A subgraph reasoning method fusing logical rule learning and attack semantic enhancement

Abstract

The application discloses a subgraph reasoning method fusing logic rule learning and attack semantic enhancement, which comprises an input layer, a dynamic integration of a knowledge graph topology and an AMIE rule base, and generation of an initial k-hop subgraph to provide a structured input for attack chain mining; a subgraph extraction module, which performs double confidence filtering, filters high-value attack chains and applies dictionary filtering to enhance semantic reliability; a subgraph coding module, which adopts an entity perception updating layer and a relationship aggregation evolution layer of a double-path mechanism to collaboratively model the space-time features of the attack chain; a relationship reasoning optimization module, which dynamically injects high-confidence rules to optimize the triple score; and a training optimization module, which implements task-aware negative sampling. The application adopts the above subgraph reasoning method fusing logic rule learning and attack semantic enhancement, is based on inductive reasoning and semantic perception modeling, takes logic path guided subgraph modeling as the core, mines high-confidence attack chain rules in the training graph, and improves the model structure understanding ability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a subgraph reasoning method fusing logical rule learning and attack semantic enhancement. BACKGROUND

[0002] In the field of network security, a knowledge graph (KG) provides a basic support for automatic reasoning in complex fields through structured modeling of entities and their relationships. However, due to the high dynamicity (such as 0-day vulnerabilities, new malicious traffic) and behavior diversity (such as DDoS, phishing, APT) of network attacks, network security knowledge graphs generally have problems such as sparse structure and heterogeneous relationships. These problems make it difficult for traditional graph neural networks (GNN) to effectively propagate graph signals on such graphs, limiting their performance in key tasks such as link prediction.

[0003] In the face of a graph environment that is constantly changing in structure, subgraph reasoning methods are widely used in dynamic knowledge graph modeling due to their good inductive ability and scalability. It can make predictions based only on the local structure related to the query, without the need for global model updates, thereby overcoming the cost problem caused by frequent updates of traditional direct inference methods (such as TransE, RotatE).

[0004] However, the application of existing subgraph reasoning methods in the field of network security still has significant limitations: on the one hand, logical rule paths in attack chains are not introduced to guide subgraph construction, and the inductive ability is insufficient; on the other hand, the semantic characteristics of attack behavior are ignored, making it difficult for the model to focus on key paths and affecting the reasoning accuracy. SUMMARY

[0005] The purpose of the present application is to provide a subgraph reasoning method fusing logical rule learning and attack semantic enhancement, by constructing a security-aware inductive graph reasoning model - SecGIRF (Security-aware Graph Inductive Reasoning Framework), innovatively combining domain knowledge-driven inductive reasoning and semantic-aware modeling, taking logical path-guided subgraph modeling as the core, mining high-confidence attack chain rules in the training graph, and improving the model's structural understanding ability. At the same time, an information entropy negative sampling strategy driven by attack type priority is introduced to enhance the relevance of the training graph and attack semantics, thereby alleviating the sparsity problem. In the design of the model, the SecGIRF model combines path-weighted multi-head attention mechanism and semantic-aware encoding network to further strengthen the modeling ability and semantic expression of key attack chains.

[0006] To achieve the above object, the application provides a subgraph reasoning method fusing logical rule learning and attack semantic enhancement, and a SecGIRF model is constructed and contains five modules: an input layer, a subgraph extraction module, a subgraph coding module, a relation reasoning optimization module and a training optimization module.

[0007] The input layer dynamically integrates a knowledge graph topology and an AMIE rule base to generate an initial k-hop subgraph, thereby providing a structured input for attack chain mining.

[0008] The subgraph extraction module performs double confidence filtering to screen high-value attack chains and applies dictionary filtering to enhance semantic reliability.

[0009] The subgraph coding module adopts a double-path mechanism, the entity perception update layer iteratively optimizes node representation through path perception attention and target relation perception attention, the relation aggregation evolution layer generates high-order semantic representation through a φ function to fuse multiple source relations, and the temporal and spatial features of attack chains are cooperatively modeled.

[0010] The relation reasoning optimization module dynamically injects high-confidence rules to optimize triple scoring.

[0011] The training optimization module implements task-aware negative sampling.

[0012] Preferably, in the subgraph extraction module, a multi-hop path is modeled by means of a Horn rule form in first-order logic FOL, wherein the Horn rule is as follows:

[0013] ;

[0014] wherein, is the initiating step of the attack chain, which is the first relation in the rule body and describes the initial action of the attack; is the second relation in the rule body and describes how the attacker or the exploited entity propagates the attack to the next intermediate entity after the first step; is the final step of the attack, which is the last item of the rule body and connects the last intermediate entity and the final attack target; is the target relation; the rule body represents a multi-hop path between entity and entity , and the rule head represents the target relation .

[0015] In the rule generation stage, based on the classical logic induction method AMIE, rules are generated through frequent relation path mining and confidence calculation; wherein each rule is represented in the form of a triple path pattern, as follows:

[0016] ;

[0017] wherein, and is the relation, describing the reasoning path; is the predicate in the rule head, characterizing the target relation about the entity ; is the identifier of the whole rule, used to uniquely mark a logical rule;

[0018] The generated rules are filtered, and the frequent relation paths with the confidence threshold are reserved.

[0019] Preferably, after the confidence rules are filtered, the rules are weighted; for each path , the number of occurrences in the positive samples and the number of occurrences in the whole samples are counted, and the attack probability is defined as follows:

[0020] ;

[0021] wherein, is the smoothing factor, used to alleviate the statistical deviation of the low-frequency path; according to the frequency and the attack probability, the weight of the path is calculated as follows:

[0022] ;

[0023] wherein, is the frequency of the path in the training set, reflecting the importance of the path.

[0024] Preferably, based on the filtered rules and the calculated weights, a subgraph is constructed, and a k-hop subgraph is extracted around the target triple , with the head entity and the tail entity as the center; starting from and , respectively, the entity's adjacent node set and are obtained by expanding outward for steps, as follows:

[0025] ;

[0026] ;

[0027] wherein, is the shortest path distance; is the number of hops for subgraph extraction; is the candidate relation; ​

[0028] By the intersection operation of the and adjacency set, the common node set is obtained , and the subgraph centered on and is constructed As follows:

[0029] ;

[0030] ;

[0031] ;

[0032] wherein, is the node set; is the edge set; , is any two nodes in the subgraph;

[0033] After the subgraph is constructed, the selected rule path is injected into the edge set to form the final subgraph, as follows:

[0034] ;

[0035] ;

[0036] wherein, is the basic topology edge set; is the selected rule path set; is the weight threshold; is the final edge set; is the final weighted subgraph constructed around the target node; is a weight mapping function or a weight set acting on the entire final subgraph .

