Information security model assisted decision-making method and system based on intelligent knowledge graph

Abstract

The application relates to the technical field of artificial intelligence, and discloses an information security model auxiliary decision-making method and system based on an intelligent knowledge graph, which comprises the following steps: constructing a multi-modal security data pool of a to-be-decided scene, training a joint extraction model of the to-be-decided scene to extract data instances and instance relationships of the multi-modal security data pool; constructing a security knowledge graph of the to-be-decided scene; constructing an attack tactic-technology-process ontology layer of the to-be-decided scene to calculate a potential attack path of the to-be-decided scene, and calculate an attack path occurrence probability and an attack influence range of the potential attack path; marking a strategy decision point of the security knowledge graph, and analyzing Top-K strategies of the strategy decision point by using a preset PPO algorithm; constructing an attack chain analysis interface of the Top-K strategies in the security knowledge graph to generate strategy optimization parameters of the Top-K strategies, and executing information security model auxiliary decision-making of the to-be-decided scene based on the strategy optimization parameters. The application can improve the efficiency of information security decision-making of the to-be-decided scene.

Description

Technical Field

[0001] This invention relates to a method and system for assisting decision-making based on an intelligent knowledge graph information security model, belonging to the field of artificial intelligence technology. Background Technology

[0002] Information security model-assisted decision-making refers to the process of using mathematical models, statistical models, machine learning models, etc., to analyze, predict, and evaluate problems in the field of information security, thereby providing decision-makers with scientific basis and decision support. This decision-making approach aims to improve the efficiency and effectiveness of information security management, reduce decision-making risks, and optimize resource allocation.

[0003] Traditional methods of information security model-assisted decision-making typically rely on security experts to formulate strategies based on empirical rules, static risk assessments, or analysis of isolated security incidents. The decision-making process is often subjective and struggles to fully grasp the dynamically changing threat landscape, resulting in low decision-making efficiency, inaccurate resource allocation, and an inability to effectively respond to increasingly intelligent and covert cyberattacks, thus leading to inefficient information security decision-making. Summary of the Invention

[0004] This invention provides a method and system for assisting decision-making based on an intelligent knowledge graph information security model, the main purpose of which is to improve the efficiency of information security decision-making in decision-making scenarios.

[0005] To achieve the above objectives, this invention provides an information security model-assisted decision-making method based on intelligent knowledge graphs, comprising:

[0006] Construct a multimodal security data pool for the scenario to be decided, and train a joint extraction model for the scenario to be decided based on the data characteristics of the multimodal security data pool to extract data instances and instance relationships from the multimodal security data pool;

[0007] Based on the data instances and instance relationships, a security knowledge graph for the scenario to be decided is constructed;

[0008] Construct an attack tactics-technology-process ontology layer for the scenario to be decided, in order to calculate the potential attack paths for the scenario to be decided, and calculate the probability of occurrence and the scope of impact of the potential attack paths.

[0009] Based on the probability of the attack path and the scope of the attack, the policy decision points of the security knowledge graph are marked, and the Top-K policies of the policy decision points are analyzed using a preset PPO algorithm.

[0010] The Top-K strategy is constructed on the attack chain analysis interface of the security knowledge graph to generate strategy optimization parameters for the Top-K strategy. Based on the strategy optimization parameters, the information security model of the decision-making scenario is executed to assist decision-making.

[0011] Optionally, the construction of the multimodal security data pool for the decision-making scenario includes:

[0012] Identify the multimodal data source for the scenario to be decided;

[0013] Construct a real-time / offline acquisition architecture for the multimodal data source to collect multimodal data of the scenario to be decided;

[0014] Identify contaminated data in the multimodal data to filter the multimodal data and obtain target multimodal data;

[0015] The target multimodal data is normalized to obtain normalized multimodal data;

[0016] High-value annotations are performed on the normalized multimodal data to obtain annotated multimodal data;

[0017] The labeled multimodal data is stored to obtain a multimodal security data pool for the scenario to be decided.

[0018] Optionally, training the joint extraction model for the decision-making scenario includes:

[0019] Preprocess the model training data corresponding to the decision-making scenario to obtain processed model training data;

[0020] Construct the BERT model for the multimodal secure data pool, and add a BiLSTM layer to the BERT output layer corresponding to the BERT model;

[0021] A CRF layer is added after the BiLSTM layer;

[0022] The word vectors of the training data of the processing model are output using the BERT output layer corresponding to the BERT model.

[0023] Based on the word vectors, the sequence information of the model training data is captured using the BiLSTM layer corresponding to the BERT model;

[0024] The sequence information is labeled using the CRF layer corresponding to the BERT model to obtain sequence labeled data.

[0025] Define the loss function and loss function weights of the BERT model, wherein the loss function includes an entity recognition loss function, a relation classification loss function, and a modality alignment loss function;

[0026] Based on the sequence labeling data and the loss function weights, the model loss of the BERT model is calculated using the loss function to update the model parameters of the BERT model, thereby obtaining the joint extraction model for the decision-making scenario.

[0027] Optionally, the construction of the attack tactics-technology-process ontology layer for the scenario to be decided includes:

[0028] Determine the decision-making objectives for the scenario to be decided;

[0029] Based on the decision-making objectives, collect basic TTP information for the scenario to be decided.

[0030] The basic TTP information is mapped to the preset MITRE ATT&CK framework to obtain the mapped MITRE ATT&CK framework.

