: The metrics generated by the black-box model are difficult to provide a basis for decision-making and cannot meet the needs of security analysts;

[0005] Poor dynamic adaptability: slow response to new attack methods such as APT attacks, and difficulty in quickly adjusting based on expert experience.

[0006] Therefore, there is an urgent need for a method that integrates domain knowledge and data-driven approaches to solve the above problems.

[0007] Full names of terms and abbreviations

[0008] • OWL: Web Ontology Language

[0009] • DKG: Domain Knowledge Graph

[0010] • STIX: Structured Threat Information Expression

[0011] • APT: Advanced Persistent Threat

[0012] • LSTM: Long Short-Term Memory Network

[0013] • Transformer: A deep learning model based on self-attention mechanism

[0014] • GNN: Graph Neural Network Summary of the Invention

[0015] This invention provides a domain knowledge-driven method for generating threat intelligence feature indicators, aiming to overcome the limitations of traditional methods. This method constructs a framework that integrates expert knowledge and data-driven approaches through three core steps: domain knowledge modeling, multimodal feature fusion, and indicator generation and verification.

[0016] Domain knowledge modeling: Construct a domain knowledge graph (DKG) to formally represent threat entities and relationships, inject expert rules and quantify them to establish a knowledge foundation;

[0017] Multimodal feature fusion: embeds multimodal data such as network traffic and logs into a unified space by embedding features from knowledge graphs and dynamically optimizes weights through an attention mechanism;

[0018] Metric generation and validation: Generate interpretable metrics that conform to the STIX format, and optimize the accuracy of metrics by combining closed-loop feedback of data error loss and knowledge consistency loss.

[0019] Technical solution

[0020] The purpose of this invention is to overcome the shortcomings of traditional data-driven methods and provide a threat intelligence feature indicator generation method that combines domain knowledge fusion, high interpretability, and dynamic adaptability. The specific implementation scheme is as follows:

[0021] 1. Domain Knowledge Modeling

[0022] This module establishes a basic framework for generating threat intelligence features by constructing domain knowledge graphs and formalizing expert experience. Specifically, it includes the following key steps:

[0023] 1.1 Step 1: Constructing a Domain Knowledge Graph (DKG)

[0024] Technical objective: To achieve a formal representation of threat entities and their relationships in the field of cybersecurity through ontological modeling, providing structured knowledge support for subsequent feature fusion.

[0025] Implementation method:

[0026] (1) Entity definition:

[0027] We construct a threat intelligence ontology based on OWL (Web Ontology Language), clearly defining entity types and hierarchical structures:

[0028] Core entity set:

[0029] Attackers include malicious IPs, malicious domains, and threat groups.

[0030] Attack vectors include vulnerabilities (CVE IDs), malware (MD5 hashes), and phishing emails.

[0031] Attack behaviors include: port scanning, data theft, lateral movement, etc.

[0032] Entities include industrial control equipment (such as PLC models), network services (such as HTTP / FTP protocols), etc.

[0033] Entity attribute definition: Attach multi-dimensional attributes to each entity, for example:

[0034] The attributes of malicious IPs include: geographic location, historical attack records, reputation score, and timeliness tags;

[0035] The attributes of a vulnerability include: CVSS score, affected versions, patch status, and disclosure time.

[0036] (2) Relationship modeling:

[0037] Define semantic relationships between entities and construct directed edges. Typical relationships include:

[0038]

[0039] Relationship weight setting: The strength of the relationship is quantified through a confidence score mechanism (value range 0-1). For example, the initial confidence score is generated based on the frequency of occurrence of the "exploit vulnerabilities" relationship according to historical attack data, and then dynamically adjusted through subsequent expert verification.

[0040] (3) Knowledge graph storage and updating:

[0041] Use a graph database (such as Neo4j) to store the DKG, which supports efficient graph traversal and semantic query;

[0042] Establish an incremental update mechanism: Real-time synchronization of the latest entity and relationship data through threat intelligence subscription interfaces (such as STIX / TAXII protocols), combined with expert manual review to ensure the accuracy of the knowledge graph.

[0043] Formal expression:

[0044] DKG = (E, R, A)

[0045] E = {e1,e2,…,e} n} represents a set of threat entities, each containing a unique identifier and a set of attributes;

[0046] R = {r ij |e i ,e j Let ∈E} represent the set of relations between entities, r ijFor directed edges, each edge contains a relation type and a confidence attribute.