[0037] Preferably, the SecGIRF model introduces a subgraph encoding dual-channel mechanism in the subgraph encoding stage, including an entity awareness update layer and a relationship aggregation evolution layer.

[0038] The entity awareness update layer updates the entity representation by fusing the rule path and the task semantics through path awareness attention and target relationship awareness attention.

[0039] The relationship aggregation evolution layer integrates multi-hop relationships through the φ function, and fuses neighbor entity states to evolve nodes through gated output, forming a closed loop collaboration.

[0040] Preferably, in the initialization encoding, a double radius node labeling (DRNL) strategy is adopted, which calculates the distance between the node and the head entity and the tail entity The shortest path distance of the subgraph, mark the nodes so that the mark value of each node reflects its relative position in the subgraph, providing structural information for model learning; the node marking formula is as follows:

[0041] ;

[0042] wherein, is the double-radius mark value of the node ; is any one node in the subgraph;

[0043] To further capture the high-order semantic context of the target triplets in the graph, a context graph is constructed, whose nodes include entities, relationships and connections and confidence rule paths;

[0044] After the context graph is built, the nodes are embedded and updated using a graph convolution network to model their high-order interactions; a multi-dimensional interaction encoding function is introduced to combine and model the features of any pair of context nodes , as follows:

[0045] ;

[0046] wherein, is the interaction feature vector of the node pair ; , is the vector representation of the nodes in the context graph; is the vector concatenation operation; and model the difference and similarity, respectively.

[0047] Preferably, in the structure encoding process, a target relationship-based attention mechanism is introduced; the attention weight of each edge in the subgraph is as follows:

[0048] ;

[0049] wherein, , are the initial feature vectors; is the target relationship embedding vector; , are the vector representations after linear transformation of the point features; is the linear transformation vector of the target relationship features; and are trainable parameters; is the transpose of ; is the activation function;

[0050] Further capture potential path dependency in subgraph, sort each node to entity and distance, construct node sequence, and only sort filtered rule path nodes in attack chain order, extract time sequence features through BiGRU, thereby supplementing sequence information difficult to explicitly model in static structure.

[0051] Preferably, in the feature fusion stage, the spliced features are processed through an MLP network to fuse multi-source information, including node initialized label features, relationship aware attention embedding, and path level BiGRU sequence features; feature fusion is as follows:

[0052] ;

[0053] wherein, is the final feature representation of node ; is the representation of the context graph node; is the representation of the node sequence; is a multi-layer perceptron;

[0054] In the feedforward network design after feature fusion, a feedforward network with a three-layer expansion-constriction structure is adopted to capture the nonlinear structural features in the subgraph, as follows:

[0055] ;

[0056] wherein, is the updated representation of node ; represents a nonlinear activation function; is the set of adjacent nodes of node ; is the index of all neighbors of node i;

[0057] In the graph aggregation stage, an attention mechanism based on the target relationship is adopted to adjust the aggregation weight of each edge , as follows:

[0058] ;

[0059] wherein, is the normalized attention weight, representing the influence strength of neighbor on node ; is an activation function; is a linear mapping vector of the target relationship ; is a node Any neighboring node;

[0060] The final node is represented as:

[0061] ;

[0062] in, For nodes The final aggregate representation; For neighboring nodes The representation after processing by the MLP network; It is a multilayer perceptron used for feature transformation.

[0063] Preferably, in the relational reasoning optimization module, the SecGIRF model introduces a multi-granularity semantic fusion mechanism during the reasoning phase, combining structural context, rule paths, and task semantic information to achieve model-based optimization of reasoning performance. The specific process is as follows:

[0064] First, at the structural level, obtain the node representation { }, and combined with rule path embedding , to obtain fusion representation As shown below:

[0065] ;

[0066] Through aggregate functions The node features are summarized to construct a subgraph structure representation, as shown below:

[0067] ;

[0068] in, Represented as a subgraph structure;

[0069] Then, at the semantic level, a context graph is introduced to model the rule path semantics and relational context of the target triples in the knowledge graph; the target entity... Candidate Relationship and its semantic interaction feature input feature combination function As shown below:

[0070] ;

[0071] in, Represents candidate relation; function The impact of candidate relations on semantic interaction is clearly expressed; This is a vector concatenation operation;

[0072] Finally, a dual-pathway relationship scoring function is used to achieve joint structure-semantic optimization, as shown below:

[0073] ;

[0074] wherein, is the final prediction score of the target triple; is a learnable weight matrix for the subgraph structure representation; is a learnable weight matrix for the semantic feature; and are learnable parameters; is a nonlinear activation function, used to fuse the matching strength of the structural context and the semantic path to the target relation;

[0075] In addition, at the logical level, the SecGIRF model introduces a rule consistency optimization mechanism; for the automatically mined Horn rules in the training set , if a path matches the rule body, the rule is enhanced for the corresponding relation scoring, as follows:

[0076] ;

[0077] wherein, is the relation score adjusted under logical constraints; is the degree of influence of the control rule path on the reasoning result; represents whether there is a rule path matching, taking values of 0 or 1, and is 1 when and only when there is a path between the entity pair that completely matches a certain rule body; is 0 when there is no path that meets the matching conditions; represents the assignment;

[0078] In the training phase, the multi-objective loss function is jointly optimized, including the relation classification loss and the logical consistency constraint, as follows:

[0079] ;

[0080] wherein, is the cross-entropy loss; is the logical consistency loss, used to encourage the model to make consistent reasoning under the logical rule constraint, and used to encourage the model to make consistent reasoning judgments under the logical rule; is a weight hyperparameter.

[0081] Preferably, in the training optimization module, the design is carried out around three aspects of negative sampling mechanism, loss function and optimization strategy, and the specific implementation process is as follows:

[0082] Firstly, in the negative sampling strategy, the task-aware negative sampling method based on attack semantic category is used to enhance the relevance of negative samples in the semantic space by assigning different sampling weights to different attack types, and to improve the discrimination ability of attack types. The sampling probability is defined as:

[0083]

[0084]

[0085] Then, in the loss function construction, a multi-task joint loss function is used. The main task loss is the binary cross entropy based on negative sampling, which is used to supervise the triple relationship classification. The auxiliary task loss is based on the pseudo label generated by the logical rule path, and the consistency constraint is applied to the subgraph that meets the high confidence path. The two are combined in a weighted form to construct the overall loss function

[0086]

[0087]

[0088] Finally, in the training scheduling and parameter optimization, the AdamW optimizer is used, combined with the weight decay mechanism to suppress overfitting. Gradient clipping and L2 regularization control are introduced to prevent gradient explosion.