[0031] Define the core elements of the ontology layer for the scenario to be decided, and define the inter-class relationships and inter-class attributes of the core elements of the ontology layer;

[0032] Based on the aforementioned mapping MITRE ATT&CK framework, create a class instance of the scenario to be decided;

[0033] Based on the inter-class relationships and inter-class attributes, define the inter-instance relationships of the class instances;

[0034] Based on the class instances and the relationships between the instances, construct the attack tactics-techniques-process ontology layer for the scenario to be decided.

[0035] Optionally, calculating the potential attack paths for the scenario to be decided includes:

[0036] Analyze the security environment status of the scenario to be decided;

[0037] Based on the security environment status, determine the potential attack starting points of the scenario to be decided in the security knowledge graph;

[0038] Based on the attack tactics-technology-process ontology layer corresponding to the scenario to be decided, the reachable instance of the potential attack starting point is determined, so as to determine the path segment of the security knowledge graph;

[0039] The feasibility coefficient of the path segment is calculated based on the security environment status.

[0040] Based on the feasibility coefficient, the potential attack paths of the scenario to be decided are analyzed in the security knowledge graph.

[0041] Optionally, calculating the probability of occurrence and the scope of impact of the potential attack path includes:

[0042] Analyze the CVSS baseline score, defense coverage, and attacker capability matching degree of the potential attack paths;

[0043] Based on the CVSS baseline score, defense coverage, and attacker capability matching degree, the single-step transition probability of the potential attack path is calculated;

[0044] Based on the single-step transition probability, the probability of the attack path occurring is calculated.

[0045] Calculate the node impact coefficient of the potential attack path;

[0046] Based on the node influence coefficient, the attack impact range of the potential attack path is determined.

[0047] Optionally, calculating the node influence coefficient of the potential attack path includes:

[0048] Define the impact dimensions of the potential attack paths;

[0049] Based on the aforementioned impact dimensions, calculate the basic impact value of the potential attack path on the corresponding attack graph node in the security knowledge graph;

[0050] The node influence coefficient of the attack graph node corresponding to the potential attack path is calculated using the basic influence value.

[0051] Optionally, the step of analyzing the Top-K strategy of the strategy decision point using a preset PPO algorithm includes:

[0052] Construct candidate strategies for the strategy decision point;

[0053] Based on the PPO algorithm, construct the policy network of the candidate policies;

[0054] Generate the state-action-reward trajectory of the candidate strategy;

[0055] Calculate the action advantage value of the state-action-reward trajectory;

[0056] Based on the action advantage value, the action probability distribution of the candidate policy is generated using the policy network;

[0057] Based on the action probability distribution, the Top-K strategies of the candidate strategies are determined.

[0058] Optionally, the construction of the Top-K strategy in the attack chain analysis interface of the security knowledge graph includes:

[0059] Construct a visual model of the attack chain corresponding to the potential attack paths of the security knowledge graph;

[0060] The Top-K strategy and the attack chain visual model are mapped to obtain the mapped visual model;

[0061] And construct an interactive strategy for the mapping visual model;

[0062] Based on the interactive strategy, an attack chain analysis interface for the security knowledge graph is generated, wherein the attack chain analysis interface includes attack probability change value, node impact value change value, and residual risk heat map.

[0063] To address the aforementioned problems, the present invention also provides an information security model-assisted decision-making system based on intelligent knowledge graphs, the system comprising:

[0064] An extraction model building module is used to construct a multimodal security data pool for the scenario to be decided. Based on the data characteristics of the multimodal security data pool, a joint extraction model for the scenario to be decided is trained to extract data instances and instance relationships from the multimodal security data pool.

[0065] The knowledge graph construction module is used to construct a security knowledge graph for the decision-making scenario based on the data instances and instance relationships.

[0066] The attack path analysis module is used to construct the attack tactics-technology-process ontology layer of the scenario to be decided, to calculate the potential attack paths of the scenario to be decided, and to calculate the probability of occurrence and the scope of impact of the potential attack paths.

[0067] The defense strategy generation module is used to mark the strategy decision points of the security knowledge graph according to the probability of the attack path and the scope of the attack, and to analyze the Top-K strategy of the strategy decision points using a preset PPO algorithm.

[0068] The security auxiliary decision-making module is used to construct the Top-K strategy on the attack chain analysis interface of the security knowledge graph, generate the strategy optimization parameters of the Top-K strategy, and execute the information security model auxiliary decision-making for the scenario to be decided based on the strategy optimization parameters.

[0069] First, by constructing a multimodal security data pool, this solution can comprehensively integrate and utilize security data from different sources, breaking the data silo dilemma in traditional decision-making and providing a more comprehensive and accurate information foundation for decision-making. The training of the joint extraction model further enhances the data mining and analysis capabilities, enabling more accurate identification of data entities and entity relationships, providing strong support for the subsequent construction of a security knowledge graph. The security knowledge graph built based on data entities and entity relationships can not only intuitively display the security situation in the decision-making scenario, but also help decision-makers to understand attack paths and potential threats more deeply. The construction of the attack tactics-technology-process ontology layer further improves the accuracy and efficiency of attack path calculation, providing a more reliable basis for decision-making. By using the PPO algorithm to analyze the candidate strategy set and calculate its semantic matching degree with the decision-making scenario, this solution can intelligently filter out the Top-K strategies, providing decision-makers with more scientific and accurate strategy suggestions. The construction of the attack chain analysis interface can not only intuitively display the execution process of the Top-K strategies, but also help decision-makers better understand the strategy optimization parameters, thereby more effectively implementing information security model-assisted decision-making. Therefore, this invention can improve the efficiency of information security decision-making in decision-making scenarios. Attached Figure Description

[0070] Figure 1 This is a flowchart illustrating an information security model-assisted decision-making method based on intelligent knowledge graphs, provided in an embodiment of the present invention.