[0047] A={a e ,a r}, where a e For a collection of entity attributes, a r It is a set of relational attributes.

[0048] 1.2 Step 2: Expert Rule Injection

[0049] Technical objective: To transform the experiential knowledge of cybersecurity experts into computable rules, enabling prior guidance of feature weights and improving the model's responsiveness to new types of attacks.

[0050] Implementation method:

[0051] (1) Rule extraction and structuring:

[0052] Through expert interviews and historical case analysis, judgment rules for specific attack scenarios are extracted, such as:

[0053] Example rule: If "the same IP frequently accesses multiple closed ports within a short period of time" (Condition) is detected... j If the IP address is determined to have a threat score S, then the IP address is assigned a threat score of S. j Upgraded to high-risk zone.

[0054] Expert experience is formally expressed using production rules (IF-THEN structure), with each rule containing:

[0055] Prerequisites: A Boolean expression consisting of entity attributes, relational attributes, and logical operators (such as AND / OR / NOT);

[0056] Conclusion Action: Adjustment of parameters such as feature weights and threat scores.

[0057] (2) Fuzzy logic quantization:

[0058] Fuzzy set theory is introduced to handle uncertainties in expert experience, for example:

[0059] The fuzzy linguistic variable for “threat score” is defined as {low, medium, high}, with a corresponding universe of discourse of [0, 100]. The fuzzy mapping from conditional input to score is achieved through triangular fuzzy numbers or Gaussian membership functions.

[0060] The weight adjustment factors in the rule conclusions are smoothed and quantized using a sigmoid activation function:

[0061] S j Threat score after fuzzy inference (standardized to the [-5,5] range);

[0062] α: Domain adjustment factor (set by experts based on the complexity of the attack scenario, for example, α=2 for industrial control scenarios and α=1 for general network scenarios), used to control the sensitivity of weight adjustment.

[0063] (3) Rule base management:

[0064] Establish a hierarchical rule base: categorize and store rules according to attack type (such as APT attacks, ransomware) and industry sector (such as power, finance);

[0065] Supports rule conflict detection: By setting priority (e.g., emergency rules > normal rules) and checking logical consistency, the uniqueness of the output is ensured when multiple rules are triggered in parallel.

[0066] 2. Multi-modal Feature Fusion

[0067] This section aims to effectively fuse multimodal data from different sources to extract more representative and discriminative features, providing strong support for subsequent threat detection and analysis. Specifically, it includes two key steps: feature space mapping and dynamic weight optimization.

[0068] 2.1 Step 3: Feature Space Mapping

[0069] Technical objective: To map raw data from different modalities and information from domain knowledge graphs into a common feature space, so as to facilitate effective feature fusion and analysis in the future.

[0070] Implementation method:

[0071] (1) Raw data acquisition and preprocessing

[0072] Network traffic data: This involves collecting packet-level traffic information from network devices (such as routers and switches), including source IP, destination IP, port number, protocol type, and traffic volume. The collected traffic data is cleaned to remove noise and invalid data, and then normalized to eliminate dimensional differences between different characteristics.

[0073] Log data: Collect system logs, application logs, etc., covering login information, operation records, error messages, etc. Parse and structure the log data, converting unstructured text logs into a structured data format to facilitate subsequent feature extraction.

[0074] Asset information data: Acquire asset information in the network, such as device type, operating system version, software installation status, etc. Encode the asset information and convert it into numerical features for representation in a feature space.

[0075] (2) Data feature extraction function Φ(·)

[0076] LSTM (Long Short-Term Memory) network: For network traffic and log data with temporal sequence characteristics, LSTM can effectively capture long-term dependencies in the data. By feeding input data into the LSTM network in time steps, the network learns the temporal patterns of the data and outputs the hidden state at each time step. The hidden state of the last time step can be selected as the feature representation of the sequence.

[0077] Transformer: The Transformer model boasts powerful parallel computing capabilities and the ability to capture global information. When processing text-based log data, the log text can be segmented into words, and each word can be converted into a word vector through an embedding layer. These word vectors are then input into the Transformer model, where they undergo processing via a multi-head self-attention mechanism and a feedforward neural network to obtain the text's feature representation.