[0089] Therefore, the subgraph reasoning method fusing logical rule learning and attack semantic enhancement is used to fuse logical rule guidance and attack semantic enhancement, and to improve the reasoning ability of the network security knowledge graph in complex attack scenarios. The rule path injection mechanism based on attack probability weighting is introduced to effectively alleviate the structure sparsity problem. The task-aware negative sampling strategy and multi-head attention mechanism are designed to improve the modeling accuracy of the model for heterogeneous attack paths. Combined with the logical consistency optimization method, zero-sample generalization reasoning for new threat relationships is realized.

[0090] The technical solutions of the present application will be further described in detail below with the help of the accompanying drawings and examples. BRIEF DESCRIPTION OF DRAWINGS

[0091] Figure 1 ​​​​​​​​​​​​​This is a diagram of the SecGIRF model architecture constructed by a subgraph reasoning method that integrates logical rule learning and attack semantic enhancement according to the present invention.

[0092] Figure 2 This is a diagram of a dual-path spatiotemporal collaborative coding architecture;

[0093] Figure 3 This is a flowchart of the subgraph (SG) and context graph (CG) processing of the present invention;

[0094] Figure 4 This is a diagram showing the interpretability verification results of the rule header-rule body embedding space of this invention. Detailed Implementation

[0095] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0096] Example 1

[0097] like Figure 1 As shown, this invention presents a subgraph reasoning method that integrates logical rule learning and attack semantic enhancement to construct a security-aware inductive graph reasoning model—SecGIRF (Security-aware Graph Inductive Reasoning Framework), which includes five modules: input layer, subgraph extraction module, subgraph encoding module, relation reasoning optimization module, and training optimization module.

[0098] The input layer dynamically integrates the knowledge graph topology and the AMIE rule base to generate an initial k-hop subgraph, providing structured input for attack chain mining.

[0099] The subgraph extraction module performs double-reset confidence filtering (rule path confidence). And attack probability ), screen high-value attack chains and apply dictionary filtering to enhance semantic reliability.

[0100] The subgraph encoding module adopts a dual-path mechanism. The entity perception update layer iteratively optimizes the node representation through path perception attention and target relationship perception attention, while the relationship aggregation and evolution layer generates a high-order semantic representation by fusing multi-source relationships through the φ function. The two work together to model the spatiotemporal features of the attack chain.

[0101] The relational reasoning optimization module dynamically injects high-confidence rules to optimize triple scoring.

[0102] The training optimization module implements task-aware negative sampling to improve noise robustness.

[0103] The five modules form a closed-loop architecture of rule-driven → spatiotemporal coding → dynamic feedback, which improves the real-time threat identification capability.

[0104] I. Subgraph Extraction Module.

[0105] In inductive knowledge graph reasoning, local subgraphs are widely used to characterize the contextual relationships between entities. To improve the model's ability to logically model structural relationships, multi-hop paths are modeled using the Horn Rule from First-order Logic (FOL). The Horn Rule is as follows:

[0106] ;

[0107] in, This is the first relationship in the rule body that initiates the attack chain, describing the initial actions of the attack. The second relationship in the rule body describes how, after the first step, the attacker or the exploited entity propagates the attack to the next intermediate entity; This is the final step in the attack, the last item in the rule body, connecting the last intermediate entity and the final attack target; For target relationships; the rule body represents the relationship from the entity. To the entity The rule header represents the target relationship in the multi-hop path between them. .

[0108] This structure can be transformed into a relational path consisting only of relation sequences in a knowledge graph, exhibiting good interpretability and generalization ability. Compared to directly embedding and modeling entity pairs, the relational path-based representation can more accurately capture the underlying semantic logic between entities.

[0109] In the rule generation phase, high-quality rules are generated based on the classic logical induction method (Association Rule Mining Inference Engine, AMIE) through frequent relation path mining and confidence calculation. Each rule is represented by a triplet path pattern, as shown below:

[0110] ;

[0111] in, and Describe the reasoning path for the relationship; The predicates in the rule header describe the entities. Target relationship (e.g., " "has a certain attribute / state" or " (Able to reach a certain inference conclusion); in knowledge graph reasoning... It typically represents the target relationship pattern derived from the rule body; An identifier for the entire rule, used to uniquely identify a logical rule; different Different rule instances correspond to different rules.

[0112] The generated rules are filtered, retaining those with high confidence (threshold). The frequent relationship paths are identified. Only high-confidence rules that pass the screening are used in subsequent subgraph construction. This screening process ensures the reliability of the rules and provides a valid reasoning basis for the subsequent model.

[0113] After selecting high-confidence rules, these rules are weighted. The weight of each path reflects its correlation with the attack behavior. For each path... Count the number of times it appears in the positive sample. Number of occurrences in the entire sample Define attack probability As shown below:

[0114] ;

[0115] in, This is a smoothing factor used to mitigate statistical bias in low-frequency paths. If a path never appears, a default probability is assigned. As a cold start mechanism; only retain The path, where the attack probability threshold .

[0116] Based on the aforementioned frequency and attack probability, calculate the path. weight As shown below:

[0117] ;

[0118] in, Representing a path The frequency of occurrence of a path in the training set reflects its importance within the overall data. The resulting path weights will play a crucial role in subgraph construction and inference, enhancing the model's ability to focus on critical paths.

[0119] Based on the filtered rules and calculated weights, the subgraph is constructed. This involves building around the target triplet. , with head entity Tail-end entity K-hop subgraph extraction is performed centered on [the target element]. and Starting from there, they expanded outwards respectively. Step 1, obtain the set of adjacent nodes of the entity. and As shown below:

[0120] ;

[0121] ;

[0122] wherein, is the shortest path distance; is the hop count of subgraph extraction; is the candidate relationship.

[0123] By intersection operation on the two adjacency sets, the common node set is obtained and is constructed as the core of the subgraph , as shown below:

[0124] ;

[0125] ;

[0126] ;

[0127] wherein, is the node set; is the edge set; , is any two nodes (entities) in the subgraph.

[0128] At this time, a basic topology structure is constructed with and as the core.

[0129] After the subgraph is constructed, the selected rule path is injected into the edge set to form the final subgraph, as shown below:

[0130] ;

[0131]

[0132] wherein, is the basic topology edge set; is the selected rule path set; is the weight threshold value; is the final edge set; is the final constructed weighted subgraph around the target node; is a weight mapping function or a weight set acting on the entire final subgraph ; the final subgraph contains the basic topology structure and the rule path with high attack relevance, providing high-quality input for subsequent coding.