[0071] Figure 2 This is a schematic diagram of a module for implementing the information security model-assisted decision-making method based on intelligent knowledge graph, according to an embodiment of the present invention.

[0072] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0073] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0074] This application provides a method for assisting decision-making based on an intelligent knowledge graph-based information security model. The executing entity of this method includes, but is not limited to, at least one electronic device that can be configured to execute the method provided in this application, such as a server or a terminal. In other words, the method can be executed by software or hardware installed on a terminal device or a server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0075] Example 1:

[0076] Reference Figure 1 The diagram shown is a flowchart illustrating an information security model-assisted decision-making method based on an intelligent knowledge graph, according to an embodiment of the present invention. In this embodiment, the information security model-assisted decision-making method based on an intelligent knowledge graph includes:

[0077] S1. Construct a multimodal security data pool for the scenario to be decided. Based on the data characteristics of the multimodal security data pool, train a joint extraction model for the scenario to be decided to extract data instances and instance relationships from the multimodal security data pool.

[0078] This invention can comprehensively integrate and utilize security data from different sources, breaking the dilemma of data silos in traditional decision-making and providing a more comprehensive and accurate information foundation for decision-making.

[0079] Specifically, the construction of the multimodal security data pool for the decision-making scenario includes:

[0080] Identify the multimodal data source for the scenario to be decided;

[0081] Construct a real-time / offline acquisition architecture for the multimodal data source to collect multimodal data of the scenario to be decided;

[0082] Identify contaminated data in the multimodal data to filter the multimodal data and obtain target multimodal data;

[0083] The target multimodal data is normalized to obtain normalized multimodal data;

[0084] High-value annotations are performed on the normalized multimodal data to obtain annotated multimodal data;

[0085] The labeled multimodal data is stored to obtain a multimodal security data pool for the scenario to be decided.

[0086] The modal data source refers to the original system, device, or service that generates different types (modal) data. The real-time / offline acquisition architecture refers to the technical framework designed to acquire data from the aforementioned multimodal data sources. Real-time acquisition refers to the immediate or near-immediate capture and transmission of data after its generation, typically used in scenarios requiring rapid response, such as real-time threat detection and real-time alerts. Offline acquisition refers to the periodic (e.g., hourly, daily) batch collection of data, typically used in post-event analysis, data warehouse construction, model training, and other scenarios where real-time requirements are not high. The multimodal data refers to the raw data set collected from various modal data sources, including network traffic, system logs, vulnerability data, threat intelligence (e.g., STIX / TAXII format), and business system metadata. The contaminated data refers to data contaminated by errors, noise, redundancy, incompleteness, or malicious information during the collection, transmission, or storage process. The target multimodal data refers to the relatively clean, reliable, and expected multimodal data remaining after contaminated data identification and filtering. The normalized multimodal data refers to the conversion of target multimodal data from different modalities and formats into a unified or compatible structure and format. The labeled multimodal data refers to data on which additional semantic information (labels, classifications, attributes, etc.) has been added manually (by security experts) or by automatic / semi-automatic tools on the basis of normalized data. The multimodal security data pool refers to the collection that ultimately stores multimodal security data after all the above processing steps (collection, cleaning, normalization, and labeling).

[0087] Optionally, the identification of contaminated data in the multimodal data can be achieved by deploying a GAN model at the data entry point to identify contaminated data forged by attackers (such as maliciously tampered log entries).

[0088] Optionally, the normalized multimodal data is labeled with high value, and the resulting labeled multimodal data can be automatically filtered for high-value samples by active learning for security experts to label.

[0089] Based on the data characteristics of the multimodal security data pool, this invention trains a joint extraction model for the decision-making scenario, further enhancing data mining and analysis capabilities. This enables more accurate identification of data instances and instance relationships, providing strong support for subsequent security knowledge graph construction. The data characteristics refer to…

[0090] Specifically, training the joint extraction model for the decision-making scenario includes:

[0091] Preprocess the model training data corresponding to the decision-making scenario to obtain processed model training data;

[0092] Construct the BERT model for the multimodal secure data pool, and add a BiLSTM layer to the BERT output layer corresponding to the BERT model;

[0093] A CRF layer is added after the BiLSTM layer;

[0094] The word vectors of the training data of the processing model are output using the BERT output layer corresponding to the BERT model.

[0095] Based on the word vectors, the sequence information of the model training data is captured using the BiLSTM layer corresponding to the BERT model;

[0096] The sequence information is labeled using the CRF layer corresponding to the BERT model to obtain sequence labeled data.

[0097] Define the loss function and loss function weights of the BERT model, wherein the loss function includes an entity recognition loss function, a relation classification loss function, and a modality alignment loss function;

[0098] Based on the sequence labeling data and the loss function weights, the model loss of the BERT model is calculated using the loss function to update the model parameters of the BERT model, thereby obtaining the joint extraction model for the decision-making scenario.