[0078] (3) Knowledge graph embedding model Ψ(·)

[0079] TransE (Translation-based Embedding): The TransE model embeds entities and relations in a knowledge graph into a low-dimensional vector space, allowing relationships between entities to be represented by vector addition. For each entity and relation in the domain knowledge graph (DKG), the TransE model is trained to map it to a corresponding vector representation. These vector representations preserve the semantic information of the knowledge graph, providing knowledge support for subsequent feature fusion.

[0080] (4) Feature splicing

[0081] Use the ⊕ operation to extract data features using the function Φ(X). raw The outputs of the two models are concatenated with the output of the knowledge graph embedding model Ψ (DKG). Specifically, the feature vectors of the two outputs are connected along a certain dimension to form a new feature vector, which serves as a representation in a unified feature space.

[0082] Formal expression:

[0083] F=Φ(X raw )⊕Ψ(DKG)

[0084] Among them, X raw Φ represents the raw data, including network traffic, logs, asset information, etc.; Φ(·) is the data feature extraction function, which can be LSTM or Transformer, etc.; Ψ(·) is the knowledge graph embedding model, such as TransE; ⊕ represents the tensor concatenation operation; F represents the feature representation in the unified feature space.

[0085] 2.2 Step 4: Dynamic Weight Optimization

[0086] Technical objective: To introduce an attention mechanism that dynamically adjusts the weights of different features based on their importance, enabling the model to focus more on features that are more valuable to the current task (such as threat detection), thereby improving the model's performance and adaptability.

[0087] Implementation method:

[0088] (1) Generation of query vector and key

[0089] The query vector Q is typically a learnable vector with the same dimensions as the feature vectors. During training, the model automatically learns the value of Q, enabling it to dynamically adjust the level of attention given to each feature based on different input data.

[0090] Knowledge graph entity keys K: The entity vectors output by the knowledge graph embedding model Ψ (DKG) are used as keys. These keys contain semantic information from the knowledge graph and can reflect the relationships and importance between different features.

[0091] (2) Attention Score Calculation

[0092] Calculate the dot product QK of the query vector Q and the key K. T and divide it by Scale is applied, where d is the dimension of the key vector. This is done to avoid the dot product becoming too large, which could lead to vanishing or exploding gradients.

[0093] A domain constraint function σ is introduced to process the scaled dot product result. The domain constraint function can be designed according to the specific application scenario and domain knowledge. For example, it can be a non-linear activation function (such as ReLU) to adjust the attention score to better suit the characteristics and requirements of the domain.

[0094] Explanation of the domain constraint function σ:

[0095] In dynamic weight optimization, the domain constraint function σ plays a crucial role. It processes the scaled dot product result based on the specific application scenario and domain knowledge, making the attention score more aligned with the characteristics and requirements of the domain. Besides the ReLU function, several other functions can be used for different scenarios. Below are some design examples and their adaptability to different scenarios:

[0096] 1) Sigmoid Function: In some scenarios, if a smooth, non-linear transformation of the attention score is desired, compressing it to the 0-1 range, the Sigmoid function is suitable. For example, in malware detection, malware features are complex and diverse, and the relationships between different features can be complex and uncertain. The Sigmoid function can map the scaled dot product result to [0,1], better balancing the importance of different features. Domain experts can use the function's output value as a probabilistic representation of feature importance based on the characteristics of malware behavior patterns. For instance, when certain specific combinations of malware behavior features are detected, a Sigmoid function output value close to 1 indicates that these feature combinations are highly important in determining the threat level of malware; conversely, an output value close to 0 indicates low importance.

[0097] 2) Tanh Function: For scenarios requiring symmetrical transformation of attention scores, the Tanh function is a good choice. In network attack intent analysis, it's necessary to consider multiple positive and negative attack indications. The Tanh function maps the input to the [-1,1] interval, helping to distinguish the positive and negative impacts of different features on attack intent judgment. Domain experts can set the input range and output weights of the Tanh function based on the complexity of the attack scenario and the characteristics of the attack indications. For example, in analyzing APT attacks, some seemingly normal behavioral features actually conceal attack intent. The Tanh function can transform the input of these features to more accurately reflect their influence on attack intent judgment.

[0098] Perform exponential operations on the processed results. Then, normalization is performed to obtain the attention weight w for each feature. i .

