Threat detection method using security confrontation knowledge graph technology
By using security adversarial knowledge graph technology, the problem of integrating multi-source heterogeneous security data has been solved, enabling efficient identification and rapid response to new threats, and improving the accuracy and flexibility of network security detection.
Patent Information
- Application Number
- CN202511218580.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-28
- Publication Date
- 2025-11-18
AI Technical Summary
Existing technologies cannot fully tap the potential value of multi-source heterogeneous security data, and traditional threat detection methods are ineffective in detecting new and variant threats, have a high false alarm rate, and are difficult to quickly identify complex attack scenarios.
By employing security adversarial knowledge graph technology, through data collection and preprocessing, security adversarial knowledge graph construction, deep feature mining, threat detection inference model construction, and automatic response strategy execution, we can achieve unified integration of multi-source security data and real-time threat detection.
It achieves efficient fusion of multi-source heterogeneous security data and real-time threat detection, improves the ability to identify new threats, reduces false alarm rate, and ensures rapid response and accurate threat assessment and handling.
Smart Images
Figure CN120979755A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and particularly relates to a threat detection method using security confrontation knowledge graph technology. BACKGROUND
[0002] With the rapid development of information technology, network security threats are increasingly complex and diverse. Traditional threat detection technologies, such as feature matching-based methods, rely on a feature library of known threats and often fail to effectively detect new and variant threats. Behavior analysis-based methods can identify abnormal behavior to some extent, but have a high false positive rate due to a lack of deep understanding and correlation analysis of security knowledge.
[0003] In terms of security knowledge management, existing security knowledge bases are mostly static and isolated, lacking effective organization and utilization of the internal connections between knowledge. This makes it difficult for security personnel to quickly and accurately identify and respond to threats when faced with massive security data and complex attack scenarios. Meanwhile, existing technologies have difficulties in data fusion and information silos when dealing with multi-source heterogeneous security data, failing to fully exploit the potential value of the data. SUMMARY
[0004] The purpose of the present application is to provide a threat detection method using security confrontation knowledge graph technology, which can solve the problem of failing to fully exploit the potential value of data when dealing with multi-source heterogeneous security data in existing technologies.
[0005] Technical solution: To solve the above technical problems, according to one aspect of the present application, more specifically, a threat detection method using security confrontation knowledge graph technology, specifically comprising the following steps:
[0006] S1, data collection and preprocessing: Collecting multi-source security data, preprocessing the security data including filtering, denoising, normalization, and missing value filling;
[0007] S2, security confrontation knowledge graph construction: Designing an ontology model according to professional knowledge in the security confrontation field, constructing a unified security confrontation knowledge graph, and storing it in a graph database;
[0008] S3, deep feature mining of preprocessed data: Extracting the initial attribute features of entities from the security confrontation knowledge graph for deep processing to obtain deep feature data;
[0009] S4, construction of threat detection reasoning model: Fusing rule-based reasoning and machine learning-based reasoning to construct a fusion reasoning model;
[0010] S5, real-time threat detection: real-time collection of detection data updates to the security confrontation knowledge graph, using the constructed threat detection reasoning model to perform real-time reasoning and analysis on deep feature data, and designing multi-dimensional threat scoring rules;
[0011] S6, automatic response strategy execution: a two-dimensional response matrix based on threat level-asset type is established, the execution state is monitored in real time, and if the execution fails, a degradation strategy is triggered, a response effect report is generated periodically, strategy parameters are automatically optimized based on report data, and when an attack without a matching strategy is detected, an artificial response process is automatically triggered.
[0012] Further, in step S1, the collected multi-source security data sources include: network flow logs, security device alarm information, vulnerability databases, and threat intelligence platforms.
[0013] Further, in step S1, preprocessing includes: removing duplicate and invalid records by cleaning the data, filtering normal network connection records and low-level invalid alarms; noise reduction processing is performed to eliminate interference information in the data; IP addresses and port numbers are normalized to unify the format; and mean filling or interpolation method is used to handle missing values.
[0014] Further, in step S2, when constructing the security confrontation knowledge graph, an ontology model containing entity types, relationship types and attribute definitions is designed, the entity types cover attackers, attack tools, vulnerabilities, assets and defense measures, the relationship types include attack relationships, causal relationships and defense relationships, the attribute definitions include basic attributes and security-related specific attributes of entities, entity, relationship and attribute information is extracted from the preprocessed data, structured data is obtained through database queries and conversions, unstructured data is extracted using named entity recognition and relationship extraction techniques, the extracted knowledge is fused through entity alignment technology, a unified security confrontation knowledge graph is constructed, and stored in a graph database.