[0099] The model training data refers to raw multimodal security data, including historical network traffic, system logs, vulnerability data, threat intelligence (such as STIX / TAXII format), and business system metadata. The processed model training data refers to pre-processed, standardized data. The BERT model refers to a pre-trained language model based on the Transformer architecture. The BERT output layer refers to the last hidden state of BERT. The BiLSTM layer refers to a bidirectional long short-term memory network used to capture sequence dependencies. The CRF layer refers to a conditional random field used to constrain label transitions. The word vectors refer to the token-level embeddings output by BERT. The sequence information refers to the temporal features processed by BiLSTM. The sequence labeling data is... The indicators specify the entity boundaries and types. The entity recognition loss function measures the model's performance in recognizing data instances. The relationship classification loss function measures the model's performance in recognizing relationships between entities. The modality alignment loss function describes the consistency and coordination of information from different modalities (such as text, network traffic, and logs) in the multimodal data pool within the model. The loss function weights are the relative importance coefficients assigned to the three different loss terms: entity recognition loss, relationship classification loss, and modality alignment loss. The model loss is the final loss value obtained by combining the entity recognition loss, relationship classification loss, and modality alignment loss according to their respective weights. The model parameters refer to all learnable weights and biases in the model, including BERT parameters, BiLSTM weights, and the CRF transition matrix. The joint extraction model refers to the finally trained, complete model capable of simultaneously recognizing multiple data instances from text data and discovering the relationships between them.

[0100] Optionally, the preprocessing of the model training data corresponding to the decision-making scenario to obtain processed model training data includes text modality: security event description after word segmentation (e.g., "[CLS] CVE-2021-44228 vulnerability was used for RCE attack [SEP]"), numerical modality: normalized traffic feature matrix (dimension: [time step × number of features]), and graph modality: adjacency matrix of asset graph + node feature matrix.

[0101] Optionally, the loss function and loss function weights of the BERT model are defined, wherein the initial weights of the loss function weights can be 0.6 for entity recognition loss function, 0.3 for relation classification loss function, and 0.1 for modality alignment loss function, and are automatically adjusted according to the task difficulty during BERT model training.

[0102] It should be explained that the data instance refers to an instance with independent semantics extracted from multimodal security data, such as attacker, vulnerability, asset, attack technique, malicious tool, security event, etc. The instance relationship refers to the interaction behavior or logical association between entities, such as exploitation, attack, belonging, lateral movement, associated event, etc.

[0103] S2. Based on the data instances and instance relationships, construct a security knowledge graph for the scenario to be decided.

[0104] Based on the aforementioned data instances and instance relationships, this invention constructs a security knowledge graph for the decision-making scenario, enabling more accurate identification of data instances and instance relationships, thus providing strong support for subsequent security knowledge graph construction. The security knowledge graph refers to a systematic model that organizes and represents security domain knowledge using a graph structure (composed of nodes and edges). Specifically, the security knowledge graph is a knowledge graph with data instances as nodes and instance relationships as edges.

[0105] S3. Construct the attack tactics-technology-process ontology layer of the scenario to be decided, so as to calculate the potential attack paths of the scenario to be decided, and calculate the probability of occurrence of the attack path and the attack impact range of the potential attack paths.

[0106] The attack tactics-technology-process ontology layer constructed by this invention for the scenario to be decided further improves the accuracy and efficiency of attack path calculation, providing a more reliable basis for decision-making.

[0107] Specifically, the construction of the attack tactics-technology-process ontology layer for the decision-making scenario includes:

[0108] Determine the decision-making objectives for the scenario to be decided;

[0109] Based on the decision-making objectives, collect basic TTP information for the scenario to be decided.

[0110] The basic TTP information is mapped to the preset MITRE ATT&CK framework to obtain the mapped MITRE ATT&CK framework.

[0111] Define the core elements of the ontology layer for the scenario to be decided, and define the inter-class relationships and inter-class attributes of the core elements of the ontology layer;

[0112] Based on the aforementioned mapping MITRE ATT&CK framework, create a class instance of the scenario to be decided;

[0113] Based on the inter-class relationships and inter-class attributes, define the inter-instance relationships of the class instances;

[0114] Based on the class instances and the relationships between the instances, construct the attack tactics-techniques-process ontology layer for the scenario to be decided.

[0115] The decision-making construction goal refers to the specific purpose that this TTP ontology layer ultimately aims to achieve. For example, if the decision-making scenario is "the financial industry responding to ransomware attacks," then the decision-making construction goal might be: "Identify key TTPs in the financial system that may be exploited by ransomware to guide the optimization of intrusion detection system rules." The basic TTP information refers to raw, unsystematized attack tactics, techniques, and processes collected for constructing the ontology layer. For instance, in the decision-making scenario of "the financial industry responding to ransomware attacks," the basic TTP information could be publicly available data from MITRE ATT&CK regarding ransomware (such as WannaCry and Ryuk), or reports from security vendors about recent ransomware attacks against financial institutions, describing the phishing email content used by attackers, the vulnerabilities they exploited, lateral movement methods, encryption strategies, etc. The MITRE ATT&CK framework refers to a globally recognized, publicly available adversarial knowledge based on real-world observations. The base (adversary knowledge base) provides a standardized language and classification system to describe the tactics (target stages in the attack chain, such as reconnaissance and initial access) and techniques (specific methods used by attackers to achieve tactical objectives, such as phishing emails and vulnerability exploitation) of network attacks. The core elements of the ontology layer refer to the basic concept categories that constitute the TTP ontology layer, such as tactics, reconnaissance, initial access, techniques, and phishing. The inter-class relationships refer to the semantically defined connections between the core elements (classes) of the ontology layer. The inter-class attributes refer to the attributes defined on the core elements (classes) that describe the specific characteristics of instances of that class. The class instances refer to the specific objects or entities created based on the defined core elements (classes). The inter-instance relationships refer to the connections established between the specifically created class instances based on the defined inter-class relationships. The attack tactics-techniques-process ontology layer refers to the final completed knowledge structure.

