Security knowledge graph construction method and system based on behavior trajectory

Abstract

The invention discloses a security knowledge graph construction method and system based on behavior tracks, and relates to the technical field of network security. The method comprises the following steps: carrying out operation link aggregation according to user operation records to obtain a standardized behavior track chain; calling and accessing heterogeneous behavior trajectory data by taking the standardized behavior trajectory chain as a constraint to obtain multi-source behavior trajectory data; decomposing the standardized behavior track chain to obtain a link node time sequence operation relation and M link nodes; performing time sequence dependence modeling based on the graph convolutional network to generate a security knowledge graph; decomposing the multi-source behavior track data according to the M link nodes to obtain M pieces of multi-source behavior node data; and taking the M multi-source behavior node data as training data, and executing local parameter adaptive optimization of the security knowledge graph through a meta-learning framework. The technical problem of insufficient adaptability of the knowledge security graph in the prior art is solved, and the technical effect of dynamic adaptive optimization of the security knowledge graph is realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for constructing a security knowledge graph based on behavioral trajectories. Background Technology

[0002] In cybersecurity protection systems, knowledge graphs, as a technology capable of depicting entity relationships and semantic structures, have been increasingly applied to scenarios such as attack detection, threat intelligence analysis, and security situation awareness. However, existing methods for constructing security knowledge graphs primarily rely on static data and predefined rules, making it difficult to adapt to dynamically changing network behavior environments. This is particularly true when dealing with cross-domain, heterogeneous, and multi-source user behavior trajectory data, resulting in high graph construction latency, incomplete behavioral semantic characterization, and weak graph generalization capabilities. Furthermore, with the increasing complexity of network environments and the increasingly diverse forms of security incidents, traditional static graphs struggle to reflect the behavioral paths and evolutionary characteristics of emerging security threats in a timely manner, thus limiting the graph's support for practical security protection. Summary of the Invention

[0003] This application provides a method and system for constructing a security knowledge graph based on behavioral trajectories, which solves the technical problem of insufficient adaptability of existing knowledge security graphs.

[0004] A first aspect of this application provides a method for constructing a security knowledge graph based on behavioral trajectories, the method comprising: Based on user operation records, operation links are aggregated to obtain a standardized behavior trajectory chain. Using this standardized behavior trajectory chain as a constraint, a federated learning framework is used to access heterogeneous behavior trajectory data from cross-domain heterogeneous data sources, resulting in multi-source behavior trajectory data. The standardized behavior trajectory chain is decomposed to obtain the temporal operation relationships of link nodes and M link nodes. The temporal operation relationships of link nodes are used as topological edges, and the M link nodes are used as topological nodes. Temporal dependency modeling is performed based on graph convolutional networks to generate a security knowledge graph. The multi-source behavior trajectory data is decomposed based on the M link nodes to obtain M multi-source behavior node data. The M multi-source behavior node data is used as training data, and a meta-learning framework is used to perform local parameter adaptive optimization of the security knowledge graph.

[0005] A second aspect of this application provides a security knowledge graph construction system based on behavioral trajectories, the system comprising: The system comprises the following modules: Aggregation Module: Aggregates operation links based on user operation records to obtain a standardized behavior trajectory chain; Data Retrieval Module: Using the standardized behavior trajectory chain as constraints, it calls heterogeneous behavior trajectory data from cross-domain heterogeneous data sources through a federated learning framework to obtain multi-source behavior trajectory data; Decomposition Module: Decomposes the standardized behavior trajectory chain to obtain the temporal operation relationships of link nodes and M link nodes; Graph Generation Module: Uses the temporal operation relationships of link nodes as topological edges and the M link nodes as topological nodes, performs temporal dependency modeling based on graph convolutional networks, and generates a security knowledge graph; Data Decomposition Module: Decomposes the multi-source behavior trajectory data based on the M link nodes to obtain M multi-source behavior node data; Graph Optimization Module: Uses the M multi-source behavior node data as training data and performs local parameter adaptive optimization of the security knowledge graph through a meta-learning framework.