[0015] Further, step S3 specifically includes the following steps:
[0016] S31, extract the initial attribute features of the entity from the security confrontation knowledge graph, calculate the importance weight of each attribute using the information gain algorithm, select the key attributes and combine them, and construct an entity enhanced feature set by combining the inclusion degree and betweenness of the entity in the knowledge graph;
[0017] S32, construct a relationship matrix based on the relationship type of the entity key, perform matrix decomposition using the NMF algorithm to extract latent relationship features, traverse the knowledge graph through breadth-first search, count the frequency of relationship paths with lengths of 2-4, calculate the path confidence, and mine hidden association features in multi-hop relationships;
[0018] S33, input the entity enhancement feature and the hidden correlation feature into the generative adversarial network to generate an adversarial sample feature similar to the real threat feature but with subtle differences, fuse the original feature and the adversarial sample feature at a certain proportion to form deep feature data.
[0019] Further, in the step S4, when constructing the threat detection reasoning model, the rule-based reasoning is based on the experience and knowledge of security experts, combines the deep feature data, formulates the threat detection rules, converts the rules into executable logical expressions, and performs matching and reasoning on the knowledge graph to quickly detect known threat patterns conforming to the rules; the machine learning-based reasoning takes the deep feature data as input, labels historical security data as normal samples and threat samples, trains a machine learning model, makes the machine learning model learn complex patterns and rules in the review features, and judges whether new data is threatened; the rule-based reasoning and the machine learning-based reasoning are combined to construct a fusion reasoning mechanism, for explicit and common threat patterns, the rule-based reasoning is used for rapid detection, for complex and unknown threats, the machine learning-based reasoning is used for in-depth analysis, and the structure of the two reasoning methods is fused by setting a weight coefficient to comprehensively judge whether there is a threat.
[0020] Further, the step S5 specifically includes the following steps:
[0021] S51, real-time collection of data including network traffic, security device alarms, and server logs, cleaning and uniform format conversion of the data;
[0022] S52, constructing a real-time feature processing engine, mapping the collected data to corresponding entities and relationships in the knowledge graph, performing deep feature mining on the data to obtain deep feature data, inputting the deep feature data into the threat detection reasoning model to determine whether there is a threat feature, and completing preliminary screening of threats;
[0023] S53, a multi-dimensional threat scoring model calculates a threat index from three dimensions of attack intent, asset value, and feature matching degree, the attack intent is according to the stage of the attack tool in the kill chain, the asset value is valued according to importance, and the feature matching degree is combined with the rule reasoning score and the machine learning probability value, according to the threat index, different levels of alarms are triggered.
[0024] Further, in step S6, when the automatic response strategy is executed, a two-dimensional corresponding matrix based on threat level-asset type is established, different strategies are executed for different alarms, the returned execution state is collected in real time during execution, including success, failure, timeout, if the execution state is execution failure, a degradation strategy is triggered, all response action record values are tamper-proof logs, including operator, execution time, impact range, a response effect report is generated regularly, including threat interception success rate, false interception rate, business impact duration, based on the report data, the strategy parameters are automatically optimized using reinforcement learning, when an attack with no matching strategy is detected, an artificial response process is automatically triggered, a value security operation team is assigned, and the response result is used as a new sample to feed back the knowledge graph.
[0025] Advantages:
[0026] 1. By collecting multi-source security data and performing filtering, denoising, normalization, and missing value filling, the consistency of multi-source heterogeneous data can be solved. On the one hand, repeated, invalid records, and normal network connections are removed to reduce the influence of redundant data on subsequent processing. On the other hand, by unifying the format and handling missing values, the integrity and usability of the data are ensured, providing a high-quality data foundation for security confrontation knowledge graph construction and deep feature mining, and avoiding detection bias caused by data quality problems.
[0027] 2. By designing an ontology model containing entity type, relationship type, and attribute definition, a unified security confrontation knowledge graph is constructed and stored in a graph database, which can break through the limitations of traditional security knowledge base "static, isolated". On the one hand, it realizes the association and integration of multi-source security knowledge, clearly presents the internal relationship between entities, and helps security personnel intuitively understand complex attack scenarios. On the other hand, the dynamic updating feature of the knowledge graph solves the problem that traditional knowledge bases are difficult to adapt to the rapid evolution of threats, providing real-time and comprehensive knowledge support for threat detection.
