Construction method and device of network security knowledge graph, equipment and storage medium

Abstract

The invention relates to a construction method and device of a network security knowledge graph, equipment and a storage medium, and the method comprises the steps: obtaining multi-source data of a network security application scene, and carrying out distributed processing to obtain a security data set; performing structured storage management and security knowledge extraction on the security data set to obtain an initial knowledge graph; performing zero-day attack prediction construction based on the initial knowledge graph to obtain potential attack data; performing path fusion association on the potential attack data and the initial knowledge graph to obtain attack chain fusion information; and obtaining real-time event data of the network security application scene, and carrying out dynamic iteration updating on the initial knowledge graph by using the real-time event data and the attack chain fusion information to obtain the network security knowledge graph. According to the invention, the timeliness and practicability of the network security knowledge graph can be ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular relates to a network security knowledge graph construction method and device, equipment and a storage medium. BACKGROUND

[0002] As a new type of knowledge representation and management method, network security knowledge graph has important application value in the field of network security. With the increasing complexity and diversification of network attack methods, traditional network security defense technologies are facing great challenges. Network security knowledge graph can effectively integrate multi-source heterogeneous security information and form a systematic knowledge system by structurally organizing and semantically associating scattered security data, providing comprehensive knowledge support for network security defense. Existing network security knowledge graph construction methods often only focus on static security knowledge representation, such as vulnerability information or records of known attack patterns, ignoring the dynamic nature of network attacks and the complex attack chain associations. This simplified approach may lead to inaccurate identification of new attack methods, thereby affecting the effectiveness of network security defense. Traditional knowledge graph construction methods usually rely on single-source data and lack comprehensive utilization and processing capabilities for multi-source heterogeneous data, making it difficult to fully reflect the complex knowledge system in the field of network security. At the same time, the prediction and representation capabilities for unknown threats such as zero-day attacks are limited, making it difficult to achieve early warning of potential security risks. SUMMARY

[0003] The main purpose of the present application is to provide a network security knowledge graph construction method, device, equipment and storage medium, which can ensure the timeliness and practicality of the network security knowledge graph.

[0004] To achieve the above purpose, the present application provides a network security knowledge graph construction method, comprising: Obtaining multi-source data of network security application scenarios for distributed processing to obtain a security data set; Structurally storing and managing the security data set and extracting security knowledge to obtain an initial knowledge graph; Based on the initial knowledge graph, zero-day attack prediction construction is performed to obtain potential attack data; Fusing and associating the potential attack data with the initial knowledge graph to obtain attack chain fusion information; Obtaining real-time event data of the network security application scenarios and dynamically updating the initial knowledge graph based on the attack chain fusion information to obtain a network security knowledge graph.

[0005] Further, the obtaining of multi-source data of network security application scenarios for distributed processing to obtain a security data set comprises: Data sharding is performed on the multi-source data, and the multi-source data is distributed to corresponding distributed computing nodes to obtain node data shards; Feature conversion is performed on the node data shards to obtain security feature data; Event clustering is performed based on the security feature data to obtain a security event clustering result; The security event clustering result is matched with a preset threat model library in a label mode to obtain labeled security data; The labeled security data is integrated by association rules to obtain the security data set.

[0006] Further, the security data set is stored and managed in a structured manner and security knowledge is extracted to obtain an initial knowledge graph, including: Semantic annotation mapping is performed on the security data set to obtain semantic attribute information; Ontology structure definition representation is performed based on the semantic attribute information to obtain an initial target representation; Entity boundaries of the initial target representation are identified, and relationship associations are performed to obtain multiple types of associated relationships; The multiple types of associated relationships between entities are merged with the initial target representation in a graph structure to obtain a relationship-enhanced graph structure; The relationship-enhanced graph structure is stored and indexed to optimize the network security data structure; Security entity knowledge is extracted from the network security data structure to obtain an initial knowledge graph.

[0007] Further, the security entity knowledge is extracted from the network security data structure to obtain an initial knowledge graph, including: Security entity identification is performed on the network security data structure to obtain a preliminary security entity set; Entity type classification is performed on the preliminary security entity set to obtain a security entity type library; Attribute feature extraction is performed on the preliminary security entity set based on the security entity type library to obtain a security entity attribute table; Semantic relationship identification is performed on the security entity attribute table to obtain a semantic relationship triple; The semantic relationship triple is matched with the network security data structure to perform relationship reasoning and graph construction to obtain the initial knowledge graph.

[0008] Further, the initial knowledge graph is used to predict and construct zero-day attacks to obtain potential attack data, including: Entity node extraction and attack pattern analysis are performed based on the initial knowledge graph to obtain an implicit attack pattern; According to the preset graph attention network, multi-hop edge prediction is performed on the implicit attack mode, and potential connection information is obtained. According to the potential connection information, a heterogeneous hierarchy is constructed and a graph structure attack is identified, and an attack virtual node set is obtained. Zero-day feature extraction is performed on the attack virtual node set, and a zero-day attack vector is obtained. Network topology vulnerability identification is performed on the potential connection information, and combined penetration analysis is performed with the zero-day attack vector, and vulnerability chain analysis information is obtained. The vulnerability chain analysis information is fused with the initial knowledge graph, and the potential attack data is obtained.

[0009] Further, the potential attack data is fused with the initial knowledge graph to obtain attack chain fusion information, including: According to the potential attack data, hierarchical similar clustering is performed on the initial knowledge graph, and an attack association structure is obtained. According to the attack association structure, path search is performed on the initial knowledge graph, and a potential attack path set is obtained. Attack probability evaluation is performed on the potential attack path set, and a weighted attack path is obtained. According to the weighted attack path, edge relationship construction is performed on the initial knowledge graph and the potential attack data, and a semantic attack chain is obtained. According to the semantic consistency attack chain, information fusion is performed on the potential attack data and the initial knowledge graph, and the attack chain fusion information is obtained.