[0006] One or more technical solutions provided in this application have at least the following technical effects or advantages: First, operation links are aggregated based on user operation records to obtain a standardized behavior trajectory chain. Next, using this standardized behavior trajectory chain as a constraint, a federated learning framework is used to access heterogeneous behavior trajectory data from cross-domain data sources, resulting in multi-source behavior trajectory data. Simultaneously, the standardized behavior trajectory chain is decomposed to obtain the temporal operation relationships of the link nodes and M link nodes. Further, the temporal operation relationships of the link nodes are used as topological edges, and the M link nodes are used as topological nodes. Temporal dependency modeling is performed based on a graph convolutional network to generate a security knowledge graph. Then, the multi-source behavior trajectory data is decomposed based on the M link nodes to obtain M multi-source behavior node data. Finally, the M multi-source behavior node data are used as training data, and a meta-learning framework is used to perform local parameter adaptive optimization of the security knowledge graph. This solves the technical problem of insufficient adaptability of existing knowledge security graphs and achieves the technical effect of dynamic adaptive optimization of the security knowledge graph. Attached Figure Description

[0007] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0008] Figure 1 This is a schematic diagram of the process for constructing a security knowledge graph based on behavioral trajectories, provided in an embodiment of this application. Figure 2 A schematic diagram of the structure of a security knowledge graph construction system based on behavioral trajectories provided in this application embodiment.

[0009] Figure labeling: Aggregation module 11, Data retrieval module 12, Decomposition module 13, Map generation module 14, Data decomposition module 15, Map optimization module 16. Detailed Implementation

[0010] This application solves the technical problem of insufficient adaptability of existing knowledge security graphs by providing a method and system for constructing a security knowledge graph based on behavioral trajectories.

[0011] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0012] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to these processes, methods, products, or devices.

[0013] Example 1, as Figure 1 As shown, this application provides a method for constructing a security knowledge graph based on behavioral trajectories, wherein the method includes: By aggregating user operation records, a standardized behavioral trajectory chain is obtained.

[0014] In this embodiment, user operation records are acquired, including multiple dimensions such as operation timestamp, operation event type, operation object identifier, and operation device ID. For the timestamp field in the operation records, cross-device timestamp calibration is performed based on a multi-source time alignment strategy under a federated learning framework to generate a unified global time series sequence. The user operation records are segmented and sorted according to the global time series sequence to obtain multiple time-continuous operation event sequences. Event semantic classification and operation target identification are performed on the operation event sequences to identify multiple related candidate link nodes. Further, based on the causal relationships between events, an initial operation link topology is constructed, and the causal correlation strength value between each node is calculated. According to a preset causal strength threshold, the candidate link nodes are filtered and aggregated, eliminating weakly correlated paths with causal strength below the threshold and retaining link structures with strong logical connections. Finally, the aggregated high-confidence link nodes are connected according to the global time series order to form a standardized behavior trajectory chain with a clear structure, standardized node semantics, and traceable topology.

[0015] Furthermore, by aggregating user operation records, a standardized behavioral trajectory chain is obtained, including: The user operation records are calibrated using a multi-source timestamp based on a federated learning framework to obtain a global time series sequence. The user operation records are then decomposed based on the global time series sequence to obtain multiple operation event sequences. After aggregating the multiple operation event sequences to obtain the M link nodes, the causal association strength of the M link nodes is calculated based on the multiple operation event sequences to obtain M sets of node association frequencies. The M sets of node association frequencies are then filtered based on a preset causal strength threshold to output the standardized behavior trajectory chain.

[0016] The local timeline in user operation records is aligned using a federated learning framework. Specifically, each participant maps its local timestamp data to a unified reference timeline, and aggregates and learns the time offsets through a federated averaging algorithm to eliminate time deviations caused by inconsistent times between data sources and acquisition devices, thereby generating a unified global time series.

[0017] The original user operation records are sorted and segmented based on the global time sequence, decomposing the operation data within a continuous time window into multiple ordered operation event sequences. Each operation event sequence contains several operation events performed by users on system, software, or network resources within a certain time range, such as login, file access, command execution, and data transfer.

[0018] After obtaining multiple operation event sequences, the system performs node aggregation processing to identify M link nodes with obvious semantic features or security significance. Link nodes may include specific operation actions (such as "accessing sensitive directories"), operation objects (such as "high-privilege files"), or state changes (such as "successful privilege escalation").

[0019] Based on the operation sequence and node interaction logic in each operation event sequence, the causal association strength between M link nodes is calculated to obtain the association frequency data between M groups of nodes. The causal association strength can be modeled using methods such as operation co-occurrence counts within a sliding window, operation sequence dependencies, and time interval statistics, and is used to measure whether there is a stable and significant behavioral logical relationship between any two link nodes.

[0020] Based on a preset causal strength threshold, the frequency data of node associations in M ​​groups are filtered, and edge relationships with association strength below the threshold are removed, retaining only node connection paths with high confidence and causal logic. This results in a standardized behavioral trajectory chain with a clear topological structure and explicit temporal dependencies.