[0116] Optionally, the mapping of the basic TTP information to a preset MITRE ATT&CK framework can be achieved through a technical similarity function for mapping non-standard TTPs.

[0117] The present invention calculates the potential attack paths of the scenario to be decided, which can provide a basis for subsequent attack analysis.

[0118] Specifically, calculating the potential attack paths for the scenario to be decided includes:

[0119] Analyze the security environment status of the scenario to be decided;

[0120] Based on the security environment status, determine the potential attack starting points of the scenario to be decided in the security knowledge graph;

[0121] Based on the attack tactics-technology-process ontology layer corresponding to the scenario to be decided, the reachable instance of the potential attack starting point is determined, so as to determine the path segment of the security knowledge graph;

[0122] The feasibility coefficient of the path segment is calculated based on the security environment status.

[0123] Based on the feasibility coefficient, the potential attack paths of the scenario to be decided are analyzed in the security knowledge graph.

[0124] The security environment status refers to the overall status and configuration of the network, system, application, data, and related security control measures involved in the decision-making scenario at a specific point in time. The potential attack starting point refers to a specific entity or event instance in the security knowledge graph that may be used by attackers as the initial intrusion or attack initiation point. The reachable instance refers to other related entity instances that can be traced in the security knowledge graph through a series of relationships, starting from the potential attack starting point, according to the attack behavior patterns (such as "using technology", "exploiting vulnerabilities", "gaining privileges") defined in the attack tactics-techniques-process (TTP) ontology layer. The path segment refers to a continuous, local subgraph structure in the security knowledge graph formed by a series of connected reachable instances (nodes) and their relationships (edges) starting from the potential attack starting point. The feasibility coefficient is a numerical value that quantifies the probability of a path segment being executed or successfully executed in the actual environment. The potential attack path refers to a relatively complete attack trajectory formed by connecting one or more path segments that have been evaluated by the feasibility coefficient and are considered to have high feasibility.

[0125] Optionally, the reachable instance of the potential attack starting point is determined based on the attack tactics-technology-process ontology layer corresponding to the scenario to be decided by analyzing the extension of the potential attack starting point technology to technology (technology A usually leads to or utilizes technology B), the extension of technology to process / entity, and the extension of process to technology.

[0126] The present invention calculates the probability of occurrence of the potential attack path and the scope of its impact, which can help to better analyze protection policies.

[0127] Specifically, calculating the probability of occurrence and the scope of impact of the potential attack path includes:

[0128] Analyze the CVSS baseline score, defense coverage, and attacker capability matching degree of the potential attack paths;

[0129] Based on the CVSS baseline score, defense coverage, and attacker capability matching degree, the single-step transition probability of the potential attack path is calculated;

[0130] Based on the single-step transition probability, the probability of the attack path occurring is calculated using the following formula:

[0131]

[0132] in, This represents the probability of an attack path occurring, indicating a potential attack path. Indicates the single-step transition probability. The first potential attack path One step, The first potential attack path One step, This indicates the number of steps in a potential attack path. Represents an exponential function. Indicates the causal decay factor. Indicates the strength of technological causal dependence;

[0133] Calculate the node impact coefficient of the potential attack path;

[0134] Based on the node influence coefficient, the attack impact range of the potential attack path is determined.

[0135] The CVSS baseline score refers to the baseline score of the Common Vulnerability Scoring System (CVSS), reflecting the inherent severity of the vulnerability. For example, CVE-2024-12345 has a CVSS baseline score of 8.2 (high severity), and Remote Code Execution (RCE) has a CVSS baseline score of 9.8 (critical severity). Defense coverage refers to the proportion of a step in the attack path covered by existing defense measures (such as firewalls and intrusion detection systems). For example, a firewall blocks 80% of vulnerability exploitation attempts (defense coverage 80%). Attacker capability matching refers to the attacker's skill level and ability to match the vulnerability's severity. The degree of matching between the tools and resources and a certain step in the attack path, for example, the attacker has the tools to exploit publicly known vulnerabilities (attacker capability matching degree 0.9), the single-step transition probability refers to the probability of the attacker moving from technology K to K+1, the attack path occurrence probability refers to the joint probability of the entire attack chain, the causal attenuation factor refers to the sensitivity of controlling causal influence to probability correction, which can be 1.5 in this invention, the technical causal dependence strength refers to the degree of causal influence from technology K to K+1, the node influence coefficient refers to the basic influence value of the node itself, and the attack influence range refers to the severity of the attack impact.

[0136] Optionally, the strength of the technical causal dependency can be calculated using a Bayesian network or historical data.

[0137] Further, calculating the node influence coefficient of the potential attack path includes:

[0138] Define the impact dimensions of the potential attack paths;

[0139] Based on the aforementioned impact dimensions, calculate the basic impact value of the potential attack path on the corresponding attack graph node in the security knowledge graph;

[0140] Using the aforementioned basic influence value, the node influence coefficient of the attack graph node corresponding to the potential attack path is calculated using the following formula:

[0141]

[0142] in, Indicates attack graph nodes The node influence coefficient, Indicates attack graph nodes The set of neighboring nodes, Indicates attack graph nodes The neighboring nodes, Indicates attack graph nodes The basic impact value, Indicates attack graph nodes The basic impact value, Represents an exponential function. Indicates the propagation attenuation coefficient. Indicates attack graph nodes To attack graph node The shortest path length.