[0010] Further, the real-time event data of the network security application scene is obtained, and the initial knowledge graph is dynamically iteratively updated according to the attack chain fusion information, and a network security knowledge graph is obtained, including: Abnormal detection and semantic labeling are performed on the real-time event data, and a semantic threat event is obtained. The semantic threat event is matched with the initial knowledge graph for entity association, and an entity mapping relationship is obtained. According to the entity mapping relationship, path analysis is performed on the attack chain fusion information, and a target attack chain path is obtained. According to the initial knowledge graph, node relationship incremental adjustment is performed on the target attack chain path, and an incremental knowledge subgraph is obtained. According to the incremental knowledge subgraph, the initial knowledge graph is iteratively updated and optimized, and the network security knowledge graph is obtained.

[0011] The application also provides a network security knowledge graph construction device, which is applied to the network security knowledge graph construction method described above. The collection module is used for acquiring multi-source data of a network security application scenario, performing distributed processing, and obtaining a security data set; The analysis module is used for performing structured storage management and security knowledge extraction on the security data set, and obtaining an initial knowledge graph. The processing module is used for performing zero-day attack prediction construction based on the initial knowledge graph, and obtaining potential attack data. The control module is used for performing path fusion association on the potential attack data and the initial knowledge graph, and obtaining attack chain fusion information. The execution module is used for acquiring real-time event data of the network security application scenario, and performing dynamic iterative updating on the initial knowledge graph based on the attack chain fusion information, and obtaining a network security knowledge graph.

[0012] The application further provides a network security knowledge graph construction device, comprising: A memory is used for storing a program. A processor is used for executing the program, and realizing each step of the network security knowledge graph construction method.

[0013] The application further provides a storage medium, which stores computer instructions for making a computer execute the method.

[0014] The network security knowledge graph construction method, device, equipment and storage medium provided by the application have the following beneficial effects: By distributed processing and structured storage management of multi-source data, the network security data structure can be more comprehensively and accurately constructed, thereby improving the completeness and accuracy of the initial knowledge graph. Compared to traditional methods that rely on a single data source, this method integrates information from multiple data sources, enabling the knowledge graph to more comprehensively reflect the complex knowledge system in the network security field. By extracting security entity knowledge from the network security data structure, various security entities and their relationships can be effectively identified and represented, providing a reliable foundation for the construction of the initial knowledge graph. This process not only enhances the ability to identify known attack patterns, but also provides data support for subsequent knowledge reasoning and fusion. Based on the initial knowledge graph, zero-day attack prediction construction can be carried out to discover potential attack data in advance and provide early warning for unknown threats. By fusing and associating potential attack data with the initial knowledge graph, attack chain fusion information is formed, which can better reveal the internal logical relationships of complex attack chains and improve the ability to identify advanced persistent threats. This fusion process helps to achieve comprehensive analysis and deep understanding of attack paths, thereby providing more accurate information support for security defense decisions. Real-time acquisition of security event data in network security application scenarios and dynamic iterative updating with attack chain fusion information can ensure the timeliness and practicality of the network security knowledge graph. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 is a network security knowledge graph construction method flowchart provided by the present application; Figure 2 is a network security knowledge graph construction device structure diagram provided by the present application; Figure 3 is a network security knowledge graph construction device structure diagram provided by the present application.

[0016] The objectives, functional features and advantages of the present application will be further described with reference to the accompanying drawings. DETAILED DESCRIPTION

[0017] In order to make the objectives, technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0018] The present application will be further described below with reference to the accompanying drawings and specific embodiments.

[0019] Referring to Figure 1 , the present application provides a network security knowledge graph construction method, comprising: Step S1: Obtain multi-source data of network security application scenarios, perform distributed processing, and obtain a security data set; Step S2: Structured storage management and security knowledge extraction of security data set, to obtain an initial knowledge graph; Step S3: Based on the initial knowledge graph, zero-day attack prediction construction is carried out, and potential attack data is obtained; Step S4: Path fusion association of potential attack data and initial knowledge graph is carried out, and attack chain fusion information is obtained; Step S5: Obtain real-time event data of network security application scene, and dynamically update the initial knowledge graph with the attack chain fusion information, to obtain a network security knowledge graph.

[0020] Based on the above steps, the detailed step process is as follows: Step S1: The multi-source data in the field of network security usually includes network traffic logs, system logs, application program logs, firewall logs, intrusion detection system (IDS) alarms and vulnerability database information, etc. These data come from different devices, systems and platforms, and have different formats and large quantities. Distributed processing frameworks such as Hadoop or Spark are used to process these heterogeneous data to ensure high efficiency and scalability. The data processing process involves several key operations: data cleaning to remove noise, duplication and incomplete records; format unification to create consistent data representation; feature extraction to identify attack indicators and security event patterns; and data standardization to ensure that data from different sources can be effectively compared. In addition, in order to ensure data quality, data verification and integrity check are performed, and abnormal values and irrelevant information are removed. The output of this processing flow is a structured security data set containing cleaned, standardized and featured records, which lays the foundation for subsequent knowledge graph construction. This security data set contains not only known security threats and vulnerability information, but also benchmark data of normal network behavior, providing reference for anomaly detection.

[0021] Step S2: Transforming unstructured security data into structured data with explicit relationships and attributes. When designing the data model, consider the core concepts and entities in the cybersecurity domain, including attackers, attack techniques, vulnerabilities, affected systems, threat indicators, and defensive measures. Use a graph database management system (such as Neo4j or JanusGraph) to store these structured data, supporting complex relationship queries and traversals. The data structure design follows the principles of ontology, defining entity types, relationship types, and attribute sets. In the process of modeling relationships between entities, identify and define key relationship types, such as the "exploit" relationship connecting attack techniques and vulnerabilities, the "impact" relationship connecting vulnerabilities and system components, and the "mitigate" relationship connecting defensive measures and vulnerabilities. Data normalization ensures that information from different sources can be uniformly mapped to the designed structure. In addition, establish indexing and query optimization structures to improve the efficiency of subsequent knowledge graph queries. The network security data structure produced in this step is a richly related data framework, containing clear definitions of entities, relationships, and attributes, providing a structured foundation for entity knowledge extraction.