[0099] (3) Feature-weighted fusion

[0100] Based on the calculated attention weight w i The model performs a weighted summation of the feature vectors F in a unified feature space. Specifically, each dimension of each feature vector is multiplied by its corresponding attention weight, and the results from all dimensions are then summed to obtain a weighted and fused feature vector. This weighted and fused feature vector can better highlight the role of important features and improve the model's performance.

[0101] Formal expression:

[0102]

[0103] Where Q is the query vector, K is the knowledge graph entity key, d is the dimension, σ is the domain constraint function, and wi This represents the attention weight of the i-th feature.

[0104] 3. Indicator Generation & Validation

[0105] This section focuses on generating interpretable threat indicators and optimizes the generation process through a closed-loop feedback mechanism to ensure the accuracy and effectiveness of the indicators, providing a reliable basis for cybersecurity decisions.

[0106] 3.1 Step 5: Generate interpretable metrics

[0107] Technical objective: To transform the fused multimodal features into structured metrics conforming to the STIX (Structured Threat Information eXpression) format, making the metrics highly readable and interoperable, and facilitating sharing and communication among different security systems and organizations.

[0108] Implementation method:

[0109] (1) Hadamard product operation

[0110] The Hadamard product (⊙) is an element-wise multiplication operation. In this step, the eigenvectors F in the unified feature space are multiplied by the dynamic weight matrix W. The dynamic weight matrix W is obtained through the dynamic weight optimization process in step 4. It can adjust the weights of the eigenvectors according to the importance of different features, highlighting the role of important features.

[0111] For example, suppose the feature vector F is a vector of length n and the dynamic weight matrix W is also an n-dimensional vector. Then the result of the Hadamard product is a new n-dimensional vector, where each element is the product of the corresponding elements of F and W.

[0112] (2) Knowledge-driven decoder

[0113] The knowledge-driven decoder is a trained neural network model whose input is the feature vector F⊙W processed by the Hadamard product, and whose output is a structured index I conforming to the STIX format. STIX .

[0114] Knowledge-Driven Decoder Description: The knowledge-driven decoder is a key component that transforms the feature vectors processed by the Hadamard product into structured metrics conforming to the STIX format. Its network architecture is designed as follows:

[0115] Network Structure: A multi-layer fully connected neural network (FCN) is employed. Specifically, it consists of three fully connected layers: the first layer has 256 neurons, the second has 128, and the third is the output layer. The number of neurons is determined by the dimension of the STIX metric to be generated. Regarding activation function selection, the first two fully connected layers use the ReLU activation function, which effectively alleviates the vanishing gradient problem and accelerates model convergence during training. The output layer selects an appropriate activation function based on the type of metric generated: Softmax is used for categorical metrics (such as attack type), and linear activation is used for numerical metrics (such as threat level).

[0116] Training data sources: The training data primarily relies on an annotated STIX sample library. A large number of attack event samples are collected from actual network security monitoring data, covering various types of network attack scenarios. For each sample, its multimodal features are extracted, and these features are associated and annotated with the corresponding real STIX metrics. Simultaneously, information from the Domain Knowledge Graph (DKG) is combined to further enrich the feature dimensions of the training data. For example, for an attack event sample targeting power grid equipment, not only are relevant features extracted from network traffic and log data, but also relevant information such as the attack subject, attack vector, and asset entities are obtained from the power grid domain knowledge graph. This integrated information is then used as training data input into the decoder for training.

[0117] The decoder's training process incorporates information from the domain knowledge graph (DKG), enabling it to understand the semantic relationships between feature vectors and STIX metrics. For example, the decoder can learn that specific feature combinations correspond to a particular threat type, thus transforming feature vectors into corresponding STIX metrics.

[0118] When training the decoder, labeled sample data can be used, including the input feature vectors and their corresponding STIX metrics. By minimizing the error between the decoder output and the true STIX metrics, the decoder parameters are continuously adjusted so that it can accurately generate the required metrics.

[0119] Formal expression:

[0120] I STIX =Decoder(F⊙W)

[0121] Where ⊙ represents the Hadamard Product, W is the dynamic weight matrix, F is the eigenvector in the unified feature space obtained in step 3, and I STIX It outputs structured metrics conforming to the STIX format.

[0122] 3.2 Step 6: Closed-loop feedback optimization

[0123] Technical objective: By defining a loss function and comprehensively considering data error and knowledge consistency, the entire indicator generation process is optimized to improve the accuracy and reliability of the generated indicators.