[0028] 3. Deep feature data is obtained, which can fully exploit the potential value of the data. Entity enhanced features combined with attribute importance weight and topological features solve the problem of single attribute difficulty in fully describing entity risk. Multi-hop relationship feature mining reveals the hidden association patterns between entities. Adversarial feature generation and original feature fusion enhance the ability to recognize variant threats and solve the problem of insufficient adaptability of traditional features to new attacks.
[0029] 4. Fusion of rule-based reasoning and machine learning-based reasoning can balance detection efficiency and coverage. Rule-based reasoning can quickly detect known threat patterns and ensure response speed. Machine learning-based reasoning can identify complex and unknown threats and make up for the insufficient coverage of rules for new attacks. Through weight fusion, the existence of threats is comprehensively judged, the false positive rate of single reasoning method is reduced, and the detection accuracy is improved.
[0030] 5. Through real-time data collection to update the knowledge graph, real-time feature processing and reasoning, combined with multi-dimensional threat scoring, timely discovery and accurate classification of threats can be realized. Real-time data updating and reasoning ensure rapid response to dynamic threats, solving the problem of traditional detection lag. The dimension score model quantifies the severity of the threat, avoids single dimension misjudgment, makes the alarm classification more reasonable, and helps security personnel to prioritize high-risk threats.
[0031] 6. Through the combination of two-dimensional response matrix, degradation strategy, automatic optimization and manual response, efficient and flexible threat disposal can be realized. Differentiated response strategies ensure security while reducing business impact. Execution state monitoring and degradation strategy ensure response reliability. Strategy optimization based on reinforcement learning and manual response feed back the knowledge graph, realize the continuous evolution of response ability, solve the problem of traditional strategy rigidity and difficulty in adapting to threat evolution. BRIEF DESCRIPTION OF DRAWINGS
[0032] Figure 1 is a method flow diagram. DETAILED DESCRIPTION
[0033] In order to make the technical scheme of the present application clearer, the present application will be further described in detail below in combination with the drawings and specific embodiments.
[0034] Embodiment 1
[0035] This embodiment takes protecting a corporate data center network as an example.
[0036] Step 1: Data collection and preprocessing
[0037] Data collection: The collected multi-source security data includes: network traffic logs: NetFlow data collected from the mirror ports of core switches. Security device alarm information: real-time alarm logs collected from firewalls, intrusion detection systems (IDS). Vulnerability database: periodically call NVD (National Vulnerability Database) API to obtain CVE vulnerability information related to enterprise assets. Threat intelligence platform: subscribe to open source threat intelligence sources (such as AlienVault OTX) to obtain malicious IP, domain name and hash value information. Preprocessing: cleaning: use SparkStreaming to clean streaming data, remove completely repeated alarm records and invalid records such as network heartbeat packets. Filtering: set whitelist rules to filter out normal network connection records with trusted targets such as internal DNS servers and WSUS update servers; filter out invalid alarms with "low" priority generated by IDS. Noise reduction: apply sliding time window (such as 5 minutes) to aggregate repeated alarms from the same source within a short period of time, eliminating burst noise. Normalization: convert all IP addresses in the logs to dotted decimal format; map port numbers to uniform service names (such as port 80 -> 'HTTP'). Fill in missing values: for missing CVSS score fields in vulnerability data, use the average score of the same type of vulnerability in the same period to fill in.
[0038] Second step, security confrontation knowledge graph construction:
[0039] Ontology model design: entity types include attackers (attributes: IP, reputation), attack tools (attributes: name, type), vulnerabilities (attributes: CVE-ID, CVSS score), assets (attributes: IP, hostname, asset value level), defense measures (attributes: policy ID, action). Relationship types include exploitation, target, mitigation. Knowledge extraction and construction: for structured vulnerability library and asset library data, extract entities and relationships directly through SQL queries and ETL tools. For unstructured IDS alerts and threat intelligence texts, use BERT+BiLSTM-CRF model for named entity recognition (NER) to extract attacker IP, malicious tool name, etc. Use an attention-based relationship extraction model to extract attack and association relationships from text. Use entity alignment technology to determine that 192.168.1.100 (from the firewall) and Internal-Web-Server (from the asset library) point to the same entity and are merged. Storage: store the final unified knowledge graph in the Neo4j graph database.