[0022] The knowledge extraction process uses natural language processing techniques to identify key entities, relationships, and attributes from unstructured text. Named Entity Recognition (NER) technology is applied to identify security entities in the text, such as malware names, attacker organizations, and vulnerability identifiers. Relationship extraction technology is used to determine the semantic associations between entities, such as a specific attack organization using a particular attack technique or a vulnerability existing in a specific software version. Attribute extraction extracts entity features from text, such as vulnerability severity, discovery date, or exploit difficulty. Knowledge fusion techniques are used to integrate information about the same entity from different sources, solving the entity alignment problem. Ontology mapping maps the extracted knowledge to a predefined security ontology model, ensuring consistency in knowledge representation. Knowledge reasoning mechanisms are used to infer implicit relationships, enriching the knowledge graph. Through the above process, an initial knowledge graph is formed, which contains key entities and their complex relationship networks in the cybersecurity domain, presenting a panoramic view of security threats, vulnerabilities, and their associations. This initial knowledge graph serves as the basis for subsequent zero-day attack prediction and is the core carrier for dynamic update and iteration.

[0023] Step S3: Zero-day attacks pose a significant challenge to network security due to their undiscovered nature. Through in-depth analysis of the initial knowledge graph, potential attack paths and threat patterns can be identified. Graph analysis techniques are applied to detect abnormal structures and patterns in the knowledge graph, identifying potential security vulnerabilities. Similarity analysis methods compare the feature similarity between known attacks and potential vulnerabilities, inferring possible attack vectors. Deep learning algorithms such as graph neural networks are trained on existing attack data to predict unknown vulnerabilities and attack methods. Attack graph technology constructs possible attack links, simulating penetration paths from the attacker's perspective. The MITRE ATT&CK framework is used to supplement existing knowledge and enrich attack technique descriptions. Through comprehensive multidimensional analysis, a potential attack database is constructed, containing predicted attack techniques, possible vulnerabilities, potential attack vectors, and their possible impact on systems or components. These virtual knowledge, although not observed in reality, are based on existing knowledge reasoning and represent the potential threat possibilities in the current network environment. Virtual knowledge is accompanied by a credibility score, reflecting the estimated accuracy of the prediction. This prediction result provides a forward-looking perspective for network security defense, allowing organizations to take preventive measures before attacks actually occur.

[0024] Step S4: Path fusion correlation analysis integrates predicted attack paths with known threat knowledge, focusing on attack chain thinking. Graph path analysis techniques are applied to identify complete attack links from initial access points to target assets. Similarity measurement algorithms calculate the matching degree between virtual attack paths and historical attack patterns, evaluating the feasibility of predicted attacks. Knowledge graph reasoning engines perform relationship expansion, filling logical gaps in the attack chain. Based on the Kill Chain model or MITRE ATT&CK tactic classification, attack paths are structured mapped according to attack stages, presenting the timing characteristics of the attack process. Conflict resolution mechanisms handle contradictions between virtual knowledge and known knowledge, ensuring the consistency of the fusion results. Attack chain visualization technology converts complex relationships into intuitive graphical representations, facilitating security analysts' understanding. Through this fusion process, attack chain fusion information is generated, which presents a complete attack scenario—from initial attack vectors, intermediate penetration steps to final targets, containing a comprehensive view of known threats and predicted threats. This fusion information not only describes the sequence of actions that attackers may take, but also identifies key nodes that represent strategic points where defenders can intervene, providing tactical-level guidance for security policy development.

[0025] Step S5: Real-time event data continuously flows into the system, including newly discovered vulnerability information, the latest attack techniques, threat intelligence updates, and alert data generated by internal security monitoring of the organization. The real-time data stream processing engine processes these data in real time, extracting key information. The knowledge graph update mechanism compares new information with existing attack chain fusion information, verifies the accuracy of the prediction, and adjusts the weights of related nodes and relationships accordingly. The feedback learning algorithm analyzes the differences between the prediction results and the actual observed attack behavior, optimizing the prediction model. The time series analysis method captures the evolution trend of attack patterns, reflecting the dynamic changes of the threat situation. The knowledge forgetting mechanism periodically evaluates the timeliness of the information in the graph, reducing the weight of outdated information or archiving it. The version control system records the evolution history of the knowledge graph, supporting backtracking analysis. Through this continuous iterative updating process, the initial knowledge graph gradually develops into a comprehensive, accurate, and timely network security knowledge graph. This knowledge graph not only contains rich historical threat information, but also integrates predictive threat models and real-time security situation, forming a dynamic representation system of network security knowledge. This mature knowledge graph becomes an important support tool for security decision-making, providing a knowledge base for threat detection, vulnerability management, risk assessment, and security policy formulation.

[0026] The network security knowledge graph construction method provided by the application can more comprehensively and accurately construct a network security data structure by distributed processing and structured storage management of multi-source data, thereby improving the completeness and accuracy of the initial knowledge graph. Compared with traditional methods that rely on a single data source, this method integrates information from multiple data sources, enabling the knowledge graph to more comprehensively reflect the complex knowledge system in the field of network security. By extracting security entity knowledge from the network security data structure, various security entities and their relationships can be effectively identified and represented, providing a reliable foundation for the construction of the initial knowledge graph. This process not only improves the ability to identify known attack patterns, but also provides data support for subsequent knowledge reasoning and fusion. Based on the initial knowledge graph, zero-day attack prediction construction can be performed to discover potential attack data in advance and provide early warning for unknown threats. By correlating potential attack data with the initial knowledge graph through path fusion, attack chain fusion information is formed, which can better reveal the internal logical relationships of complex attack chains and improve the ability to identify advanced persistent threats. This fusion process helps to achieve comprehensive analysis and deep understanding of attack paths, thereby providing more accurate information support for security defense decision-making. Real-time acquisition of security event data in network security application scenarios and dynamic iterative updating with attack chain fusion information can ensure the timeliness and practicality of the network security knowledge graph.