[0124] Implementation method:

[0125] (1) Data error loss

[0126] Data error loss Used to measure the generated metric I against the true label The differences between them can be identified. Common loss functions, such as mean squared error (MSE) and cross-entropy loss, can be used, with the specific choice depending on the type of metric and the nature of the task.

[0127] For example, if the generated metric is a classification metric, then cross-entropy loss can be used; if it is a regression metric, then mean squared error loss can be used. By minimizing the data error loss, the generated metric can be made as close as possible to the true label, thus improving the accuracy of the metric.

[0128] (2) Loss of knowledge consistency

[0129] Knowledge consistency loss This is used to measure the consistency between the generated metrics and the domain knowledge graph (DKG). A graph neural network (GNN) is used to calculate the semantic distance between the generated metrics and entities and relations in the knowledge graph.

[0130] The specific implementation of "Graph Neural Network (GNN) for calculating semantic distance" in closed-loop feedback optimization:

[0131] In the closed-loop feedback optimization, a graph neural network (GNN) is used to calculate the semantic distance between the generated metric and the domain knowledge graph (DKG). Here, GraphSAGE (Graph SAmple and aggreGatE) is chosen as the specific GNN type, and its implementation process is as follows:

[0132] 1) GraphSAGE Model: GraphSAGE learns node representations by sampling and aggregating the neighboring nodes of a node. For each node (entity) in the domain knowledge graph (DKG), its neighboring nodes are first sampled, and then the features of the neighboring nodes are fused with the node's own features through aggregation functions (such as mean aggregation, pooling aggregation, etc.) to generate a new feature representation of the node. After computation through multiple layers of GraphSAGE, a stable representation of each node in a low-dimensional vector space is obtained.

[0133] 2) Semantic distance calculation formula: The semantic distance between the generated metric and related entities and relations in the knowledge graph is calculated using Euclidean distance. Assume the vector representation of the generated metric after calculation in GraphSAGE is I. vec In a knowledge graph, the vector representation of entities or relationships related to this indicator is called DKG. vec Then the formula for calculating the semantic distance d is:

[0134]

[0135] Where n is the dimension of the vector, I vec (i) and DKG vec (i) represent vectors I and I respectively vec and DKG vec The value of the i-th dimension. By calculating the semantic distance, if the generated metric is inconsistent with the information in the knowledge graph, the semantic distance will be large, and the corresponding knowledge consistency loss will also increase.

[0136] Graph neural networks can learn structural and semantic information from knowledge graphs, mapping generated metrics to the vector space of the knowledge graph and calculating their distances to related entities and relationships within the knowledge graph. If the generated metrics are inconsistent with the information in the knowledge graph, the semantic distance will be large, and the corresponding loss in knowledge consistency will increase.

[0137] For example, suppose a knowledge graph records the association between a certain attack type and a specific vulnerability. If the generated metrics involve that attack type but do not show the association with the corresponding vulnerability, then the knowledge consistency loss will reflect this inconsistency.

[0138] (3) Balance factor λ

[0139] The balancing factor λ is used to adjust the data error loss and knowledge consistency loss in the total loss function. The weights in the equation are as follows. The value of λ ranges from [0,1]. When λ is close to 1, the total loss function focuses more on data error loss, that is, it pays more attention to the degree of matching between the generated indicators and the real labels; when λ is close to 0, the total loss function focuses more on knowledge consistency loss, that is, it emphasizes the consistency between the generated indicators and the domain knowledge graph.

[0140] The optimal value of λ can be determined through experimentation and optimization to achieve a balance between data accuracy and knowledge consistency.

[0141] (4) Optimization process

[0142] Using optimization algorithms such as gradient descent, based on the total loss function... The parameters of the entire model are updated. In each iteration, the gradient of the total loss function with respect to the model parameters is calculated, and the parameters are adjusted according to the direction and magnitude of the gradient to continuously reduce the total loss function.

[0143] Through multiple iterations and optimizations, the model can continuously learn and improve, and the generated metrics will become increasingly accurate and consistent with domain knowledge.