[0040] Third step, deep feature mining of preprocessed data:
[0041] 1、Extract the initial attribute features of entities from the knowledge graph, such as the IP and value level of assets, the CVSS score of vulnerabilities, etc. Use the information gain algorithm to calculate the importance weight of each attribute to the threat label, and select key attributes such as asset value and CVSS score. Combine the topological features of entities in the knowledge graph (calculate the degree centrality and betweenness centrality of each entity), and form an enhanced feature vector of entities in combination with key attributes.
[0042] 2、Based on the relationship type between entities (such as exploitation and target), a relationship adjacency matrix is constructed. Use the non-negative matrix factorization (NMF) algorithm to decompose the matrix and extract the latent, low-dimensional relationship feature vector. Traverse the knowledge graph through breadth-first search (BFS) and count the frequency of relationship paths such as attacker-[exploit]->vulnerability-[impact]->asset with a length of 3, and calculate their confidence as multi-hop association features.
[0043] 3、Input the above enhanced entity features and hidden association features into the generative adversarial network (GAN) to generate adversarial sample features. Fuse the generated adversarial sample features with the original extracted features in a 7:3 ratio to form the final, more robust deep feature data for subsequent model training and reasoning.
[0044] Step 4, Threat detection reasoning model construction:
[0045] Rule-based reasoning: According to expert experience, formulate rules and convert them into Cypher query statements to match and reason on the Neo4j knowledge graph. Machine learning-based reasoning: Use XGBoost algorithm to train a classification model by inputting deep feature data and labeling historical data as "normal" or "threat". Learn complex patterns. For threat patterns that exist explicitly in the rule base, use rule-based reasoning for fast detection. For unknown traffic that cannot be matched by rule-based reasoning, use machine learning-based reasoning model for in-depth analysis and output threat probability. Set weight coefficients (such as rule-based reasoning result weight 0.4, machine learning-based reasoning probability weight 0.6) to weight and fuse the results of the two reasoning methods to determine the final threat score.
[0046] Step 5, Real-time threat detection:
[0047] 1、Real-time collection of data including network traffic, security device alerts, and server logs, and data cleaning and unified format conversion;
[0048] 2. Construct a real-time feature processing engine (such as a Flink job), map the collected data to the corresponding entities and relationships in the knowledge graph, perform deep feature mining on the data to obtain deep feature data, input the deep feature data into the threat detection reasoning model, and determine whether there is a threat feature to complete the preliminary screening of threats;
[0049] 3. A multi-dimensional threat scoring model calculates a threat index from three dimensions: attack intent, asset value, and feature matching degree. Attack intent is assigned different weights according to the stage of the attack tool in the kill chain. Asset value is assigned according to importance. Feature matching degree combines rule-based reasoning scores and machine learning probability values. According to the threat index, different levels of alarms are triggered. Multi-dimensional threat scoring:
[0050] Attack intent: According to the ATT&CK framework, determine the stage of the attack tool in the kill chain (such as reconnaissance, weaponization, penetration), and assign different weights.
[0051] Asset value: Assign values according to the "value level" attribute of asset entities in the knowledge graph.
[0052] Feature matching degree: Combine rule-based reasoning scores (such as 0 or 1) and MLR output probability values (0~1) to calculate the weighted sum. According to the comprehensive threat index calculated from the three dimensions, different levels of alarms (such as prompt, warning, and serious) are triggered.
[0053] Step 6, automatic response strategy execution:
[0054] Establish a two-dimensional response matrix based on threat level-asset type. For example, for "serious" threats and "core" assets, execute the "automatic isolation" strategy; for "warning" threats and "ordinary" assets, execute the "linkage firewall throttling" strategy. Response actions are issued to firewalls, terminal protection, etc. through API. Real-time monitoring of execution status (success, failure, timeout). If execution fails, trigger a downgrade strategy, such as automatic isolation failure, which is downgraded to manual notification immediately. All response actions are recorded in an unalterable audit log (such as stored in a blockchain database), including operator (or system account), execution time, and impact range. Generate a response effect report every week, which includes threat interception success rate, false interception rate, business impact duration, and other indicators. Based on the report data, use reinforcement learning algorithms (such as Q-learning) to automatically optimize the strategy parameters in the two-dimensional response matrix, such as adjusting the threshold for triggering isolation. When no matching strategy is detected, automatically trigger the manual response process, generate a work order and assign it to the security operations team. After processing, the response results of this attack are used as new samples to feed back to the security countermeasure knowledge graph, achieving closed-loop optimization.