[0021] Furthermore, based on a preset causal strength threshold, the frequency of association of the M groups of nodes is filtered, and the standardized behavioral trajectory chain is output, including: Based on the causal strength threshold, the frequency of association of the M groups of nodes is filtered to obtain the M out-degree association node information of the M multi-source behavioral nodes; after splicing the M multi-source behavioral nodes according to the M out-degree association node information, out-degree conflict resolution is performed based on causal strength to output the standardized behavioral trajectory chain.

[0022] For the M groups of node association frequency data, a causal strength threshold is set to filter out node pairs with significant operational logical relationships. Specifically, the association frequency between each group of link nodes is traversed. If the association frequency between a node pair is greater than or equal to the threshold, it is considered to have a valid out-degree connection. In this way, the out-degree association node information corresponding to each multi-source behavior node is extracted, thereby constructing M out-degree association node information for the M multi-source behavior nodes.

[0023] Using the out-degree association information of each selected multi-source behavior node, one or more candidate behavior paths are initially constructed according to the global timestamp and operation sequence of the nodes, and the M multi-source behavior nodes are concatenated into an initial behavior trajectory chain. During this process, if a node has multiple out-degrees (i.e., multiple successor nodes), an out-degree conflict occurs. The system performs causal strength evaluation on each node with multiple out-degrees to resolve the conflict. Specifically, based on historical behavior data and operation co-occurrence statistics, the causal strength score between the node and each of its out-degree nodes is calculated. For example, a causal strength function can be constructed using indicators such as conditional probability (P(B|A)), operation time sequence weight, and behavior continuity score. After completing the causal strength calculation, the path with the highest causal strength from the node's multiple candidate out-degrees is selected as the retained path, while other low-strength connections are discarded. If the causal strengths of multiple out-degree nodes are similar, node context (such as predecessor nodes, operation source devices, and behavior targets) or a context path scoring mechanism based on a sliding window can be further introduced to comprehensively determine the optimal connection method. Once all out-of-degree conflicts are resolved, a standardized behavioral trajectory chain can be formed.

[0024] Using the standardized behavioral trajectory chain as a constraint, the federated learning framework is used to call cross-domain heterogeneous data sources to access heterogeneous behavioral trajectory data, thereby obtaining multi-source behavioral trajectory data.

[0025] Based on a standardized behavior trajectory chain, information about the link nodes and the temporal relationships between them is extracted to generate a behavior extraction template. Each link node includes structured elements such as node identifier, operation type, target object, and time window range, used to define behavior data matching rules. Then, a federated learning framework is established, deploying local federated clients on multiple heterogeneous data source nodes. Each heterogeneous data source node includes, but is not limited to, terminal log databases, server access record systems, edge behavior monitoring devices, and cloud security platforms. These heterogeneous data sources exhibit heterogeneity in data structure, storage protocols, and access policies. Next, without transmitting the original data, each local federated client performs behavior trajectory matching operations on its local data according to the behavior extraction template, extracting user behavior fragments that are logically consistent with the standardized behavior trajectory chain. The matching process includes: operation type alignment, target resource matching, and time window judgment. If multiple candidate behavior fragments exist, the fragment sequence with the highest temporal consistency is retained as the local extraction result. Subsequently, based on the privacy protection mechanism set by the federated learning framework, each local node performs feature encoding or homomorphic encryption on the extracted behavior trajectory data and reports it to the federated central node through a secure communication channel. The central node performs joint aggregation and feature alignment on the encoded trajectory data from various data sources to form multi-source behavioral trajectory data in a unified format.

[0026] The standardized behavior trajectory chain is decomposed to obtain the temporal operation relationship of the link nodes and M link nodes.

[0027] The standardized behavior trajectory chain is structurally analyzed to identify each behavior node within the chain. Each behavior node corresponds to an independent user action within the system. This action includes at least the following elements: operation type (e.g., login, file read / write, command execution), operation object (e.g., target file, process, or port), operation timestamp, and operation initiator identifier. Based on the analysis results, M link nodes are extracted, where M is the total number of unique operation nodes in the trajectory chain.

[0028] Based on the operation timestamp information of each link node, the M link nodes are sorted in chronological order to construct a temporal operation sequence of the link nodes. Further, based on the operation dependencies or behavioral logical order between nodes, it is determined whether there is a causal relationship between the nodes. If so, a directed edge is established between the corresponding two nodes to identify their temporal operation dependencies, thus forming a temporal operation graph structure between the link nodes. Finally, the output link node temporal operation relationship is a topology structure containing M nodes and several directed edges, where each edge represents the temporal and behavioral causal dependency between two nodes.