[0144] Formal expression:

[0145]

[0146] Where λ is the balance factor. Indicates data error loss. The loss of knowledge consistency is represented by semantic distance calculated using a graph neural network (GNN). Attached Figure Description

[0147] Figure 1 The flowchart of the method described in this invention illustrates the closed-loop process of the domain knowledge-driven threat intelligence feature indicator generation method. It starts from the beginning, goes through domain knowledge modeling (including building a domain knowledge graph and injecting expert rules), multimodal feature fusion (including feature space mapping and dynamic weight optimization), indicator generation and verification (including generating STIX indicators and closed-loop feedback optimization), and ends when the optimization is completed; otherwise, it returns to updating the domain knowledge graph and continues the loop. Detailed Implementation

[0148] The present invention will be further described below with reference to specific embodiments:

[0149] 1. Example 1

[0150] In the network environment of power grid enterprises, ensuring the safe and stable operation of the power system is of paramount importance. This embodiment takes the network security protection of power grid enterprises as an example and elaborates on the specific application process of the domain knowledge-driven threat intelligence feature indicator generation method.

[0151] 1.1 Domain Knowledge Modeling

[0152] 1.1.1 Constructing a Domain Knowledge Graph (DKG)

[0153] (1) Entity Definition: Based on the network security characteristics of power grid enterprises, an ontology is constructed using OWL. The core entity set includes:

[0154] Attackers include malicious IPs (such as external IP addresses that frequently attempt to intrude into the internal network of a power grid company) and malicious software (virus programs specifically targeting power grid control software).

[0155] Attack vector: Specific vulnerabilities in power systems (such as the CVE-20XX-XXXX vulnerability in a power monitoring system);

[0156] Attack behaviors: unauthorized command injection and power data tampering targeting power grid equipment;

[0157] Entities: Various equipment in the substation (such as specific models of transformers and relay protection devices), and communication protocols in the power grid communication network (such as the IEC 61850 protocol).

[0158] Attributes are added to each entity: malicious IP records the geographical location (the approximate location can be determined through IP address resolution) and attack frequency (the number of attacks within a certain period of time); vulnerability records the scope of power equipment affected and remediation suggestions; and equipment entity records the equipment's operating status, manufacturer, and years of use.

[0159] (2) Relationship modeling:

[0160] Define relationship types, such as "exploiting vulnerabilities" (malicious software → power system vulnerability, indicating that malicious software spreads or attacks by exploiting the vulnerability) and "affecting devices" (attack behavior → substation equipment, indicating that the attack behavior affects specific equipment).

[0161] The confidence level is based on the statistical relationship of historical attack data. For example, if a piece of malware successfully infiltrated the power grid system 80 times in the past 100 similar attack events, the initial confidence level of the "vulnerability exploitation" relationship is set to 0.8, and is dynamically adjusted according to newly emerging attack events.

[0162] (3) Knowledge Graph Storage and Updates: Neo4j graph database is selected to store the knowledge graph (DKG) in the power grid field. Through the interface with the power grid security monitoring system, information such as newly discovered attack subjects and attack behaviors is obtained in real time. At the same time, security experts are arranged to review the newly added data regularly to ensure the accuracy and completeness of the knowledge graph.

[0163] 1.1.2 Expert Rule Injection

[0164] (1) Rule extraction and structuring: Experts in power grid security were invited to extract rules based on historical attack cases. For example, if it is detected that "the same external IP initiates more than 5 connection requests to different devices in multiple substations within a short period of time (10 minutes) and the requested port number is a non-standard power communication port", then the threat score of that IP is determined to be increased.

[0165] (2) Fuzzy logic quantization:

[0166] Define the fuzzy linguistic variable "threat score" as {low, medium, high}, corresponding to the universe of discourse [0, 100]. Use triangular fuzzy numbers to transform the preconditions of the above rules into threat scores, such as raising the threat score from "low" to "high" when the condition is met.

[0167] For the weight adjustment factor in the rule conclusion, the formula is used. Calculations show that, considering the high stability requirements of the power grid system and the severe consequences of an attack, the domain adjustment factor α = 3 is set.

[0168] (3) Rule base management: Rules are stored in layers according to attack type (such as network intrusion, data theft) and power grid business area (such as power grid partitions in different regions). A rule conflict detection mechanism is established, stipulating that emergency security rules take precedence over ordinary rules to ensure the accuracy of rule execution.