[0143] The impact dimension refers to a multi-faceted assessment indicator used to quantify the damage caused to assets by an attack, including dimensions such as asset value, data sensitivity, and recovery cost. The basic impact value refers to the original impact score of a single node without considering attack propagation. The attack graph node refers to the basic unit in the attack graph. The propagation attenuation coefficient refers to the attenuation rate of the attack impact propagating between nodes. The shortest path length refers to the node in the attack graph.

[0144] The minimum number of hops from u to v.

[0145] S4. Based on the probability of the attack path and the scope of the attack, mark the policy decision points of the security knowledge graph, and use the preset PPO algorithm to analyze the Top-K policy of the policy decision points.

[0146] This invention, based on the probability of attack path occurrence and the scope of attack impact, marks the policy decision points of the security knowledge graph, providing a foundation for subsequent policy generation. Specifically, the policy decision points refer to key nodes or edges in the security knowledge graph that require the deployment of defensive measures or intervention strategies. Furthermore, the policy decision points satisfy the criteria of high attack probability, high scope of impact, and key vulnerabilities / technologies.

[0147] This invention utilizes a pre-defined PPO algorithm to analyze the Top-K strategies at the strategy decision points, providing decision-makers with more scientific and accurate strategy recommendations.

[0148] In detail, the analysis of the Top-K strategy at the strategy decision point using the preset PPO algorithm includes:

[0149] Construct candidate strategies for the strategy decision point;

[0150] Based on the PPO algorithm, construct the policy network of the candidate policies;

[0151] Generate the state-action-reward trajectory of the candidate strategy;

[0152] Calculate the action advantage value of the state-action-reward trajectory;

[0153] Based on the action advantage value, the action probability distribution of the candidate policy is generated using the policy network;

[0154] Based on the action probability distribution, the Top-K strategies of the candidate strategies are determined.

[0155] Here, the candidate strategy refers to the set of defensive measures that can be implemented for the policy decision point (PDP), which needs to cover the technical, management and physical levels. The policy network refers to the Actor network in the PPO algorithm. The state-action-reward trajectory refers to the single interaction record of the candidate strategy in reinforcement learning. The action advantage value refers to the degree of superiority or inferiority of the action relative to the average performance. The action probability distribution refers to the candidate strategy selection probability output by the policy network, reflecting the priority of each strategy in the current state. The Top-K strategy refers to the K defensive strategies selected according to the action probability distribution, where K is a preset threshold (e.g., K=3).

[0156] Optionally, the candidate strategies for constructing the policy decision point are analyzed from three aspects: technical control (disabling high-risk ports, deploying EDR, patching), management strategy (enforcing multi-factor authentication (MFA), minimizing privileges), and physical protection (upgrading access control in critical server areas), and are matched with the PDP type. For example, a node-type policy decision point → asset protection strategy, and an edge-type policy decision point → technical blocking strategy.

[0157] Optionally, the state-action-reward trajectory for generating the candidate strategy can be generated through a simulation environment: simulating attack-defense interactions based on an attack graph (such as CyberBattleSim).

[0158] S5. Construct the Top-K strategy in the attack chain analysis interface of the security knowledge graph to generate the strategy optimization parameters of the Top-K strategy, and execute the information security model to assist decision-making for the decision-making scenario based on the strategy optimization parameters.

[0159] The Top-K strategy constructed by this invention can not only intuitively display the execution process of the Top-K strategy on the attack chain analysis interface of the security knowledge graph, but also help decision-makers better understand the strategy optimization parameters, thereby more effectively implementing information security model-assisted decision-making.

[0160] Specifically, the construction of the Top-K strategy in the attack chain analysis interface of the security knowledge graph includes:

[0161] Construct a visual model of the attack chain corresponding to the potential attack paths of the security knowledge graph;

[0162] The Top-K strategy and the attack chain visual model are mapped to obtain the mapped visual model;

[0163] And construct an interactive strategy for the mapping visual model;

[0164] Based on the interactive strategy, an attack chain analysis interface for the security knowledge graph is generated, wherein the attack chain analysis interface includes attack probability change value, node impact value change value, and residual risk heat map.

[0165] The attack chain visualization model refers to a graphical representation of attack paths built on a security knowledge graph, used to intuitively display the propagation logic of potential threats. The mapping visualization model refers to an enhanced view that associates the Top-K strategy with the attack chain visualization model. The interactive strategy refers to a defense strategy control mechanism that supports dynamic user operations (such as clicking, dragging, and parameter adjustment). The attack probability change value refers to the difference in attack path probability before and after the strategy implementation. The node influence value change value refers to the reduction in node influence value after the strategy implementation. The residual risk heatmap refers to the distribution of residual risks not covered by the strategy, displayed using color gradients.

[0166] Optionally, mapping the Top-K strategy and the attack chain visual model to obtain the mapped visual model includes: node-level strategies (such as patching): overlaying strategy icons (such as shield symbols) on the target nodes corresponding to the attack chain visual model; edge-level strategies (such as blocking techniques): highlighting the associated edges corresponding to the attack chain visual model and labeling them with strategy names (such as "disable PowerShell").

[0167] Finally, this invention generates policy optimization parameters for the Top-K strategy. Executing the information security model-assisted decision-making for the decision-making scenario based on these optimization parameters can efficiently achieve information security-assisted decision-making for the scenario. The policy optimization parameters refer to the core hyperparameters and dynamically adjusted variables used to control the quality, efficiency, and adaptability of the strategy generation during the generation of the Top-K defense strategy using the PPO (Proximal Policy Optimization) algorithm. These parameters include learning rate parameters, policy pruning thresholds, discount factors, GAE parameters, batch size, etc. A high-precision Top-K strategy for the decision-making scenario is generated based on these optimization parameters.