[0029] Using the temporal operation relationships of the link nodes as topological edges and the M link nodes as topological nodes, temporal dependency modeling is performed based on graph convolutional networks to generate a security knowledge graph.

[0030] First, based on the aforementioned decomposition results, each link node is treated as a topological node in the graph structure. Each node represents a specific operation performed by the user at a certain point in time, including but not limited to operation type, operation object, initiating entity, operation time, resource path, and execution result. Then, the temporal operation relationships between link nodes are treated as directed edges in the graph structure. Each directed edge represents a temporal sequence and behavioral dependency logic between two operation nodes, reflecting the causal chain of user behavior. Through the combination of nodes and edges, a user behavior topology graph containing temporal and semantic associations is constructed. Next, a graph convolutional network is used to model the above behavior topology graph. First, the structured attributes of each topological node are extracted to form an initial set of node feature vectors. Subsequently, the graph convolutional network, through a multi-layer feature propagation mechanism, fuses and iteratively updates the structural dependencies and attribute information between nodes, enabling the representation of each node to comprehensively reflect the contextual information of its neighboring nodes and its position and role in the behavior chain. Ultimately, the node and edge representations output by the graph convolutional network are mapped to entities and relationships in a security knowledge graph. This graph contains various types of nodes, such as user behavior nodes, resource nodes, and security event nodes, as well as edges representing semantic relationships such as causal relationships, resource associations, and time dependencies.

[0031] Based on the M link nodes, the multi-source behavioral trajectory data is decomposed to obtain M multi-source behavioral node data.

[0032] Based on multiple link nodes identified in the standardized behavior trajectory chain, a behavior feature template corresponding to each node is determined. The behavior feature template describes the core behavior feature identifier of the link node, including operation type identifier, target resource identifier, operation subject identifier, behavior semantic label, and time window information. Then, the system iterates and matches the accessed multi-source behavior trajectory data, which comes from multiple heterogeneous data sources, such as terminal logs, network audit data, host behavior monitoring records, and access control logs. According to the behavior feature template of each link node, the system extracts semantically and structurally consistent behavior data fragments from the aforementioned multi-source behavior trajectory data, forming a multi-source behavior data set corresponding to that link node. Next, each type of behavior data set is aggregated according to its source dimension, operation context, chronological order, resource dependency, and other factors to construct structured data units. Each structured data unit is a multi-source behavior node data, containing the node's behavior under different data sources, its original data fragments, metadata labels, and contextual semantic information. Finally, following the above method, the corresponding multi-source behavior data is extracted and organized for each link node, resulting in M ​​multi-source behavior node data sets.

[0033] The M multi-source behavioral node data are used as training data, and the local parameter adaptive optimization of the security knowledge graph is performed through a meta-learning framework.

[0034] Based on M multi-source behavioral node data, a training task set is constructed. Each training task consists of a set of data with similar behavioral semantics or operational contexts, representing specific behavioral patterns or link types, to support rapid adaptive training in different scenarios. Next, a local meta-learning task execution unit is constructed. This unit uses each training task as basic input samples and is trained using a meta-learning framework, which includes two stages: intra-task training and cross-task meta-update. In the intra-task training stage, the system uses the multi-source behavioral node data to perform a graph modeling process, obtaining the graph neural network parameters for the current task. In the meta-update stage, the system aggregates the model parameters from multiple tasks to form a general initial model. Subsequently, in each new task scenario, the initial model is used to perform rapid adaptive adjustments. Based on the newly input behavioral node data, the system quickly fine-tunes the local model parameters to adapt to the behavioral feature distribution of the current node, achieving localized knowledge graph construction and updating.

[0035] Furthermore, using the M multi-source behavioral node data as training data, the local parameter adaptive optimization of the security knowledge graph is performed through a meta-learning framework, including: Based on a preset behavioral baseline, abnormal data in the M multi-source behavioral node data are isolated to obtain M multi-source abnormal behavior data; the M multi-source abnormal behavior data are reorganized according to the operation timestamp sequence to obtain abnormal operation link data; the abnormal operation link data is input into the security knowledge graph, and the local parameter adaptive optimization of the security knowledge graph is performed through the meta-learning framework.

[0036] First, based on a preset behavioral baseline, anomalies are identified and isolated from M multi-source behavioral node data. The behavioral baseline can be constructed from historical normal behavior samples, including typical operation sequence patterns, behavior frequency ranges, access resource path ranges, and operation response characteristics. By comparing the current multi-source behavioral node data with the behavioral baseline, data segments with high deviation are identified and extracted to form multiple multi-source abnormal behavior data.