[0169] 1.2 Multimodal Feature Fusion

[0170] 1.2.1 Feature Space Mapping

[0171] (1) Raw data acquisition and preprocessing:

[0172] Network traffic data: Network traffic data is collected from routers at the network boundary of the power grid enterprise, including source IP, destination IP, port number, traffic size, etc. Obvious errors or abnormal data are removed, such as data records with negative traffic size, and numerical characteristics such as traffic size are normalized to the [0,1] interval.

[0173] Log data: Collect operational logs and safety audit logs of power equipment, parse the log content, and extract key information such as equipment operation records and login failure information. Convert unstructured log text into structured data; for example, convert "User [Username] failed to log in to [Device Name] at [Time]" into a structured record containing username, time, device name, and login result.

[0174] Asset information data: Acquire asset information for various types of equipment in the power grid, including equipment model, substation affiliation, and equipment status. Perform one-hot encoding on categorical data such as equipment model to convert it into numerical features.

[0175] (2) Data feature extraction function Φ(·):

[0176] For network traffic data with time-series characteristics, an LSTM network is used for feature extraction. Network traffic data within a certain period (e.g., 1 hour) is input into the LSTM network according to time steps (e.g., one minute per time step), and the hidden state of the last time step output by the network is used as the feature representation of the network traffic during that period.

[0177] For log data, the Transformer model is used to extract features. First, the log text is segmented into words, then each word is converted into a word vector and input into the Transformer model. After processing through a multi-head self-attention mechanism and a feedforward neural network, the feature representation of the log data is obtained.

[0178] (3) Knowledge Graph Embedding Model Ψ(·): The TransE model is used to embed entities and relationships in the power grid domain knowledge graph DKG into a low-dimensional vector space. For example, entities such as malicious IPs, vulnerabilities, and devices, as well as the relationships between them, are mapped to corresponding vectors, so that the semantic information of entities and relationships can be represented in the vector space.

[0179] (4) Feature splicing: Using the tensor splicing operation ⊕, the features extracted from network traffic and log data are spliced ​​with the features embedded in the knowledge graph to form a feature vector F in a unified feature space.

[0180] 1.2.2 Dynamic Weight Optimization

[0181] (1) Generation of query vectors and keys:

[0182] A learnable query vector Q is generated, with dimensions consistent with the feature vector dimensions of the unified feature space. During model training, the value of Q is continuously adjusted based on the input data.

[0183] The entity vectors output by the knowledge graph embedding model are used as keys K, which carry semantic information from the knowledge graph in the power grid domain.

[0184] (2) Attention score calculation: Calculate the dot product QK between the query vector Q and the key K. T , divided by Scaling is performed using (d is the dimension of the key vector). ReLU is used as the neighborhood constraint function σ to process the scaled result. After exponential operation and normalization, the attention weight w for each feature is obtained. i .

[0185] (3) Feature-weighted fusion: Based on the calculated attention weight w i We perform a weighted summation of the feature vectors F in the unified feature space to highlight the role of important features and obtain a weighted fused feature vector.

[0186] 1.3 Indicator Generation and Validation

[0187] 1.3.1 Generating Interpretable Metrics

[0188] (1) Hadamard product operation: The Hadamard product operation is performed between the feature vector F after dynamic weight optimization and the dynamic weight matrix W to further emphasize the important features.

[0189] (2) Knowledge-driven decoder: Using a trained knowledge-driven decoder, the result of the Hadamard product is converted into a structured index I conforming to the STIX format. STIX During training, the decoder incorporates information from the power grid domain knowledge graph (DKG) to learn the mapping relationship between feature vectors and STIX metrics. For example, when a feature vector reveals a specific malicious IP address, abnormal network traffic, and related vulnerability information, the decoder outputs STIX metrics that include information such as the attack type (e.g., "exploitation attack targeting power grid equipment"), a list of affected devices, and the threat level.

[0190] 1.3.2 Closed-loop feedback optimization

[0191] (1) Data error loss Mean squared error (MSE) is used as the data error loss function. Measuring the generated metric I versus the true label The differences lie in the fact that accurate labeling can be determined through records of actual safety incidents occurring within the power grid company and expert assessments.

[0192] (2) Loss of knowledge consistency The semantic distance between the generated index I and the power grid domain knowledge graph DKG is calculated using a graph neural network (GNN) as the knowledge consistency loss. If the attack behavior mentioned in the generated metrics is inconsistent with the information about the devices and vulnerabilities involved in the attack behavior recorded in the knowledge graph, the semantic distance increases and the loss of knowledge consistency increases.