[0168] First, by constructing a multimodal security data pool, this solution can comprehensively integrate and utilize security data from different sources, breaking the data silo dilemma in traditional decision-making and providing a more comprehensive and accurate information foundation for decision-making. The training of the joint extraction model further enhances the data mining and analysis capabilities, enabling more accurate identification of data entities and entity relationships, providing strong support for the subsequent construction of a security knowledge graph. The security knowledge graph built based on data entities and entity relationships can not only intuitively display the security situation in the decision-making scenario, but also help decision-makers to understand attack paths and potential threats more deeply. The construction of the attack tactics-technology-process ontology layer further improves the accuracy and efficiency of attack path calculation, providing a more reliable basis for decision-making. By using the PPO algorithm to analyze the candidate strategy set and calculate its semantic matching degree with the decision-making scenario, this solution can intelligently filter out the Top-K strategies, providing decision-makers with more scientific and accurate strategy suggestions. The construction of the attack chain analysis interface can not only intuitively display the execution process of the Top-K strategies, but also help decision-makers better understand the strategy optimization parameters, thereby more effectively implementing information security model-assisted decision-making. Therefore, this invention can improve the efficiency of information security decision-making in decision-making scenarios.

[0169] Example 2:

[0170] like Figure 2 The diagram shown is a functional block diagram of an information security model-assisted decision-making system based on intelligent knowledge graphs according to the present invention.

[0171] The information security model-assisted decision-making system 200 based on intelligent knowledge graph described in this invention can be installed in an electronic device. Depending on the functions implemented, the information security model-assisted decision-making system based on intelligent knowledge graph may include an extraction model construction module 201, a knowledge graph construction module 202, an attack path analysis module 203, a defense strategy generation module 204, and a security auxiliary decision-making module 205. The module described in this invention can also be referred to as a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and are stored in the memory of the electronic device.

[0172] In this embodiment of the invention, the functions of each module / unit are as follows:

[0173] The extraction model construction module 201 is used to construct a multimodal security data pool for the scenario to be decided, and train a joint extraction model for the scenario to be decided based on the data characteristics of the multimodal security data pool, so as to extract data instances and instance relationships from the multimodal security data pool.

[0174] The knowledge graph construction module 202 is used to construct a security knowledge graph for the scenario to be decided based on the data instances and instance relationships.

[0175] The attack path analysis module 203 is used to construct the attack tactics-technology-process ontology layer of the scenario to be decided, so as to calculate the potential attack paths of the scenario to be decided, and calculate the probability of occurrence of the potential attack paths and the attack impact range.

[0176] The defense strategy generation module 204 is used to mark the strategy decision points of the security knowledge graph according to the probability of the attack path and the scope of the attack, and to analyze the Top-K strategy of the strategy decision points using a preset PPO algorithm.

[0177] The security auxiliary decision-making module 205 is used to construct the Top-K strategy in the attack chain analysis interface of the security knowledge graph, generate the strategy optimization parameters of the Top-K strategy, and execute the information security model auxiliary decision-making for the scenario to be decided based on the strategy optimization parameters.

[0178] In detail, the modules in the information security model-assisted decision-making system 300 based on intelligent knowledge graphs described in this embodiment of the invention employ the same methods as described above. Figure 1 The method uses the same technical means as the information security model-assisted decision-making method based on intelligent knowledge graphs described in the article, and can produce the same technical effect, so it will not be elaborated here.