[0037] Then, based on the operation timestamp information of the multi-source abnormal behavior data, time-series reorganization processing is performed. Specifically, the operations are sorted according to their occurrence time to construct a timeline; combined with the resource access dependencies between nodes and the behavioral context, possible causal paths of abnormal behaviors are reconstructed, ultimately forming abnormal operation link data with a complete semantic chain.

[0038] Finally, the abnormal operation link data is input into the currently constructed security knowledge graph, and the local parameter adaptive optimization of the graph structure is performed through the meta-learning framework. Specifically, a rapid task adjustment strategy based on abnormal data can be adopted: in the local task training phase, the system performs parameter fine-tuning of the graph neural network based on the abnormal link data to enhance the ability to identify abnormal patterns; in the meta-update phase, the system performs cross-task aggregation based on the task gradient information corresponding to different abnormal types, adjusts the initial parameters of the general model, and improves the model's response speed and adaptability to new abnormal behaviors.

[0039] Furthermore, based on a preset behavioral baseline, abnormal data in the M multi-source behavioral node data are isolated to obtain M multi-source abnormal behavioral data, including: After obtaining multi-source local behavior baselines through interaction, a global behavior baseline is generated by aggregation using a federated averaging algorithm. Based on the global behavior baseline, M multimodal deviation scores of the M multi-source behavior node data are calculated. Based on the M multimodal deviation scores, M abnormal data isolation ratios are set. The global behavior baseline is used to traverse the M multi-source behavior node data to filter out M initial abnormal behavior data. Random isolation of the M initial abnormal behavior data is performed according to the M abnormal data isolation ratios to obtain the M multi-source abnormal behavior data.

[0040] Local behavioral baselines distributed across different network domains, system platforms, or organizational nodes are obtained through interaction from various data access points. These local behavioral baselines are behavioral feature models generated from historical normal operation records of each data source, encompassing statistical patterns across multiple modal dimensions such as operation category frequency, access path distribution, resource access scope, and operation duration distribution. A federated averaging algorithm framework is constructed based on a federated learning mechanism to perform parameter-level aggregation of multi-source local behavioral baselines without data leakage, generating a unified global behavioral baseline.

[0041] The system uses a global behavioral baseline as a benchmark to calculate the behavioral deviation of each multi-source behavioral node. Specifically, it calculates deviation scores from multiple modal dimensions, including operation frequency, operation target, behavioral sequence order, and resource access patterns, forming a multimodal deviation score set for each node. This set quantifies the degree of deviation between the current behavior and the global baseline. Based on the multimodal deviation score of each node, a corresponding abnormal data isolation ratio is set. This ratio can be determined based on anomaly level classification, adaptive threshold calculation, or manual empirical rules, reflecting the estimated proportion of abnormal samples in the overall data for each node's behavior.

[0042] Based on this, the system traverses all multi-source behavior node data, uses a global behavior baseline to initially filter the behavior of each node, and extracts a batch of data that differs significantly from the behavior baseline to form initial abnormal behavior data. Finally, according to the aforementioned abnormal data isolation ratio and combined with a certain random selection strategy, a controlled subset isolation operation is performed on the initial abnormal behavior data, ultimately outputting M multi-source abnormal behavior data.

[0043] Furthermore, the multimodal deviation score includes operation frequency deviation, timing outlier, and target object outlier.

[0044] Multimodal deviation score is used to characterize the degree of deviation of multi-source behavioral node data from the global behavioral baseline. It includes operation frequency deviation, time series outliers, and target object outliers.

[0045] Operation frequency deviation is used to measure the difference between the actual frequency of a specific operation type in the target node and the standard frequency of that operation type in the global baseline. It is calculated using a normalized difference function. The higher the deviation, the more abnormally high or low frequency the operation type exists in the behavior node.

[0046] Temporal outliers are used to characterize the deviation of the time interval distribution of operational events in a behavioral sequence from the expected temporal pattern in the baseline model. The degree of temporal deviation for a given behavioral node is calculated by performing sequence differencing on the operation timestamps in the behavioral trajectory and comparing it to the average interval between corresponding operation pairs in the global baseline. If abnormal delays, excessive clustering, or temporal interleaving occur, the temporal outlier will be significantly higher.

[0047] Outliers in target objects are used to measure whether the resource objects involved in an operation exceed the access scope or frequency distribution specified in the baseline model. By extracting target resources (such as file paths, service interfaces, database table names, etc.) from the operation behavior, and comparing them with the target object access distribution model established in the baseline, the confidence deviation is calculated. A higher deviation indicates that the behavior node has a tendency to access unauthorized or abnormal resources.