[0027] In one embodiment, multi-source data of network security application scenarios is acquired, distributed processing is performed, and a security data set is obtained, including: For multi-source data in network security application scenarios, including but not limited to network traffic logs, system logs, firewall logs, intrusion detection system alarm information, etc., the embodiment adopts data sharding technology to process these data. The data sharding technology divides large-scale data into multiple smaller data segments according to the attributes of the data such as timestamp, source IP address or data type. Each data segment is assigned to a corresponding distributed computing node to form a node data shard. The node data shard technology uses Hadoop Distributed File System (HDFS) to store these data segments, enabling parallel processing and efficient access of data. The processing result of the node data shard is a set of data segments stored on different computing nodes, each containing part of the original security data.

[0028] After obtaining the node data shard, the embodiment performs feature conversion on each data segment. The feature conversion uses the TF-IDF (Term Frequency-Inverse Document Frequency) algorithm and the Word2Vec word embedding technology to convert unstructured or semi-structured security data into numerical feature vectors. For network traffic data, extract features such as source IP address, destination IP address, port number, protocol type; for system logs, extract features such as operation type, user ID, timestamp; for alarm information, extract features such as alarm level, alarm type, attack type. The processing result of feature conversion is security feature data, i.e. a set of feature vectors with fixed dimensions, each vector representing a security event record.

[0029] Based on the security feature data, event clustering is performed by using K-means clustering algorithm and DBSCAN density clustering algorithm. The clustering algorithm calculates the Euclidean distance or cosine similarity between feature vectors to group similar security events into a class. The K-means algorithm sets the number of clusters K to be the number of predefined security event types, while the DBSCAN algorithm automatically determines the number of clusters by setting the density threshold ε and the minimum sample size MinPts. During the clustering process, the distributed computing framework SparkMLlib is used for parallel computing to improve clustering efficiency. The processing result of event clustering is the security event clustering result, i.e. a set of security event collections with similar features, each representing a potential security threat or abnormal behavior.

[0030] The next step of the embodiment is to perform label pattern matching between the security event clustering results and a preset threat model library. The threat model library contains definitions of known network attack patterns, malware behavior characteristics, abnormal access patterns, and other threat models. The label pattern matching adopts a method combining a rule-based matching algorithm and a machine learning classifier (such as random forest and support vector machine). During the matching process, the similarity score between the clustering results and the threat models is calculated, and when the similarity exceeds a preset threshold (usually set to 0.75), the corresponding threat label is assigned to the clustering group. The processing result of the label pattern matching is labeled security data, that is, each piece of security event data is labeled with a corresponding threat type label, such as "SQL injection attack", "DDoS attack", "credential theft", and the like.

[0031] The last step of constructing the security data set is to perform association rule integration on the labeled security data. The association rule integration adopts the Apriori algorithm and the FP-Growth algorithm to mine the association rules between security events. The form of the association rule is "if event A occurs, then event B has a probability of x% of occurring". The screening criteria for the association rules include a support degree of not less than 0.05, a confidence degree of not less than 0.7, and a lift degree greater than 1.5. The association rule integration process also includes rule redundancy detection and rule merging to reduce the number of rules and improve the quality of the rules. The processing result of the association rule integration is a security data set, which not only contains labeled security event data but also contains the association relationships between events, providing a data foundation for the subsequent construction of a knowledge graph.

[0032] The embodiment realizes efficient processing and analysis of large-scale security data by using distributed processing technology to process multi-source network security data, overcomes the computing bottleneck of traditional centralized processing when facing massive data, and significantly improves the data processing efficiency. Based on the feature conversion and event clustering technology, unstructured security data can be converted into structured data with clear semantics, greatly improving the utilization value and analysis depth of security data. By performing label pattern matching between the security event clustering results and the preset threat model library, the automatic identification and classification of security events are realized, the workload of manual analysis is reduced, and the accuracy and real-time performance of security threat detection are improved. The association rule integration on the labeled security data mines the internal association relationships between security events, provides data support for security situation awareness and predictive defense, and enhances the foresight and initiative of network security protection.

[0033] In one embodiment, the security data set is structured and stored, and security knowledge is extracted to obtain an initial knowledge graph, including: A rule-based and machine learning combined approach is used for semantic annotation mapping of security datasets. This process uses a predefined security terminology dictionary and semantic framework to process network security text data through named entity recognition (NER) techniques. The semantic annotation system identifies key information such as vulnerability descriptions, attack methods, and threat behaviors in the text and maps them to standardized semantic categories. For example, "CVE-2021-44228" is identified as a vulnerability entity, and "remote code execution" is labeled as an attack type. This step uses a BiLSTM-CRF neural network model to process large-scale security corpora, achieving high-precision entity recognition and semantic classification. Text cleaning, tokenization, and normalization operations are introduced in the data preprocessing stage to ensure the accuracy of semantic annotation. After semantic annotation mapping is complete, semantic attribute information containing entity types, attributes, and preliminary semantic relationships is formed.

[0034] Based on the obtained semantic attribute information, a security domain knowledge ontology structure is constructed. The ontology structure adopts a hierarchical design, with the top layer containing five core concept classes: "vulnerability", "attack", "threat", "asset", and "defense". Each core concept class has multiple levels of sub-classes, such as "application vulnerability", "system vulnerability", and "network vulnerability" under "vulnerability". Concepts are connected through "is-a" and "part-of" relationships to form a semantic network. In terms of attribute definition, each concept class is set with identifiers, descriptions, severity, and other basic attributes, as well as domain-specific attributes. The ontology model design follows the principles of completeness, consistency, and scalability, and the logical consistency of the ontology structure is verified through automatic reasoning. After the ontology structure is defined, a formal knowledge representation framework for the security domain is established, i.e., the security domain knowledge ontology.