[0193] (3) Balancing factor λ: Through multiple experiments, it was determined that in the scenario of power grid enterprises, a balancing factor λ = 0.6 can effectively balance data error loss and knowledge consistency loss. At this point, the total loss function...

[0194] (4) Optimization process: Using the gradient descent algorithm, based on the total loss function... The parameters of the entire model are updated. After multiple iterations of training, the model can be continuously optimized, and the generated threat intelligence feature indicators are more accurate and reliable, meeting the cybersecurity protection needs of power grid enterprises.

[0195] Through the above embodiments, in the actual application scenarios of power grid enterprises, this method effectively realizes the deep coupling of domain knowledge-driven and data feature-driven approaches, generates high-precision and interpretable threat intelligence indicators, provides strong support for the network security protection of power grid enterprises, and significantly improves the ability of power grid systems to cope with network attacks.

[0196] The embodiments of the present invention are not limited to the above description. The value of the domain adjustment factor α in the expert rule fuzzy logic quantization in domain knowledge modeling, the type selection of the domain constraint function σ in dynamic weight optimization (such as ReLU / Sigmoid / Tanh), the setting of the balance factor λ in closed-loop feedback optimization to balance data error loss and knowledge consistency loss, and the configuration of the number of neurons and activation function in the fully connected layer of the knowledge-driven decoder are all within the protection scope of the present invention.

Claims

1. A domain knowledge-driven method for generating threat intelligence feature indicators, characterized in that, include: Domain knowledge modeling: By constructing a domain knowledge graph (DKG), a formal representation of threat entities and their relationships is achieved. At the same time, expert rules are injected and fuzzy logic is used for quantification, establishing a basic framework that integrates structured knowledge and expert experience. Multimodal feature fusion: embeds multimodal raw data such as network traffic and logs with knowledge graphs into a unified space, introduces an attention mechanism to dynamically optimize feature weights, and generates a weighted fusion feature vector; Indicator generation and validation: Important features are enhanced through Hadamard product operation, and structured indicators conforming to the STIX format are generated using a knowledge-driven decoder. The accuracy of the indicators is optimized by combining closed-loop feedback of data error loss and knowledge consistency loss.

2. The method according to claim 1, characterized in that, The construction of the domain knowledge graph includes: Define core entities and multi-dimensional attributes such as attack subject, attack vector, attack behavior, and asset entity; Model semantic relationships between entities, such as "exploiting vulnerabilities" and "association attack chains," and quantify confidence levels; Neo4j is used to store the map, and incremental updates are implemented through the STIX / TAXII protocol.

3. The method according to claim 1, characterized in that, The expert rule injection includes: Expert experience is formally expressed using the IF-THEN structure, which includes preconditions and conclusions / actions. Fuzzy mapping of threat scoring is achieved using triangular fuzzy numbers or Gaussian membership functions; The weight adjustment factor is quantized based on the sigmoid activation function, and the formula is as follows: Where α is the domain adjustment factor.

4. The method according to claim 1, characterized in that, The feature space mapping includes: LSTM is used to extract the time-series features of network traffic and logs, while Transformer is used to process text-based log features. The TransE model embeds knowledge graph entities and relationships into a low-dimensional vector space. Tensor splicing operation F = Φ(X) raw )⊕Ψ(DKG) generates a unified feature space vector.

5. The method according to claim 1, characterized in that, The dynamic weight optimization includes: Generate a learnable query vector Q and a knowledge graph entity key K; Calculate attention weights Where σ is the neighborhood constraint function (ReLU / Sigmoid / Tanh); The fused features are weighted and summed based on their weights.

6. The method according to claim 1, characterized in that, The generation and verification of the indicators include: The knowledge-driven decoder uses a 3-layer fully connected neural network, and the output layer selects either Softmax or a linear activation function based on the type of metric. The total loss function for closed-loop feedback optimization is Where λ is the balance factor; The semantic distance between the generated metrics and the knowledge graph is calculated using GraphSAGE as the knowledge consistency loss.

7. A computer-readable storage medium, characterized in that, The device contains a computer program that, when executed, performs the steps of the method described in any one of claims 1-6.

8. A computer program product, characterized in that, It includes computer-executable instructions that, when executed, perform the function of the method according to any one of claims 1-6.

Images