[0048] Furthermore, the abnormal operation link data is input into the security knowledge graph, and local parameter adaptive optimization of the security knowledge graph is performed through a meta-learning framework, including: Based on the attack scenario, the abnormal operation link data is divided into K sub-task link data. After calculating the local loss function of the K sub-task link data to update the task-specific parameters of the security knowledge graph, the gradient features of the K sub-task link data are aggregated, and the global parameters of the security knowledge graph are updated through the meta-optimizer.

[0049] Based on attack scenario tags, semantic recognition and behavioral grouping are performed on abnormal operation link data, and the data is divided into K sub-task link data according to the homogeneity of behavioral characteristics. Each sub-task link data represents a specific type of abnormal operation process, with relatively independent attack intent, operation path or abnormal attributes.

[0050] Within the meta-learning framework, a task-specific training process is constructed for each subtask link data. Specifically, this includes: using a graph neural network to perform forward propagation calculation on the mapping subgraph of the subtask link in the security knowledge graph to obtain node representations and link prediction results; then constructing a local loss function based on the true labels of the subtask link (such as anomaly category, operation intent, etc.) and performing backpropagation of parameters to update the task-specific parameter set of the security knowledge graph.

[0051] The gradient feature sets generated during the training of the K sub-tasks are aggregated in a unified manner. Using a meta-learning optimizer (such as an optimization strategy based on MAML or Reptile), the learning results of multiple sub-tasks are fused to update the global parameters of the security knowledge graph without compromising the characteristics of the learned tasks.

[0052] Furthermore, the real-time behavioral trajectory data collected from the M link nodes is integrated into the optimized security knowledge graph, and after performing dynamic causal correlation analysis, real-time intervention instructions are generated.

[0053] Real-time behavior trajectory data is continuously acquired from behavior acquisition modules deployed at M link nodes. This data includes dimensions such as real-time operation events, timestamps, operation objects, and source terminal information. After local preprocessing, this data is input into a structured sequence format into a security knowledge graph that has undergone parameter optimization.

[0054] Based on the causal relationship structure and temporal dependency characteristics of nodes already modeled in the security knowledge graph, graph-level dynamic matching analysis is performed on real-time input operation events. By probabilistic inference of the potential causal path of newly accessed events in the graph and calculation of abnormal association scores, it is dynamically determined whether the operation may trigger a potential security risk behavior chain or a known attack behavior pattern.

[0055] After completing the dynamic causal relationship analysis, if the system determines that the matching degree between the current operation and the abnormal path already established in the graph exceeds a preset threshold, it will generate a real-time intervention command. The real-time intervention command includes, but is not limited to, response strategies such as: permission freezing, access termination, source address blocking, and abnormal behavior report push.

[0056] In summary, the embodiments of this application have at least the following technical effects: First, operation links are aggregated based on user operation records to obtain a standardized behavior trajectory chain. Next, using this standardized behavior trajectory chain as a constraint, a federated learning framework is used to access heterogeneous behavior trajectory data from cross-domain data sources, resulting in multi-source behavior trajectory data. Simultaneously, the standardized behavior trajectory chain is decomposed to obtain the temporal operation relationships of the link nodes and M link nodes. Further, the temporal operation relationships of the link nodes are used as topological edges, and the M link nodes are used as topological nodes. Temporal dependency modeling is performed based on a graph convolutional network to generate a security knowledge graph. Then, the multi-source behavior trajectory data is decomposed based on the M link nodes to obtain M multi-source behavior node data. Finally, the M multi-source behavior node data are used as training data, and a meta-learning framework is used to perform local parameter adaptive optimization of the security knowledge graph. This solves the technical problem of insufficient adaptability of existing knowledge security graphs and achieves the technical effect of dynamic adaptive optimization of the security knowledge graph.

[0057] Example 2, based on the same inventive concept as the behavior trajectory-based security knowledge graph construction method in the foregoing examples, such as... Figure 2 As shown, this application provides a security knowledge graph construction system based on behavioral trajectories, wherein the system includes: Aggregation Module 11: Aggregates operation links based on user operation records to obtain a standardized behavior trajectory chain; Data Invocation Module 12: Using the standardized behavior trajectory chain as a constraint, invokes cross-domain heterogeneous data sources through a federated learning framework to access heterogeneous behavior trajectory data and obtain multi-source behavior trajectory data; Decomposition Module 13: Decomposes the standardized behavior trajectory chain to obtain the temporal operation relationship of link nodes and M link nodes; Graph Generation Module 14: Uses the temporal operation relationship of link nodes as topological edges and the M link nodes as topological nodes, performs temporal dependency modeling based on graph convolutional networks, and generates a security knowledge graph; Data Decomposition Module 15: Decomposes the multi-source behavior trajectory data based on the M link nodes to obtain M multi-source behavior node data; Graph Optimization Module 16: Uses the M multi-source behavior node data as training data and performs local parameter adaptive optimization of the security knowledge graph through a meta-learning framework.