[0133] II. Subgraph encoding module.

[0134] To improve the model's ability to distinguish local structures, the SecGIRF model introduces a multi-mechanism of structure perception, semantic perception, and task perception in the subgraph encoding stage. The core dual-path architecture is shown in Figure 2

[0135] The left entity perception update module updates the entity representation by integrating the rule path and task semantics through path perception attention (generating weight ) and target relationship perception attention (generating ).

[0136] The right relationship aggregation evolution module integrates multi-hop relationships and fuses neighbor entity states to evolve nodes through gated output , forming a closed-loop collaboration between the two modules.

[0137] When initializing and encoding the nodes, the Double-Radius Node Labeling (DRNL) strategy is used. This strategy labels the nodes by calculating the shortest path distance from the head entity and the tail entity , so that the label value of each node reflects its relative position in the subgraph, providing structural information that helps the model learn. The node labeling formula is as follows:

[0138] ;

[0139] where is the double-radius label value of node ; is any node in the subgraph.

[0140] To further capture the high-order semantic context of the target triple in the graph, a context graph is constructed. The nodes of the context graph include entities, relationships, and high-confidence rule paths connecting and ; where the edges represent semantic association relationships such as co-occurrence frequency and path inclusion relationship.

[0141] After the context graph is built, graph convolutional networks (GCN) are used to update the embedding of the nodes and model their high-order interactions. To improve the expressive ability of context modeling, a multi-dimensional interaction encoding function is further introduced to combine and model the features of any pair of context nodes , as shown below: ​​​

[0142] ;

[0143] wherein, is the interaction feature vector of the node pair ; , is the vector representation of the node in the context graph; is the vector concatenation operation; and respectively model the difference and similarity, which helps to enhance the discriminative ability of relationship semantics.

[0144] In the structure encoding process, a target relationship-based attention mechanism is introduced. The attention weight of each edge in the subgraph not only depends on the features of its two end nodes, but also introduces the embedding vector of the target relationship to participate in the calculation, emphasizing the structural pattern related to the current reasoning task. The attention weight , as follows:

[0145] ;

[0146] wherein, , is the initial feature vector; is the target relationship embedding vector; , is the vector representation after linear transformation of the point feature; is the linearly transformed vector of the target relationship feature; and are trainable parameters; is the transpose of ; is the activation function.

[0147] Further capture the potential path-dependent relationship in the subgraph, according to the distance of each node to the entity and , construct the node sequence, and only sort the filtered rule path nodes in the attack chain order, extract the time sequence features through BiGRU, so as to supplement the sequence information that is difficult to be explicitly modeled in the static structure.

[0148] In the feature fusion stage, the concatenated features are processed through the MLP network, so as to fuse multiple source information, including the labeled features of node initialization, the attention embedding of relationship perception, and the BiGRU sequence features at the path level. Feature fusion, as follows:

[0149] ;

[0150] wherein, is the final feature representation of the node ; is the representation of the context graph node; is the representation of the node sequence; is the multi-layer perceptron.

[0151] In the design of the post-feature fusion feedforward network, a three-layer expansion-contraction structure of the feedforward network is adopted to capture the nonlinear structural features in the subgraph; where, is the dimension of the input node feature. This structure helps to improve the modeling ability of the model for local complex relationships, thereby effectively processing multi-hop paths and high-order semantic information, as follows:

[0152] ;

[0153] where, is the updated representation of the node ; represents a nonlinear activation function; is the set of adjacent nodes of the node ; is the index of all neighbors of node i.

[0154] is introduced to introduce task information, and a target relationship-based attention mechanism is adopted in the graph aggregation stage to adjust the aggregation weight of each edge , as follows:

[0155] ;

[0156] where, is the normalized attention weight, representing the influence strength of neighbor on node ; is an activation function; is a linear mapping vector of the target relationship embedding vector; is any neighbor node of node .

[0157] The final node representation is:

[0158] ;

[0159] where, is the final aggregated representation of node ; is the representation of the neighbor node after the MLP network processing; is the multi-layer perceptron used for feature conversion.

[0160] Finally, the node representation is fused with three types of information: structural markers, relation-aware attentional embeddings, contextual semantic features, and path features, thus generating a discriminative representation of the triple structural context and providing stronger representation support for the relation prediction task. Figure 3

[0161] III. Relation reasoning optimization module.

[0162] To improve the model's ability to discriminate the relationship of the target triple , the SecGIRF model introduces a multi-granularity semantic fusion mechanism in the reasoning phase, combining structural context, rule path, and task semantic information to optimize the model's reasoning performance.

[0163] First, at the structural level, based on the envelope subgraph described in the previous section, the node representation is obtained, and combined with the rule path embedding to obtain the fused representation , as shown below:

[0164] ;

[0165] The node features are aggregated by the aggregation function to construct the subgraph structure representation, as shown below:

[0166] ;

[0167] where is the subgraph structure representation.

[0168] Then, at the semantic level, the context graph is further introduced to model the rule path semantics and relationship context of the target triple in the knowledge graph. The semantic interaction features of the target entities , candidate relations are input into the feature combination function , as shown below:

[0169] ;

[0170] where represents the candidate relation; the function explicitly expresses the influence of the candidate relation on the semantic interaction; is the vector concatenation operation. This function takes into account the differences and similarities between entity pairs, enhancing the discriminative ability of the relationship semantics.

[0171] Finally, to achieve structural-semantic joint optimization, a dual-path relation scoring function is used, as shown below:

[0172] ; ​

[0173] where, is the final prediction score of the target triple; is the learnable weight matrix (for subgraph structure representation); is the learnable weight matrix (for semantic feature); and are learnable parameters; is a nonlinear activation function, used to fuse the matching strength of structure context and semantic path to the target relation.

[0174] In addition, at the logical level, the SecGIRF model introduces a rule consistency optimization mechanism. For the high-confidence Horn rules automatically mined in the training set , if a path matches the rule body, the rule enhancement is performed on the corresponding relation scoring, as follows:

[0175] ;

[0176] where, is the relation score adjusted under logical constraints; is the degree of influence of the rule path on the reasoning result; represents whether there is a rule path matching, taking the value of 0 or 1, and is 1 when and only when there is a path that completely matches the rule between the entity pair ; is 0 when there is no path that meets the matching conditions; represents the assignment.