[0035] After the completion of the security domain knowledge ontology, instantiation processing is performed. The instantiation process adopts a semi-automatic approach combined with machine extraction strategies. Structured information is extracted from standardized security repositories (such as CVE, CWE, CAPEC, etc.), and entity instances are extracted from unstructured text such as security reports and threat intelligence. The instantiation stage uses RDF triples (subject-predicate-object) to represent knowledge, and each entity instance contains a unique identifier and type label. Data normalization processing ensures that attribute values comply with the constraints defined by the ontology. Entity alignment techniques solve the problem of entity redundancy in different sources of data, and determine entity equivalence through character similarity, semantic similarity, and other multi-dimensional features. A typical example of an instance triple is "<CVE-2021-44228, exploitedBy, Log4Shell attack>". After instantiation processing is complete, an initial goal representation containing rich entities and their relationships is formed.

[0036] The initial graph structure is processed by boundary entity identification to form an initial target representation. Boundary entities refer to core entities that are important in security analysis. The identification process combines centrality calculation and expert rules. By calculating the degree centrality, closeness centrality, and betweenness centrality of each entity in the graph structure, key nodes in the network structure are identified. In addition, according to pre-set entity importance evaluation rules, such as the CVSS score of vulnerabilities and the impact range of threats, high-value entities are further screened. The boundary entity identification algorithm also considers the semantic relevance between entities and uses a knowledge propagation-based algorithm to calculate the entity importance score. A threshold is set to filter low-importance entities and retain core entities and their first-order neighbor nodes. After boundary entity identification, an initial target representation with appropriate size and high information density is obtained.

[0037] Relationship extraction is performed on the initial target representation to establish multiple types of association relationships between entities. Relationship extraction uses a deep learning method based on distant supervision combined with a graph attention network (GAT) mechanism. A set of safety field-specific relationship types is predefined, including "exploits" (exploits), "mitigates" (mitigates), "affects" (affects), "detects" (detects), and other core relationship types. The relationship extraction model is trained using a labeled dataset containing positive examples and automatically generated negative examples. During the extraction process, a relationship confidence score mechanism is introduced to retain only high-confidence relationship instances. For time-series relationships, such as the time difference between vulnerability disclosure and exploitation, a time attribute is added. Complex relationship representation uses an attribute-based relationship pattern to encode multi-dimensional relationship attributes into relationship instances. After relationship extraction, a set of multiple types of association relationships between entities expressing rich security semantics is formed.

[0038] The extracted multiple types of association relationships are merged with the initial target representation to form a relationship-enhanced graph structure. The merging process uses an attribute graph model, with nodes representing entities and edges representing relationships, and both nodes and edges can have attributes. The merging algorithm first constructs a basic graph framework, with entities in the initial target representation as nodes. Then, the extracted relationships are added to the graph as edges to form connections. For conflicting relationships (such as contradictory relationship types), a confidence comparison and timeliness evaluation is used to determine the retention strategy. In the graph structure optimization phase, a graph simplification algorithm is applied to merge semantically similar relationships and delete redundant paths. The merging process maintains the uniqueness of nodes and edges to avoid duplication. After merging, a relationship-enhanced graph structure with rich semantic connections is generated, which contains entity nodes, relationship edges, and their respective attribute information.

[0039] The relationship-enhanced graph structure is stored and indexed by sharding to achieve efficient access. The graph is divided into multiple sub-graphs according to entity types and relationship densities based on an attribute-based graph sharding strategy. The sharding design follows the principle of "high cohesion and low coupling" to minimize the number of cross-shard edges. Each shard is configured with an independent storage unit to support parallel processing. The index system is built in three levels, including entity index, relationship index, and attribute index. The entity index is implemented based on B+ tree to support fast query, the relationship index uses an adjacency list structure to support efficient graph traversal, and the attribute index uses an inverted index to accelerate attribute-based retrieval. For high-frequency query patterns, hotspot path results are pre-computed and cached. The data access layer supports both SPARQL and Cypher query languages to provide a unified graph access interface. The index update adopts an incremental update strategy to only rebuild the changed part. After the sharding storage and index optimization, a high-performance and scalable network security data structure is formed to support efficient management and query of large-scale security knowledge.

[0040] Finally, the network security data structure is subjected to security entity knowledge extraction to obtain an initial knowledge graph.

[0041] In this embodiment, the semantic annotation mapping and ontology structure definition are combined to realize the standardized and formalized representation of security domain knowledge, effectively solving the problems of high data heterogeneity and complex semantics in network security. The boundary entity recognition technology filters out high-value security entities, significantly improving the information density and practicality of the graph. The relationship extraction method based on remote supervision establishes multiple types of relationships between entities, enhancing the semantic expression ability of the knowledge graph and making the logical connection between security knowledge clearer. The attribute graph model and conflict processing strategy applied in the graph structure merging process ensure the consistency and accuracy of the graph structure. The sharding storage and multi-level index optimization technology greatly improve the query efficiency of large-scale security knowledge graph, supporting parallel processing and fast response under high-frequency query patterns. The network security knowledge graph constructed by this method provides a solid knowledge foundation for security situation awareness, threat tracing, and vulnerability analysis, and enhances the intelligent level of the network security defense system.

[0042] In one embodiment, the network security data structure is subjected to security entity knowledge extraction to obtain an initial knowledge graph, including: The network security data structure is subjected to security entity knowledge extraction to obtain an initial knowledge graph. This process first identifies security entities from the network security data structure to form a preliminary set of security entities. Security entity recognition is accomplished by a pre-set entity recognition algorithm that can detect various security-related entities from network data, such as IP addresses, domain names, file hash values, etc. The identified set of entities is the basis for subsequent steps.

[0043] The preliminary set of security entities is classified by entity type to obtain a security entity type library. Entity type classification is performed according to predefined entity type rules, and each entity is classified into a corresponding type by analyzing its characteristics. For example, IP address type, domain name type, file type, etc., which can effectively organize and manage different types of security entities.

[0044] On the basis of the entity type library, attribute features are extracted from the preliminary set of security entities to form a security entity attribute table. Attribute feature extraction is performed by analyzing the specific attributes of each entity, such as the geographical location and network segment to which an IP address belongs. The extracted attributes are recorded in the security entity attribute table, providing rich description information for each entity.