[0058] Furthermore, the map optimization module 16 is used to perform the following method: Based on a preset behavioral baseline, abnormal data in the M multi-source behavioral node data are isolated to obtain M multi-source abnormal behavior data; the M multi-source abnormal behavior data are reorganized according to the operation timestamp sequence to obtain abnormal operation link data; the abnormal operation link data is input into the security knowledge graph, and the local parameter adaptive optimization of the security knowledge graph is performed through the meta-learning framework.

[0059] Furthermore, the map optimization module 16 is used to perform the following method: The real-time behavioral trajectory data collected from the M link nodes is integrated into the optimized security knowledge graph, and after performing dynamic causal association analysis, real-time intervention instructions are generated.

[0060] Furthermore, the aggregation module 11 is used to perform the following methods: The user operation records are calibrated using a multi-source timestamp based on a federated learning framework to obtain a global time series sequence. The user operation records are then decomposed based on the global time series sequence to obtain multiple operation event sequences. After aggregating the multiple operation event sequences to obtain the M link nodes, the causal association strength of the M link nodes is calculated based on the multiple operation event sequences to obtain M sets of node association frequencies. The M sets of node association frequencies are then filtered based on a preset causal strength threshold to output the standardized behavior trajectory chain.

[0061] Furthermore, the aggregation module 11 is used to perform the following methods: Based on the causal strength threshold, the frequency of association of the M groups of nodes is filtered to obtain the M out-degree association node information of the M multi-source behavioral nodes; after splicing the M multi-source behavioral nodes according to the M out-degree association node information, out-degree conflict resolution is performed based on causal strength to output the standardized behavioral trajectory chain.

[0062] Furthermore, the map optimization module 16 is used to perform the following method: After obtaining multi-source local behavior baselines through interaction, a global behavior baseline is generated by aggregation using a federated averaging algorithm. Based on the global behavior baseline, M multimodal deviation scores of the M multi-source behavior node data are calculated. Based on the M multimodal deviation scores, M abnormal data isolation ratios are set. The global behavior baseline is used to traverse the M multi-source behavior node data to filter out M initial abnormal behavior data. Random isolation of the M initial abnormal behavior data is performed according to the M abnormal data isolation ratios to obtain the M multi-source abnormal behavior data.

[0063] Furthermore, the map optimization module 16 is used to perform the following method: The multimodal deviation score includes operation frequency deviation, timing outlier, and target object outlier.

[0064] Furthermore, the map optimization module 16 is used to perform the following method: Based on the attack scenario, the abnormal operation link data is divided into K sub-task link data. After calculating the local loss function of the K sub-task link data to update the task-specific parameters of the security knowledge graph, the gradient features of the K sub-task link data are aggregated, and the global parameters of the security knowledge graph are updated through the meta-optimizer.

[0065] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0066] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0067] This specification and accompanying drawings are merely illustrative examples of this application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from its scope. Therefore, if such modifications and modifications fall within the scope of this application and its equivalents, this application intends to include such modifications and modifications.

Claims

1. A method for constructing a security knowledge graph based on behavioral trajectories, characterized in that, The method includes: The operation chain is aggregated based on the user operation record to obtain a standardized behavior trajectory chain; Using the standardized behavior trajectory chain as a constraint, the federated learning framework is used to call cross-domain heterogeneous data sources to access heterogeneous behavior trajectory data, thereby obtaining multi-source behavior trajectory data. Decompose the standardized behavior trajectory chain to obtain the temporal operation relationship of the link nodes and M link nodes; Using the temporal operation relationships of the link nodes as topological edges and the M link nodes as topological nodes, temporal dependency modeling is performed based on graph convolutional networks to generate a security knowledge graph. Based on the M link nodes, the multi-source behavioral trajectory data is decomposed to obtain M multi-source behavioral node data; The M multi-source behavioral node data are used as training data, and the local parameter adaptive optimization of the security knowledge graph is performed through a meta-learning framework.