[0177] In the training phase, the multi-objective loss function is jointly optimized, including the relation classification loss and the logical consistency constraint, as follows:

[0178] ;

[0179] where, is the cross-entropy loss; is the logical consistency loss, used to encourage the model to make consistent reasoning under logical rule constraints, and used to encourage the model to make consistent reasoning judgments under logical rules; is the weight hyperparameter. Through structure representation enhancement, context path modeling, and rule consistency guidance, the SecGIRF model significantly improves the model's inductive and generalization ability for complex relations, especially for the sparse, heterogeneous, and rule-driven knowledge graph scenarios in network security tasks.

[0180] Four, training optimization module.

[0181] In the training process, the task characteristics and logical induction requirements in the network security graph are fully combined, and the design is carried out around three aspects of negative sampling mechanism, loss function construction and optimization strategy to improve the training efficiency and model generalization ability.

[0182] Firstly, in the negative sampling strategy, for the problem of uneven distribution of attack entities and significant long-tail phenomenon in the security graph, the task-aware negative sampling method based on attack semantic categories is used. By assigning different sampling weights to different attack types, the relevance of negative samples in the semantic space is enhanced, thereby improving the discrimination ability of attack types and helping to enhance the discriminability of training signals. Specifically, the sampling probability is defined as:

[0183] ;

[0184] wherein, represents the frequency of occurrence of attack types; is the attack category label space; is the attack type of the sample ; is the sample sampling probability.

[0185] In addition, a filtering mechanism based on head-tail entity relationship dictionary (i.e. and ) is introduced to effectively avoid potential positive examples and improve the quality of negative samples.

[0186] Then, in the construction of the loss function, a multi-task joint loss function is used to balance the structure accuracy and rule consistency. The main task loss is the binary cross-entropy based on negative sampling, which is used to supervise the triple relationship classification. The auxiliary task loss is based on the pseudo-label generated by the logical rule path, which imposes consistency constraints on the subgraph that meets the high-confidence path. The two are combined in a weighted form to construct the overall loss function , as shown below:

[0187] ;

[0188] wherein, represents the main task loss based on the structure score; represents the consistency loss based on the rule path score; is the weight coefficient.

[0189] Finally, in terms of training scheduling and parameter optimization, the model uses the AdamW optimizer combined with the weight decay mechanism to effectively suppress overfitting. The learning rate scheduling strategy ReduceLROnPlateau dynamically adjusts the learning rate according to the training progress to ensure model convergence. By introducing gradient clipping and L2 regularization control, gradient explosion is prevented, further improving the generalization ability. In addition, all parameters are initialized using Xavier to ensure stability in the early stages of training.

[0190] Example 2

[0191] 1. Dataset and evaluation metrics.

[0192] Predicting network threats from security-related public data is an emerging research field, and there is currently no publicly available dataset to evaluate the models proposed by the present invention. Therefore, this embodiment constructs the AttackKG dataset to provide a comprehensive and structured knowledge graph for the network threat prediction task. The dataset collects more than 5800 network threat data, containing a total of 19410 structured triples, expressing various types of association information in security incidents in the form of "head entity-relation-tail entity". The main sources of this dataset can be divided into the following two categories:

[0193] (1) Network data collection: A large number of vulnerability description texts were extracted from the CNNVD (China National Information Security Vulnerability Sharing Platform) website through an automated crawler system, and 5015 sentences related to attacks and vulnerabilities were randomly selected from them to construct the initial corpus. These data cover various security threat scenarios, such as buffer overflow, remote execution, privilege escalation, and other attack descriptions. Subsequently, the corpus was manually annotated according to a pre-defined annotation strategy to ensure the accuracy and semantic consistency of the data.

[0194] (2) Security information integration: Further integrate structured vulnerability and attack information from multiple mainstream security databases (including CVE, NVD, CWE, CPAEC, and ATT&CK framework) as supplementary fields to the triples corresponding to the annotated texts. This integration process enhances the professionalism and information density of the dataset, making it not only cover attack techniques and tools, but also include attack targets, path relationships, and other contextual information.

[0195] This dataset contains 6 main entity types (attack type, domain name, host, IP address, tool, and vulnerability) and 7 relationship types (such as exploits, uses_tool, resolves_to, etc.), with more than 2000 entities and more than 600 relationship types. It comprehensively covers the key elements and causal links commonly seen in network attack activities, and the entity type and its quantity statistics are shown in Table 1.

[0196] Table 1 Entity type and its quantity statistics of AttackKG dataset

[0197] ;

[0198] To ensure the accuracy of model training and evaluation, the dataset is divided into three versions (V1, V2, V3) according to the GraiL's time series principle, each version containing independent training, validation and test sets, with a division ratio of 6:2:2. The data distribution and entity relationships in each version are different to evaluate the model's generalization ability in different scenarios, especially its ability to adapt to unknown data and new attack types, as shown in Table 2.

[0199] Table 2 AttackKG multi-version benchmark set division statistics

[0200] ;

[0201] In this embodiment, in order to comprehensively and objectively evaluate the performance of the model in the knowledge graph reasoning and relationship prediction task, two types of mainstream evaluation indicators are used: AUC (Area Under Curve) and Ranking indicators.

[0202] AUC (Area Under Curve) is an important indicator for measuring the discriminant ability of a binary classification model, and is widely used in tasks such as link prediction and anomaly detection in knowledge graphs. The AUC value ranges from 0 to 1, and its physical meaning is: randomly select a positive sample and a negative sample, and the probability that the model will rank the positive sample before the negative sample. The closer the AUC value is to 1, the stronger the model's ability to distinguish between positive and negative samples; when the AUC value is 0.5, it means that the model's performance is equivalent to random guessing.

[0203] Ranking indicators are mainly used to evaluate the model's ranking ability in knowledge graph completion tasks, common indicators include Mean Rank (MR), Mean Reciprocal Rank (MRR) and Hits@K.

[0204] MR represents the average ranking of the correct entity among all candidate entities, the smaller the value the better.

[0205] MRR is the average of the reciprocal of the correct entity ranking, the larger the value the better, indicating that the model tends to rank the correct entity in the front row, as follows:

[0206] ;

[0207] where Rank represents the ranking of each sample; N is the number of samples in the test set.

[0208] Hits@K is another commonly used evaluation indicator, mainly used to evaluate the model's ranking ability in knowledge graph completion tasks, as follows:

[0209] ;

[0210] where, is an indicator function that takes value 1 when the condition is true, and 0 otherwise; is a hit threshold.

[0211] This metric represents the proportion of correct entities ranked in the top K positions. Common values of K include 1, 3, 10, etc. A higher Hits@K value indicates that the model is better at ranking correct entities in the top K positions, thus demonstrating higher ranking accuracy.