[0045] The security entity attribute table is subjected to entity relationship extraction to obtain a set of inter-entity relationships. Entity relationship extraction is achieved through a pre-set relationship extraction algorithm, which can identify the association between entities, such as the resolution relationship between IP addresses and domain names, and the association between file hash values and malware. The resulting set of inter-entity relationships can reveal the interactions between network security entities.

[0046] Based on the set of inter-entity relationships, the security entity attribute table is subjected to semantic annotation to generate semantic relationship triples. Semantic annotation involves semantic analysis of entities and their relationships to form triples with semantic meaning (entity-relation-entity), such as (IP address A-resolution-domain name B). These triples provide a semantic-level explanation of entity relationships.

[0047] After the formation of semantic relationship triples, entity disambiguation is performed to obtain a disambiguated relationship structure. Entity disambiguation is accomplished through a disambiguation algorithm, which aims to solve the problem of homonymy, such as the same IP address in different contexts may represent different entities. The disambiguation algorithm will distinguish different entities based on context information and attribute features to form a disambiguated relationship structure.

[0048] On this basis, relationship reasoning calculation is performed based on the disambiguated relationship structure to obtain a set of implicit relationships. Relationship reasoning calculation uses a reasoning algorithm to infer implicit relationships from known entity relationships. For example, by analyzing the relationship between IP addresses and domain names, potential attack paths can be inferred. The set of implicit relationships contains these inferred potential relationships.

[0049] The formula for relationship reasoning calculation includes: ; KnightRider( , ) : entity between the entities; between the entities; : confidence score of entity e, reflecting the reliability of entity recognition : conditional probability of entity e given the existence of entity e : conditional probability of entity e given the existence of entity e : time decay function, decreasing with the increase of the time interval between two entities; Conf(e): confidence score of entity e, reflecting the reliability of entity recognition , : semantic distance of entity e in the knowledge graph topology space.

[0050] The initial knowledge graph is obtained by fusing the set of implicit relationships and the disambiguated relationship structure. The fusion process combines explicit and implicit entity relationships to form a complete knowledge graph. This initial knowledge graph contains rich network security entities and their mutual relationships, providing strong support for network security analysis and threat detection.

[0051] In this embodiment, a multi-step entity recognition and classification mechanism is introduced in the construction process of the network security knowledge graph, which more accurately identifies and organizes network security entities. According to the different characteristics of network security data, the entity can be flexibly classified by type and its attribute features extracted, so that the initial knowledge graph has more rich entity information, thereby enhancing the degree of data structuring. In the entity relationship extraction and semantic annotation stage, through the automatic relationship recognition and annotation technology, the relationship between entities can be accurately expressed, even in complex data environment, the potential relationship between entities can be effectively identified and presented. The combination of entity disambiguation and relationship reasoning makes the knowledge graph not only solve the problem of homonymy, but also infer the implicit association relationship, which strengthens the reasoning ability and accuracy of the knowledge graph. Through the fusion of the set of implicit relationships and the disambiguated relationship structure, the completeness and consistency of the knowledge graph are realized, which can provide comprehensive support for network security analysis, and improve the efficiency and accuracy of security threat detection.

[0052] In one embodiment, based on the initial knowledge graph, a zero-day attack prediction is constructed to obtain potential attack data, including: Entity node extraction is performed on the initial knowledge graph to obtain the entity evolution node set. The specific operation of this step is to extract all security-related entity nodes from the initial knowledge graph through a graph structure analysis algorithm. These nodes may include network devices, software components, user accounts, etc. The extracted entity nodes constitute the entity evolution node set, which is the basis data for subsequent analysis.

[0053] Based on the set of entity evolution nodes, the initial knowledge graph is analyzed for attack patterns, obtaining implicit attack patterns. Attack pattern analysis is achieved by analyzing the correlation between entity evolution nodes and historical attack data, and mining potential attack paths and patterns. In this step, machine learning and data mining techniques, especially graph neural networks (GNNs), are used to identify attack patterns that are common in historical attacks but not apparent in the current graph. Implicit attack patterns are obtained by inferring and analyzing these correlations, providing a basis for edge prediction in subsequent steps.

[0054] According to the preset graph attention network, the implicit attack pattern is subjected to multi-hop edge prediction, obtaining potential connection information. Graph Attention Network (GAT) is an advanced graph neural network model that achieves more accurate prediction through attention mechanisms for nodes and edges. Here, the preset graph attention network is used to predict multi-hop edges of the implicit attack pattern, i.e., to predict attack paths that may exist but have not been discovered. Potential connection information is obtained by integrating these predicted edges, showing all possible attack paths in the network.

[0055] According to the potential connection information, a heterogeneous hierarchical space is constructed, obtaining an attack path candidate space. Heterogeneous hierarchical space construction refers to constructing a hierarchical space structure based on potential connection information, according to the characteristics of different types of nodes and edges in the network. In this structure, different levels represent different types of attack paths, and the attack path candidate space is thus constructed. This space includes all possible attack paths, arranged in different levels, which helps subsequent analysis and deduction.

[0056] Feasibility deduction is performed on the attack path candidate space, obtaining a confidence distribution graph. Feasibility deduction is a feasibility analysis of each path in the attack path candidate space, to determine its likelihood of being exploited in the actual network. By simulating attack behavior and environment, the confidence of each path, i.e., its probability of being successfully exploited, is calculated. The confidence distribution graph shows the confidence distribution of all candidate paths, providing a basis for further identification and inference.

[0057] The confidence distribution graph is subjected to graph structure variational identification and inference, obtaining an attack virtual node set. Graph structure variational identification and inference is a graph structure analysis method based on variational inference, which identifies and infers high-confidence paths in the confidence distribution graph to determine potential attack nodes that have not yet been discovered. The attack virtual node set consists of these inferred virtual nodes, which are potential attack targets and starting points.

[0058] Zero-day feature extraction is performed on the attack virtual node set to obtain a zero-day attack vector. Zero-day feature extraction refers to extracting feature information related to zero-day attacks from the attack virtual node set, including node attributes, association relationships, and historical data. The zero-day attack vector is obtained through comprehensive analysis of these feature information, which represents possible zero-day attack methods and means.