[0055] Example 2
[0056] This embodiment takes a container and microservice environment on a cloud platform as an example.
[0057] Step 1, Data Acquisition and Preprocessing:
[0058] Data Acquisition: Collected multi-source security data includes: container runtime logs (via Falco), Kubernetes APIServer audit logs, cloud platform security group flow logs, image vulnerability scan results (Trivy), and cloud WAF alerts. Preprocessing: Considering the characteristics of the cloud environment, preprocessing requires the following additions: Normalization: Unifying container IDs, Pod names, and service names to the platform's standard tag format. Filling Missing Values: For transiently missing container asset information, filling it with the default policy values of its respective Deployment or Service.
[0059] The second step is to construct a knowledge graph framework for security confrontation:
[0060] Ontology Model Design: Entity Type Expansion: Container Images, Service Accounts, Namespaces, Security Policies. Relationship Type Expansion: Running at, Belonging to, Violating. Knowledge Extraction: Utilizing KubernetesOperator to automatically discover cloud-native entities and relationships, incorporating them into the knowledge graph.
[0061] The third step is preprocessing for deep feature mining:
[0062] 1. Use the information gain algorithm to filter key attributes (such as the number of mirror vulnerabilities and service account permissions), and combine node degree and betweenness centrality to construct enhanced features.
[0063] 2. Construct a relation matrix and use NMF decomposition to extract potential features; use BFS to statistically analyze the frequency of multi-hop paths (such as service account A - [created in namespace X] -> Pod - [violation] -> security policy Y) as association features.
[0064] 3. Use GAN to generate adversarial example features and fuse them with the original features to form deep feature data.
[0065] Step 4: Building the threat detection inference model:
[0066] Rule-based reasoning: Define cloud-native security rules, such as "prohibit privileged container startup". Machine learning-based reasoning: Train an IsolationForest model using deep feature data to detect abnormal access behavior between microservices. Fusion mechanism: Use weighted coefficients to fuse rule matching results and anomaly detection probabilities for comprehensive judgment.
[0067] Step 5, Real-time Threat Detection:
[0068] Real-time collection of cloud environment logs, processed by feature engine. Attack intent: judge the stage of attack in the cloud environment kill chain (such as resource control, data leakage) according to behavior. Asset value: assign value according to the importance level of microservice marked by label in knowledge graph. Feature matching degree: calculate by combining rule matching score and anomaly detection probability value.
[0069] Sixth step, automatic response strategy execution:
[0070] Establish a two-dimensional response matrix based on threat level-asset type. Response actions include: adjusting security group policy, deleting malicious pod, revoking service account token, etc. Real-time monitoring of execution status, failure triggers degradation strategy (such as deleting pod failure, notify node to expel). All actions are recorded in tamper-proof logs. Generate report regularly, and optimize response strategy parameters by reinforcement learning (such as adjusting the decision threshold of pod deletion). Automatically trigger manual response process when encountering unknown attacks, and the result feeds back to the knowledge graph to form a closed loop.
[0071] The above-described embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.
Claims
1. A threat detection method utilizing security adversarial knowledge graph technology, characterized in that, Specifically, the following steps are included: S1. Data Acquisition and Preprocessing: Acquire multi-source security data and perform preprocessing on the security data, including filtering, noise reduction, normalization, and filling in missing values. S2. Construction of Security Confrontation Knowledge Graph: Based on professional knowledge in the field of security confrontation, design an ontology model, construct a unified security confrontation knowledge graph, and store it in a graph database; S3. Preprocessing data deep feature mining: Extract the initial attribute features of entities from the security adversarial knowledge graph and perform deep processing to obtain deep feature data; S4. Threat Detection Inference Model Construction: Converging rule-based reasoning and machine learning-based reasoning to construct a fusion reasoning model; S5. Real-time threat detection: Real-time collection of detection data and updates to the security adversarial knowledge graph. Using the constructed threat detection reasoning model, real-time reasoning and analysis of deep feature data are performed, and multi-dimensional threat scoring rules are designed. S6. Automatic Response Strategy Execution: Establish a two-dimensional response matrix based on threat level and asset type, monitor the execution status in real time, trigger a degradation strategy if execution fails, generate response effect reports periodically, automatically optimize strategy parameters based on report data, and automatically trigger a manual response process when an attack without a matching strategy is detected.
2. The threat detection method using security adversarial knowledge graph technology according to claim 1, characterized in that: In step S1, the multi-source security data collected includes: network traffic logs, security device alarm information, vulnerability databases, and threat intelligence platforms.