[0212] 2. Benchmark models and parameter settings.

[0213] To evaluate the performance of the proposed model in network security knowledge graph reasoning tasks, it is compared with multiple state-of-the-art benchmark models. These benchmark models cover two categories: rule-based methods and graph neural network (GNN) based methods.

[0214] Rule-based methods: These models extract logical rules from the knowledge graph and perform reasoning based on these rules, including NeuralLP [Yang et al., 2015], DRUM [Sadeghian et al., 2019], and RuleN [Yang et al., 2017].

[0215] GNN-based methods: These methods learn entity-independent features for the knowledge graph through graph neural networks (GNN) and perform reasoning using graph structures, including GraIL [Teru et al., 2020], CoMPILE [Mai et al., 2021], SNRI [Yao et al., 2020], and SASILP [Li et al., 2020].

[0216] These benchmark models cover a variety of methods from rule-based reasoning to graph neural networks, providing a strong basis for comparison of the proposed model. Through comparison with these benchmark models, the advantages and disadvantages of the proposed model in complex network security data and unseen relationship reasoning tasks can be comprehensively evaluated.

[0217] The SecGIRF model constructed in this invention is implemented based on the PyTorch and DGL frameworks, and all experiments are conducted in an environment equipped with an NVIDIA GeForce RTX 3090 GPU. To ensure the effectiveness and stability of the model, key hyperparameters are optimized in multiple experiments, and the specific parameter settings are shown in Table 3. During training, these settings optimize the training stability of the model, while avoiding overfitting and improving efficiency.

[0218] Table 3 Parameter settings

[0219] ;

[0220] In the hyperparameter selection process, key parameters such as batch size, learning rate, and GCN layer number are optimized through the grid search method. The specific search space includes batch size {2, 4, 8}, learning rate {0.001, 0.005, 0.01}, and GCN layer number {2, 3, 4}. After multiple rounds of experiments, the final optimal configuration is batch size 2, learning rate 0.01, and GCN layer number 3. This selection ensures the accuracy of the model while optimizing the computational efficiency, thereby achieving a balance between the two.

[0221] 3. Experimental results.

[0222] The experimental results demonstrate the effectiveness of the SecGIRF model in network security knowledge graph reasoning tasks and compare it with multiple advanced benchmark models on the AttackKG dataset.

[0223] From the AUC results in Table 4, the SecGIRF model achieved the best AUC values on all three dataset versions (V1, V2, V3). The V2 version significantly outperformed V1 / V3 (+2.0% / 2.5%), which was due to its more balanced data distribution and richer attack chain patterns (7 relationship types covering more complex semantic associations), providing the model with more comprehensive structural-semantic learning signals. These results indicate that the SecGIRF model has strong capabilities in distinguishing positive and negative samples.

[0224] Compared with models such as Neural-LP, DRUM, RuleN, and GraIL, the SecGIRF model showed significant advantages on all three versions. Compared with GraIL, the SecGIRF model achieved a significant improvement in AUC on all versions, especially on the V2 version, with a 6.3% improvement in AUC. This verifies that the rule enhancement mechanism of the SecGIRF model effectively compensates for the limitations of pure structural models, especially when modeling multi-hop attack paths, and improves the ability to capture sparse attack chains by injecting high-confidence rules. The advantages over CoMPILE and SNRI reflect the synergistic effect of the context graph and attention mechanism. The context graph models global semantic dependencies, while relationship-aware attention enhances the weight distribution of local key paths, jointly optimizing the discrimination accuracy in complex attack scenarios. This also indicates that the SecGIRF model has stronger discrimination ability in complex network security reasoning tasks.

[0225] Table 4 AUC performance comparison of SecGIRF model

[0226] ;

[0227] According to the results of Table 5, it is shown that the SecGIRF model also performs strong ability in the evaluation of MRR, which indicates that the present application can more stably rank the correct answer in the front in the multi-hop reasoning task. The results of MR evaluation also show better performance of the SecGIRF model, further verifying the strong ability of the SecGIRF model in accurately ranking the correct entity.

[0228] In the evaluation of Hits@K ranking ability, the SecGIRF model also achieved the best result, and the value of Hits@1 is higher than that of all benchmark models. Especially in the Hits@10 index, the performance on the V2 dataset is 76.9%, which is higher than all benchmark models. Compared with GraIL, the improvement of the SecGIRF model on Hits@10 is 4%, 4.8% and 1.9% respectively. These improvements show that the SecGIRF model has a significant advantage in accurately ranking the correct triplets in the front.

[0229] Table 5 SecGIRF model link prediction fine-grained index results

[0230] ;

[0231] Compared with multiple strong benchmark models, the model of the present application has made significant progress in AUC and Hits@K metrics, indicating that the SecGIRF model realizes stronger adaptability and higher reasoning accuracy for dynamic attack chains by introducing rule-enhanced subgraphs (weighted based on attack probability), fusing global semantic and local structure information through context graphs and attention mechanisms, and task-aware negative sampling to alleviate the long-tail bias.

[0232] 4. Ablation experiment.

[0233] The effectiveness of each module in the network security knowledge graph reasoning is evaluated through the ablation experiment. The ablation experiment includes the ablation of four key modules: rule-guided mechanism, context graph modeling, relationship-aware attention, and task-aware negative sampling. The results of Table 6 and Table 7 show that removing any module will cause different degrees of decline in the performance of the model, proving the important contribution of each module to the modeling of dynamic attack chains.

[0234] Specifically, the removal of the rule-guided mechanism leads to the maximum performance degradation (3.78% average AUC drop and 4.48% Hits@10 drop), as this module directly affects the integrity of multi-hop attack paths. The removal of the context graph modeling follows closely (2.59% average AUC drop and 2.79% Hits@10 drop), as this module plays a key role in the capture of cross-domain threat associations. The impacts of the relation-aware attention and task-aware negative sampling are relatively small but still lead to performance degradation, 1.19% / 1.21% and 0.89% / 1.26%, respectively.

[0235] Table 6. Analysis of the impact of module ablation on AUC

[0236] ;

[0237] Table 7. Hits@10 ablation experiment results

[0238] ;

[0239] The dominant role of the rule module stems from its logical constraints on attack paths, which are particularly important in network security scenarios, especially when facing sparse attack chains (such as APT attacks). The role of the context graph lies in its ability to integrate global semantic features and local rule reasoning simultaneously, providing complementary information for complex attack graphs. It is worth noting that in the V2 version with balanced data, the impact of the rule and context modules is further amplified (Hits@10 drops by 4.92% and 3.77%, respectively), indicating that the module design is robust to dynamic threat environments.