[0059] By analyzing the nodes and edges in the potential connection information, weak links are identified. Various vulnerability assessment methods are used, including node vulnerability assessment, edge vulnerability assessment, and attack path analysis. Node vulnerability assessment evaluates the vulnerability of each node by analyzing its attributes, historical vulnerability records, current patch status, externally exposed services, and ports. For example, some nodes may be running known vulnerable software versions or have multiple high-risk ports open. Edge vulnerability assessment evaluates the vulnerability of edges by analyzing the connection relationships and data flows between nodes. For example, some edges may transmit sensitive data or connect two high-risk nodes, making these edges more attractive to attackers. Attack path analysis identifies paths in the potential connection information that may be exploited by attackers through path analysis algorithms (such as shortest path, maximum flow path, etc.), which may be the best choice for attackers to move and expand their attack range in the network.

[0060] After vulnerability assessment, high-vulnerability nodes and edges are identified in the potential connection information, which constitute potential attack targets and paths. Next, the identified vulnerabilities are combined with zero-day attack vectors for penetration analysis. Zero-day attack vectors are extracted from attack virtual node sets, including specific attack techniques, tools, and strategies. Combined with these attack vectors, penetration analysis is performed on the vulnerabilities in the potential connection information.

[0061] During the simulation penetration analysis process, the zero-day attack vector is used to simulate the attacker starting from a high-vulnerability node or edge and gradually penetrating other parts of the network. This process includes exploiting known vulnerabilities, implementing social engineering attacks, bypassing security controls, etc. During the attack simulation process, the attack path is gradually expanded, and the attack means and success probability of each step are recorded. Path expansion considers various strategies that attackers may take, including lateral movement, privilege escalation, data theft, etc. The success rate of each expanded path is evaluated to calculate its feasibility in actual attacks, which combines historical attack events, current network protection measures, and the effectiveness of zero-day attack vectors.

[0062] By integrating all simulated attack paths and their success rates, vulnerability chain analysis information is obtained. The vulnerability chain analysis information includes all possible attack paths, exploitation methods, and the success probability of each path, providing an important reference for the development of network defense measures. The specific content includes an attack path list, which lists all identified potential attack paths, each path detailing the starting point, attack steps, and endpoint of the attack; attack means and tools, which describe the specific attack means and tools used in each path, such as exploiting a software vulnerability, implementing a phishing attack, etc.; success probability, which assigns a success probability value to each attack path, indicating the likelihood of being successfully exploited in an actual attack.

[0063] By integrating the vulnerability chain analysis information with the initial knowledge graph, an updated knowledge graph is formed. This updated graph contains new attack path and node information, providing comprehensive knowledge support for further security protection and risk management.

[0064] By integrating the vulnerability chain analysis information with the initial knowledge graph, potential attack data is obtained. By adding newly discovered attack paths and node information to the knowledge graph, an updated graph containing potential attack data is formed. This graph displays all possible attack paths and nodes in the network, providing comprehensive knowledge support for network security protection.

[0065] This embodiment provides a comprehensive method for predicting unknown attacks based on the initial knowledge graph, significantly improving network security defense capabilities. This method can identify implicit attack patterns that traditional security systems cannot detect through entity node extraction and attack pattern analysis. Using a graph attention network for multi-hop edge prediction, high-precision prediction of potential attack paths is achieved, avoiding the limitations of relying only on known attack features. The combination of heterogeneous hierarchical space construction and feasibility deduction makes attack path evaluation in complex network environments more accurate and reduces false positive rates. Through graph structure variational identification inference technology, potential attack virtual nodes can be accurately identified, providing a forward-looking perspective for zero-day attack defense. The combination of zero-day feature extraction and network topology vulnerability identification enables comprehensive analysis of vulnerability chains, allowing security teams to prioritize high-risk threats. The final potential attack data provides data support for security decisions, enabling defense measures to shift from passive response to proactive prevention, significantly reducing the exposure window of security vulnerabilities and improving the overall resilience of the network security system.

[0066] In one embodiment, the potential attack data is path-fused and associated with the initial knowledge graph to obtain attack chain fusion information, including: The potential attack data contains various attack techniques, tools, vulnerabilities, and attacker behavior patterns. The attack intent extraction process uses semantic analysis techniques to process this knowledge. The extraction process uses an attention mechanism combined with a BERT pre-trained model to identify key verbs, target nouns, and impact degree words from attack description texts. The system assigns different weights to different types of words, such as a destructive verb weight of 0.8, a sensitive system noun weight of 0.9, and a severity level word weight of 0.7. A 512-dimensional attack intent vector is generated by weighting and summing the word vectors. This vector represents the purpose, target, and severity of the attack in a high-dimensional space, providing a foundation for subsequent steps.

[0067] The processing result of attack intent extraction is a high-dimensional attack intent vector corresponding to each potential attack data entry. These vectors capture the core features and target direction of the attack.

[0068] Based on the attack intent vector, the entities in the initial knowledge graph are hierarchically clustered. The clustering algorithm uses hierarchical clustering to calculate the cosine similarity between the attack intent vector and the vectors of each entity in the knowledge graph. The similarity threshold is set to 0.75, and entities with a similarity above this threshold are considered potential related entities. The clustering process uses a bottom-up agglomeration approach, where each entity is initially a separate cluster. Then, clusters are merged based on similarity until a pre-set number of clusters is reached or the similarity falls below the threshold. The default clustering depth is set to three levels, forming a hierarchical structure of upper-level categories, middle-level categories, and specific entities.

[0069] The processing result of hierarchical similarity clustering is the attack association structure, which organizes a set of entities related to potential attacks in a tree-like manner, from high to low relevance, facilitating subsequent path search.

[0070] Based on the attack association structure, path search is performed in the initial knowledge graph. The search uses a bidirectional breadth-first search algorithm to explore possible paths connecting the attack starting and ending points from the attack-related entities. The search depth is limited to 6 hops to avoid the decrease in relevance caused by excessively long paths. The path scoring function combines path length (weight 0.3), node relevance (weight 0.4), and edge relationship strength (weight 0.3) for comprehensive evaluation. The system selects paths with a score above the threshold of 0.6 to form a set of potential attack paths.