3. The threat detection method using security adversarial knowledge graph technology according to claim 2, characterized in that: In step S1, the preprocessing includes: cleaning the data to remove duplicate and invalid records, filtering normal network connection records and low-level invalid alarms; performing noise reduction to eliminate interference information in the data; normalizing IP addresses and port numbers to unify the format; and using mean filling or interpolation to handle missing values.
4. The threat detection method using security adversarial knowledge graph technology according to claim 3, characterized in that: In step S2, when constructing the security adversarial knowledge graph, an ontology model is designed that includes entity types, relationship types, and attribute definitions. Entity types cover attackers, attack tools, vulnerabilities, assets, and defense measures. Relationship types include attack relationships, causal relationships, and defense relationships. Attribute definitions include the basic attributes of entities and security-related specific attributes. Entity, relationship, and attribute information is extracted from preprocessed data. For structured data, it is obtained through database query and transformation. For unstructured data, named entity recognition and relationship extraction techniques are used for extraction. The extracted knowledge is fused through entity alignment technology to construct a unified security adversarial knowledge graph and store it in a graph database.
5. A threat detection method using security adversarial knowledge graph technology according to claim 4, characterized in that: Step S3 specifically includes the following steps: S31. Extract the initial attribute features of entities from the security adversarial knowledge graph, use the information gain algorithm to calculate the importance weight of each attribute, screen key attributes and combine them, and construct an entity augmentation feature set by combining the topological features of entities in the knowledge graph, including degree and betweenness. S32. Construct a relation matrix based on the relation type of entity key, perform matrix decomposition using the NMF algorithm, extract potential relation features, traverse the knowledge graph through breadth-first search, count the frequency of relation paths with length 2-4, calculate path confidence, and mine hidden association features in multi-hop relations. S33. Input entity enhancement features and hidden association features into a generative adversarial network to generate adversarial sample features that are similar to real threat features but have subtle differences. These features are then fused with the original features in a certain proportion to form deep feature data.
6. The threat detection method using security adversarial knowledge graph technology according to claim 5, characterized in that: In step S4, when constructing the threat detection inference model, rule-based inference relies on the experience and knowledge of security experts, combined with deep feature data, to formulate threat detection rules. These rules are then transformed into executable logical expressions, matched and inferred on a knowledge graph, to quickly detect known threat patterns that conform to the rules. Machine learning-based inference uses deep feature data as input, labels historical security data as normal and threat samples, and trains the machine learning model to learn complex patterns and rules in the features to determine whether new data poses a threat. By combining rule-based and machine learning-based inference, a fusion inference mechanism is constructed. For clear and common threat patterns, rule-based inference is prioritized for rapid detection, while for complex and unknown threats, machine learning-based inference is used for in-depth analysis. By setting weight coefficients, the structures of the two inference methods are fused to comprehensively determine whether a threat exists.
7. A threat detection method using security adversarial knowledge graph technology according to claim 6, characterized in that: Step S5 specifically includes the following steps: S51. Real-time collection of data including network traffic, security device alarms, and server logs; data cleaning and unified format conversion. S52. Construct a real-time feature processing engine to map the collected data to the corresponding entities and relationships in the knowledge graph, perform deep feature mining on the data to obtain deep feature data, input the deep feature data into the threat detection inference model, determine whether there are threat features, and complete the initial threat screening. S53, the multi-dimensional threat scoring model calculates the threat index from three dimensions: attack intent, asset value, and feature matching degree. Attack intent is determined by the stage of the attack tool in the kill chain, asset value is assigned according to importance, and feature matching degree combines rule reasoning score and machine learning probability value. Based on the threat index, different levels of alarms are triggered.
8. A threat detection method using security adversarial knowledge graph technology according to claim 7, characterized in that: In step S6, when the automatic response strategy is executed, a two-dimensional response matrix based on threat level and asset type is established. Different strategies are executed for different alarms. During the execution process, the returned execution status is collected in real time, including success, failure, and timeout. If the execution status is "execution failure", a degradation strategy is triggered. All response action records are logged in an immutable manner, including the operator, execution time, and scope of impact. Response effect reports are generated periodically, including threat interception success rate, false interception rate, and duration of business impact. Based on the report data, reinforcement learning is used to automatically optimize strategy parameters. When an attack without a matching strategy is detected, a manual response process is automatically triggered, and the security operations team is assigned to the response. The response results are used as new samples to feed back into the knowledge graph.