[0240] In summary, the ablation experiments verify the necessity of the rule-guided mechanism and context modeling as the core "double pillars" and further support the rationality of the SecGIRF model.

[0241] 5. Application verification.

[0242] To visually demonstrate the reasoning mechanism of the SecGIRF model in the network security knowledge graph, Table 8 lists examples of attack rules learned in AttackKG's three versions. Two rules with the highest confidence are selected for each dataset version, for example, rule (3) learned in the V2 version describes that after the attacker implements lateral movement through compromised devices, they will inevitably gain control of the key node, which conforms to the behavior logic of "break-in-expand-control" in APT attacks. All rules reflect interpretable security semantics, such as V3 rule (5) associates malicious code injection with C2 channel activation ( (This corresponds to MITRE ATT&CK tactics T1055→T1071.) These discrete rules, in synergy with neural computation, drive the threat reasoning capabilities of the SecGIRF model.

[0243] Table 8 Examples of AttackKG Multi-Version High-Confidence Attack Rules

[0244] ;

[0245] like Figure 4 As shown, this scatter plot reveals the distribution relationship between rule paths and target rule heads in the topological space composed of "rule path density" and "node centrality". In the figure, blue dots represent rule paths (ε) with different confidence levels, and their color intensity corresponds to the confidence values ​​(0.55 to 0.90) of the color bar on the right; orange triangles represent target rule heads (r). As can be seen from the figure, high-confidence (dark blue) rule paths are significantly clustered in the upper left area of ​​the graph, exhibiting characteristics of high node centrality and medium-to-low rule path density. This indicates that the most valuable rules are often associated with core nodes in the network, and their path structures are not overly complex. In contrast, the distribution of target rule heads is more dispersed.

[0246] This distribution pattern provides an intuitive basis for the rule selection mechanism of the SecGIRF model: prioritizing high-confidence rules located in this region (high centrality, moderate density) can effectively capture key attack patterns, thereby enhancing the model's inference performance.

[0247] Therefore, this invention employs a subgraph reasoning method that integrates logical rule learning and attack semantic enhancement, thereby improving the reasoning ability of network security knowledge graphs in complex attack scenarios. By introducing a rule path injection mechanism based on attack probability weighting, the structural sparsity problem is effectively alleviated; a task-aware negative sampling strategy and a multi-head attention mechanism are designed to improve the model's accuracy in modeling heterogeneous attack paths; and a logical consistency optimization method is combined to achieve zero-sample generalization reasoning for novel threat relationships.

[0248] Experiments on the self-built dataset AttackKG demonstrate that the SecGIRF model outperforms existing mainstream methods in key metrics such as AUC, MRR, and Hits@10. It also exhibits good interpretability and generalization ability, showcasing the effectiveness of logical induction and task semantic fusion in subgraph reasoning and improving the generalization prediction ability against novel attacks. This provides a feasible path for the application of graph neural reasoning technology in cybersecurity scenarios.

[0249] It should be pointed out finally that the above examples are only used to illustrate the technical solutions of the present application but not to limit it, and although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present application can still be modified or replaced equivalently, and these modifications or equivalent replacements should not make the modified technical solutions deviate from the spirit and scope of the technical solutions of the present application.

Claims

1. A subgraph reasoning method that fuses learning of logical rules with attack semantic enhancement, characterized in that, The SecGIRF model includes five modules: input layer, subgraph extraction module, subgraph encoding module, relationship reasoning optimization module, and training optimization module. The input layer dynamically integrates the knowledge graph topology and the AMIE rule base to generate an initial k-hop subgraph, providing structured input for attack chain mining. The subgraph extraction module performs double confidence filtering to screen high-value attack chains and applies dictionary filtering to enhance semantic reliability. In the subgraph extraction module, the multi-hop path is modeled using the Horn rule form in first-order logic (FOL), where the Horn rule is as follows: ； wherein, is the initiating step of the attack chain, the first relation in the rule body, describing the initial action of the attack; is the second relation in the rule body, describing how the attacker or exploited entity propagates the attack to the next intermediate entity after the first step; is the final step of the attack, the last item of the rule body, connecting the last intermediate entity and the final attack target; is the target relation; the rule body represents a multi-hop path between the entity and the entity ; the rule head represents the target relation ; In the rule generation phase, based on the classical logic induction method AMIE, rules are generated through frequent relationship path mining and confidence calculation. Each rule is represented as a triple path pattern, as follows: ； wherein, and is a relation, describing the reasoning path; is a predicate in the rule head, characterizing the target relation about the entity ; is an identifier of the whole rule, used to uniquely mark a logical rule; The generated rules are filtered, retaining those with a confidence threshold frequent relationship paths; After the confidence rules have been selected, they are weighted; for each path the number of occurrences in the positive samples and the total number of occurrences in all samples is defined as the attack probability as follows: ； wherein, is a smoothing factor, used to mitigate statistical bias of the low frequency path; the weight of the path is computed according to its frequency and attack probability as follows:​ ； wherein, is the path The frequency of occurrence in the training set reflects the importance of the path; Based on the filtered rules and the calculated weights, a subgraph is constructed, centering on the target triple with the head entity and the tail entity as the center, k-hop subgraph extraction is performed; from and , respectively, the entity's adjacent node set and are obtained in steps, as follows: ； ； wherein, is the shortest path distance; is the hop count extracted for the subgraph; is the candidate relationship; By the intersection operation of the and adjacency sets, the common node set is obtained , and the subgraph with and as the core is constructed , as follows: ； ； ； wherein, is a set of nodes; is a set of edges; , are any two nodes in the subgraph; After the subgraph is constructed, the filtered rule paths are injected into the edge set to form the final subgraph, as follows: ； ； wherein, is a set of edges of the base topology; is a set of filtered rule paths; is a weight threshold; is a final set of edges; is a final constructed weighted subgraph around the target node; is a weight mapping function or a set of weights acting on the entire final subgraph ; The subgraph encoding module adopts a double-path mechanism. The entity perception update layer iteratively optimizes the node representation through path perception attention and target relationship perception attention. The relationship aggregation evolution layer generates high-order semantic representation through function fusion of multi-source relationships and collaboratively models the time and space characteristics of attack chains. Function fusion multi-source relationship generates high-order semantic representation, collaborative modeling of attack chain time and space characteristics; The relationship reasoning optimization module dynamically injects high-confidence rules to optimize triple scoring. The training optimization module implements task-aware negative sampling.