2. The method for constructing a security knowledge graph based on behavioral trajectories as described in claim 1, characterized in that, Using the M multi-source behavioral node data as training data, the local parameter adaptive optimization of the security knowledge graph is performed through a meta-learning framework. The method includes: Based on a preset behavior baseline, abnormal data in the M multi-source behavior node data are isolated to obtain M multi-source abnormal behavior data. The abnormal operation link data is obtained by reorganizing the M multi-source abnormal behavior data according to the operation timestamp sequence. The abnormal operation link data is input into the security knowledge graph, and the local parameters of the security knowledge graph are adaptively optimized through a meta-learning framework.

3. The method for constructing a security knowledge graph based on behavioral trajectories as described in claim 1, characterized in that, The real-time behavioral trajectory data collected from the M link nodes is integrated into the optimized security knowledge graph, and after performing dynamic causal association analysis, real-time intervention instructions are generated.

4. The method for constructing a security knowledge graph based on behavioral trajectories as described in claim 1, characterized in that, The method involves aggregating user operation records to obtain a standardized behavior trajectory chain, wherein the aggregator method includes: Perform multi-source timestamp calibration based on a federated learning framework on the user operation records to obtain a global time series sequence; The user operation record is decomposed based on the global time sequence to obtain multiple operation event sequences; After aggregating the multiple operation event sequences to obtain the M link nodes, the causal association strength of the M link nodes is calculated based on the multiple operation event sequences to obtain M sets of node association frequencies; The M groups of nodes are filtered based on a preset causal strength threshold, and the standardized behavioral trajectory chain is output.

5. The method for constructing a security knowledge graph based on behavioral trajectories as described in claim 4, characterized in that, The method includes filtering the association frequency of the M groups of nodes based on a preset causal strength threshold and outputting the standardized behavioral trajectory chain. Based on the causal strength threshold, the association frequency of the M groups of nodes is filtered to obtain the out-degree association node information of the M multi-source behavioral nodes; After concatenating the M multi-source behavior nodes based on the M out-degree association node information, out-degree conflict resolution is performed based on causal strength, and the standardized behavior trajectory chain is output.

6. The method for constructing a security knowledge graph based on behavioral trajectories as described in claim 1, characterized in that, Based on a preset behavioral baseline, abnormal data in the M multi-source behavioral node data is isolated to obtain M multi-source abnormal behavioral data. The method includes: After obtaining multi-source local behavioral baselines through interaction, a global behavioral baseline is generated by aggregating them using a federated averaging algorithm. Based on the global behavioral baseline, calculate the M multimodal deviation scores of the M multi-source behavioral node data; Based on the M multimodal deviation scores, set M abnormal data isolation ratios; Using the global behavior baseline, M initial abnormal behavior data are obtained by traversing the M multi-source behavior node data and filtering them. Based on the isolation ratio of the M abnormal data, random isolation of the M initial abnormal behavior data is performed to obtain the M multi-source abnormal behavior data.

7. The method for constructing a security knowledge graph based on behavioral trajectories as described in claim 6, characterized in that, The multimodal deviation score includes operation frequency deviation, timing outlier, and target object outlier.

8. The method for constructing a security knowledge graph based on behavioral trajectories as described in claim 2, characterized in that, The abnormal operation link data is input into the security knowledge graph, and local parameter adaptive optimization of the security knowledge graph is performed through a meta-learning framework. The method includes: Based on the attack scenario, the abnormal operation link data is divided into K sub-task link data; After calculating the local loss function of the K sub-task link data to update the task-specific parameters of the security knowledge graph, the gradient features of the K sub-task link data are aggregated, and the global parameters of the security knowledge graph are updated through the meta-optimizer.

9. A security knowledge graph construction system based on behavioral trajectories, characterized in that, The system is used to implement the security knowledge graph construction method based on behavioral trajectories according to any one of claims 1-8, the system comprising: Aggregation module: Aggregates operation links based on user operation records to obtain standardized behavior trajectory chains; Data retrieval module: Based on the standardized behavior trajectory chain, it uses a federated learning framework to call cross-domain heterogeneous data sources to access heterogeneous behavior trajectory data and obtain multi-source behavior trajectory data; Decomposition module: Decomposes the standardized behavior trajectory chain to obtain the temporal operation relationship of the link nodes and M link nodes; The graph generation module uses the temporal operation relationships of the link nodes as topological edges and the M link nodes as topological nodes. It performs temporal dependency modeling based on graph convolutional networks to generate a security knowledge graph. Data decomposition module: Decomposes the multi-source behavioral trajectory data based on the M link nodes to obtain M multi-source behavioral node data; The graph optimization module uses the M multi-source behavioral node data as training data and performs local parameter adaptive optimization of the security knowledge graph through a meta-learning framework.

Images