[0179] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0180] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. An intelligent knowledge graph-based information security model decision-making assistance method, characterized in that, The method includes: Construct a multimodal security data pool for the scenario to be decided, and train a joint extraction model for the scenario to be decided based on the data characteristics of the multimodal security data pool to extract data instances and instance relationships from the multimodal security data pool; Based on the data instances and instance relationships, a security knowledge graph for the scenario to be decided is constructed; Construct an attack tactics-technology-process ontology layer for the scenario to be decided, in order to calculate the potential attack paths for the scenario to be decided, and calculate the probability of occurrence and the scope of impact of the potential attack paths. Based on the probability of the attack path and the scope of the attack, the policy decision points of the security knowledge graph are marked, and the Top-K policies of the policy decision points are analyzed using a preset PPO algorithm. The Top-K strategy is constructed in the attack chain analysis interface of the security knowledge graph to generate strategy optimization parameters for the Top-K strategy, and the information security model of the decision-making scenario is executed based on the strategy optimization parameters to assist decision-making. The construction of the attack tactics-technology-process ontology layer for the scenario to be decided includes: Determine the decision-making objectives for the scenario to be decided; Based on the decision-making objectives, collect basic TTP information for the scenario to be decided. The basic TTP information is mapped to the preset MITRE ATT&CK framework to obtain the mapped MITRE ATT&CK framework. Define the core elements of the ontology layer for the scenario to be decided, and define the inter-class relationships and inter-class attributes of the core elements of the ontology layer; Based on the aforementioned mapping MITRE ATT&CK framework, create a class instance of the scenario to be decided; Based on the inter-class relationships and inter-class attributes, define the inter-instance relationships of the class instances; Based on the class instances and the relationships between the instances, construct the attack tactics-techniques-process ontology layer for the scenario to be decided; The calculation of potential attack paths for the scenario to be decided includes: Analyze the security environment status of the scenario to be decided; Based on the security environment status, determine the potential attack starting points of the scenario to be decided in the security knowledge graph; Based on the attack tactics-technology-process ontology layer corresponding to the scenario to be decided, the reachable instance of the potential attack starting point is determined, so as to determine the path segment of the security knowledge graph; The feasibility coefficient of the path segment is calculated based on the security environment status. Based on the feasibility coefficient, the potential attack paths of the scenario to be decided are analyzed in the security knowledge graph. 2.The smart knowledge graph-based information security model aided decision-making method of claim 1, wherein, The construction of the multimodal security data pool for the decision-making scenario includes: Identify the multimodal data source for the scenario to be decided; Construct a real-time / offline acquisition architecture for the multimodal data source to collect multimodal data of the scenario to be decided; Identify contaminated data in the multimodal data to filter the multimodal data and obtain target multimodal data; The target multimodal data is normalized to obtain normalized multimodal data; High-value annotations are performed on the normalized multimodal data to obtain annotated multimodal data; The labeled multimodal data is stored to obtain a multimodal security data pool for the scenario to be decided. 3.The smart knowledge graph-based information security model aided decision-making method of claim 2, characterized in that, The training of the joint extraction model for the decision-making scenario includes: Preprocess the model training data corresponding to the decision-making scenario to obtain processed model training data; Construct the BERT model for the multimodal secure data pool, and add a BiLSTM layer to the BERT output layer corresponding to the BERT model; A CRF layer is added after the BiLSTM layer; The word vectors of the training data of the processing model are output using the BERT output layer corresponding to the BERT model. Based on the word vectors, the sequence information of the model training data is captured using the BiLSTM layer corresponding to the BERT model; The sequence information is labeled using the CRF layer corresponding to the BERT model to obtain sequence labeled data. Define the loss function and loss function weights of the BERT model, wherein the loss function includes an entity recognition loss function, a relation classification loss function, and a modality alignment loss function; Based on the sequence labeling data and the loss function weights, the model loss of the BERT model is calculated using the loss function to update the model parameters of the BERT model, thereby obtaining the joint extraction model for the decision-making scenario. 4.The smart knowledge graph-based information security model aided decision-making method of claim 1, wherein, The calculation of the probability of occurrence and the scope of impact of the potential attack path includes: Analyze the CVSS baseline score, defense coverage, and attacker capability matching degree of the potential attack paths; Based on the CVSS baseline score, defense coverage, and attacker capability matching degree, the single-step transition probability of the potential attack path is calculated; Based on the single-step transition probability, the probability of the attack path occurring is calculated. Calculate the node impact coefficient of the potential attack path; Based on the node influence coefficient, the attack impact range of the potential attack path is determined. 5.The smart knowledge graph-based information security model aided decision-making method of claim 4, characterized in that, The calculation of the node influence coefficient of the potential attack path includes: Define the impact dimensions of the potential attack paths; Based on the aforementioned impact dimensions, calculate the basic impact value of the potential attack path on the corresponding attack graph node in the security knowledge graph; The node influence coefficient of the attack graph node corresponding to the potential attack path is calculated using the basic influence value. 6.The smart knowledge graph-based information security model aided decision-making method of claim 1, wherein, The analysis of the Top-K strategy at the strategy decision point using a preset PPO algorithm includes: Construct candidate strategies for the strategy decision point; Based on the PPO algorithm, construct the policy network of the candidate policies; Generate the state-action-reward trajectory of the candidate strategy; Calculate the action advantage value of the state-action-reward trajectory; Based on the action advantage value, the action probability distribution of the candidate policy is generated using the policy network; Based on the action probability distribution, the Top-K strategies of the candidate strategies are determined. 7.The smart knowledge graph-based information security model aided decision-making method of claim 1, wherein, The construction of the Top-K strategy in the attack chain analysis interface of the security knowledge graph includes: Construct a visual model of the attack chain corresponding to the potential attack paths of the security knowledge graph; The Top-K strategy and the attack chain visual model are mapped to obtain the mapped visual model; And construct an interactive strategy for the mapping visual model; Based on the interactive strategy, an attack chain analysis interface for the security knowledge graph is generated, wherein the attack chain analysis interface includes attack probability change value, node impact value change value, and residual risk heat map.

8. An intelligent knowledge graph-based information security model aided decision system, which is realized based on the method of claim 1, characterized in that, The system includes: An extraction model building module is used to construct a multimodal security data pool for the scenario to be decided. Based on the data characteristics of the multimodal security data pool, a joint extraction model for the scenario to be decided is trained to extract data instances and instance relationships from the multimodal security data pool. The knowledge graph construction module is used to construct a security knowledge graph for the decision-making scenario based on the data instances and instance relationships. The attack path analysis module is used to construct the attack tactics-technology-process ontology layer of the scenario to be decided, to calculate the potential attack paths of the scenario to be decided, and to calculate the probability of occurrence and the scope of impact of the potential attack paths. The defense strategy generation module is used to mark the strategy decision points of the security knowledge graph according to the probability of the attack path and the scope of the attack, and to analyze the Top-K strategy of the strategy decision points using a preset PPO algorithm. The security auxiliary decision-making module is used to construct the Top-K strategy on the attack chain analysis interface of the security knowledge graph, generate the strategy optimization parameters of the Top-K strategy, and execute the information security model auxiliary decision-making for the scenario to be decided based on the strategy optimization parameters.

Images