2. The subgraph reasoning method of claim 1, wherein, The SecGIRF model introduces a subgraph encoding dual-channel mechanism in the subgraph encoding phase, including an entity-aware update layer and a relationship aggregation evolution layer. The entity-aware update layer updates entity representations by fusing rule paths and task semantics through path-aware attention and target relationship-aware attention. Relationship aggregation and evolution layer, through The function integrates multi-hop relationships and merges the states of neighboring entities, then outputs evolution nodes through gating to form a closed-loop collaboration.

3. The subgraph reasoning method of claim 2, wherein, When initializing the encoding, the double radius node labeling (DRNL) strategy is adopted. The nodes are labeled by calculating the shortest path distances from the nodes to the head entity and the tail entity . The label value of each node reflects its relative position in the subgraph, providing structural information for model learning. The node labeling formula is as follows: ； wherein, is a double radius marker value for the node ; is any one node in the subgraph; To further capture the high-order semantic context of the target triplets in the graph, a context graph is constructed, whose nodes include entities, relations, and connections With confidence rules paths; After the context graph is constructed, a graph convolutional network is used to embed and update the nodes, modeling their higher-order interactions; a multidimensional interaction encoding function is introduced for any pair of context nodes. The features are combined and modeled as follows: ； wherein, is an interaction feature vector for a pair of nodes ; , is a vector representation of a node in the context graph; is a vector concatenation operation; and model difference and similarity, respectively.

4. The subgraph reasoning method of claim 3, wherein, In the structure encoding process, a target relation based attention mechanism is introduced; the attention weight of each edge in the subgraph As follows: ； wherein, , is an initial feature vector; is a target relation embedding vector; , is a linearly transformed vector representation of the point feature; is a linearly transformed vector of the target relation feature; and are trainable parameters; is a transpose of ; is an activation function; Further capture potential path dependency in sub-graph, sort each node to entity With distance, construct node sequence, and only sort the filtered rule path nodes in attack chain order, extract time sequence features through BiGRU, thereby supplementing the sequence information that is difficult to explicitly model in static structure.

5. The subgraph reasoning method of claim 4, wherein, In the feature fusion stage, the MLP network processes the concatenated features to integrate multi-source information, including node initialization label features, relationship-aware attention embeddings, and path-level BiGRU sequence features. Feature fusion is as follows: ； wherein, is a final feature representation for the node ; is a representation of a context graph node; is a representation of a sequence of nodes; is a multi-layer perceptron; In the feature fusion of the feedforward network design, a three-layer expansion-constriction structure is used to capture the nonlinear structural features in the subgraph, as follows: ； wherein, is an update representation for a node ; denotes a non-linear activation function; is a set of adjacent nodes for a node ; is an index that traverses all neighbors of a node i; In the graph aggregation stage, the attention mechanism based on the target relation is adopted to adjust the aggregation weight of each edge as follows: ； wherein, is the normalized attention weight, denotes the neighbor of node ; is an activation function; is a linear mapping vector of the target relation ; is an arbitrary neighbor node of node ; The final node representation is as follows: ； wherein, is the final aggregated representation of the node ; is the representation of the neighbor node after processing by the MLP network; is a multi-layer perceptron for feature transformation.

6. The subgraph reasoning method of claim 1, wherein, In the relationship reasoning optimization module, the SecGIRF model introduces a multi-granularity semantic fusion mechanism in the reasoning phase, combining structural context, rule paths, and task semantic information to optimize reasoning performance. The specific process is as follows: First, at the structural level, the node representation is obtained and combined with the rule path embedding to obtain the fused representation as follows: ； By aggregation function The node features are summarized to build a subgraph structure representation as follows: ； wherein is a subgraph structure representation; Then, at the semantic level, the context graph is introduced to model the rule path semantics and relationship context of the target triple in the knowledge graph; the target entity , candidate relationship and semantic interaction features are input into the feature combination function , as follows: ； wherein, represents a candidate relationship; function explicitly expresses the influence of the candidate relationship on the semantic interaction; is a vector concatenation operation; Finally, a dual-channel relationship scoring function is used to achieve structure-semantic joint optimization, as follows: ； wherein, is the final prediction score for the target triple; is a learnable weight matrix for the subgraph structure representation; is a learnable weight matrix for the semantic feature; and are learnable parameters; is a nonlinear activation function for fusing the matching strength of the structural context and the semantic path on the target relation. In addition, at the logical level, the SecGIRF model introduces a rule consistency optimization mechanism. For the confidence Horn rules automatically mined in the training set If a path matches the rule body, the rule is enhanced for the corresponding relationship scoring, as shown below: ； wherein, score the relationship after adjustment under logical constraints; control the degree of influence of the rule path on the inference result; indicates whether there is a rule path match, taking values 0 or 1, and 1 indicates that there is a path that matches the rule body completely if and only if the entity pair there is a path that matches the rule body completely; 0 indicates that there is no path that meets the matching conditions; indicates the assignment; In the training phase, the multi-objective loss function is jointly optimized including the relation classification loss and the logical consistency constraint, as follows: ； wherein, is a cross-entropy loss; is a logical consistency loss for encouraging the model to make consistent inferences under logical rule constraints, for encouraging the model to make consistent inference judgments under logical rules; is a weight hyperparameter.

7. The subgraph reasoning method of claim 1, wherein, In the training optimization module, the design focuses on three aspects: negative sampling mechanism, loss function, and optimization strategy. The specific implementation process is as follows: First, in the negative sampling strategy, the task-aware negative sampling method based on attack semantic categories is used to assign different sampling weights to different attack types, enhancing the relevance of negative samples in the semantic space and improving the discrimination ability of attack types. The sampling probability is defined as follows: ； wherein, is the frequency of occurrence of the attack type; is the attack category label space; is the attack type of the sample; is the sample sampling probability; a filtering mechanism based on the head-tail entity relationship dictionary is introduced to avoid potential positive examples and improve the quality of negative samples; Then, in the loss function construction, a multi-task joint loss function is adopted; wherein the main task loss is a binary cross entropy based on negative sampling, used to supervise the triple relationship classification; the auxiliary task loss is based on the pseudo label generated by the logical rule path, and the consistency constraint is applied to the subgraph meeting the high confidence path; the two are combined in the form of weighting to construct the overall loss function As shown below: ； wherein, represents a main task loss based on the structure score; represents a consistency loss based on the rule path score; is a weight coefficient; Finally, in terms of training scheduling and parameter optimization, the AdamW optimizer is used in conjunction with the weight decay mechanism to suppress overfitting. Gradient clipping and L2 regularization are introduced to prevent gradient explosion.

Images