[0071] The processing result of path search is a set of potential attack paths, containing multiple possible paths from the attack source to the target, each composed of a series of nodes and their connections.

[0072] The attack probability of each path in the set of potential attack paths is evaluated. The evaluation model combines Bayesian networks and Markov processes, considering the vulnerability score of each node in the path (0-1), the success rate of attack techniques (based on CVSS score conversion), and the transition difficulty coefficient between nodes (0-10). The system trains the transition probability matrix based on historical attack data, and uses a probability estimation method based on attribute similarity for new attacks that lack historical data. The overall attack probability of the path is calculated by multiplying the probabilities, and is normalized to the range of 0-1.

[0073] The processing result of attack probability evaluation is the weighted attack path, which is the set of potential attack paths with attack success probability weights. The weight value reflects the feasibility and threat level of the attack path.

[0074] Based on the weighted attack path, the edge relationship between the initial knowledge graph and the potential attack data is constructed. The construction process follows the relationship extraction rules based on the semantic framework, identifying the semantic relationship types between entities in the path, such as "exploit", "impact", "cause", etc. The relationship type threshold is set to 0.8, and relationships below this threshold are considered uncertain relationships. The weight of the new edge is proportional to the weight of the attack path, representing the strength of the association. For repeated edge relationships in multiple paths, the weight accumulation method is used to enhance their importance.

[0075] The processing result of edge relationship construction is the expanded relationship information, which represents the newly established semantic connections between the potential attack data and the initial knowledge graph, enriching the associated structure of the knowledge graph.

[0076] The expanded relationship information is verified and optimized for graph structure to ensure semantic consistency. The verification process checks the logical reasonableness of the new relationships, identifies and removes circular dependency relationships and semantic contradictory edges. The optimization algorithm uses graph structure adjustment techniques to achieve structure optimization by minimizing the energy function, which considers the relationship consistency score (weight 0.5), the knowledge completeness score (weight 0.3), and the structure simplicity score (weight 0.2). The system removes redundant edges with a relationship strength below 0.3, and merges similar relationships with a semantic overlap degree exceeding 0.85.

[0077] The processing result of graph structure verification and optimization is the semantic consistency attack chain, which conforms to the logical causal relationship, removes unreasonable connections, maintains a simple structure, and keeps the semantics coherent.

[0078] According to the semantic consistency attack chain, the potential attack data and the initial knowledge graph are fused. The fusion process adopts a graph fusion algorithm based on an attention mechanism, and assigns fusion weights to knowledge from different sources. The verified entity relationship weight in the initial knowledge graph is 0.7, the professional threat intelligence weight in the potential attack data is 0.8, and the predictive attack mode weight is 0.6. The fusion algorithm retains overlapping information, uses the high-confidence-first principle for conflicting information, and losslessly combines supplementary information.

[0079] The processing result of information fusion is attack chain fusion information, which integrates the basic security knowledge of the initial knowledge graph and the attack intelligence of the potential attack data, forms a complete attack chain knowledge system, and provides a comprehensive perspective for security defense.

[0080] The present embodiment effectively realizes the construction and analysis of a complete attack chain through the path fusion association method of potential attack data and the initial knowledge graph. The method accurately identifies potential threat-related entities through attack intent extraction and hierarchical similarity clustering, improving the accuracy of threat identification. Based on attack association structure path search and attack probability evaluation, comprehensive discovery and risk quantification of attack paths are realized, enhancing the pertinence of security defense. Edge relationship construction and graph structure verification optimization ensure the semantic consistency and logical rationality of the attack chain, eliminating misleading associations. The final information fusion process integrates multi-source security knowledge, forming a more comprehensive attack chain knowledge system, providing a solid foundation for security situation awareness and threat warning. Practice shows that the method can effectively improve attack prediction ability, reduce security incident response time, and provide more scientific knowledge support for network security defense decision-making.

[0081] In one embodiment, real-time event data of a network security application scenario is obtained, and the initial knowledge graph is dynamically and iteratively updated with attack chain fusion information to obtain a network security knowledge graph, including: In a network security monitoring system, various security devices such as firewalls, intrusion detection systems, and terminal security software continuously generate a large amount of security logs and event data. The real-time event data acquisition module collects raw event data streams through standardized interfaces to multiple sources of security devices.

[0082] The specific implementation steps of anomaly detection filtering on real-time event data include: security event data is analyzed and processed by a dedicated anomaly detection engine, which integrates multiple detection algorithms, including anomaly behavior recognition methods based on statistical models, anomaly pattern detection based on machine learning, and rule-based feature matching techniques. The anomaly detection engine adopts a three-layer filtering mechanism in the detection process: the basic feature filtering layer performs preliminary screening on the basic attributes of the event, such as source IP address, target port, protocol type, etc.; the behavior pattern filtering layer performs time series analysis on the event sequence to identify potential attack behavior patterns; the context association filtering layer analyzes the single event in the network environment background and evaluates its threat level.

[0083] The result obtained after anomaly detection filtering is a set of potential threat events, which have a high anomaly score and are recognized as possible security threats. The set of potential threat events is stored in a structured data form, recording key information such as event type, occurrence time, involved entities, and anomaly score.

[0084] The set of potential threat events is processed by semantic annotation, which converts the original event data into threat event descriptions with clear semantic meaning. The semantic annotation adopts a double-layer annotation framework: the basic annotation layer adds basic semantic elements to the event, such as attack type, attack stage, and impact level; the enhanced annotation layer introduces domain knowledge to give the event more rich context semantics, including attack technology classification (corresponding to the MITRE ATT&CK framework), threat source classification, and vulnerability information association.

[0085] The semantic annotation process uses a knowledge-driven automated annotation method, combining a predefined network security ontology model and event feature extraction algorithm to perform structured analysis and semantic mapping on event data. The annotation engine identifies key semantic elements in the event through regular expression matching, natural language processing techniques, and feature extraction based on security domain dictionaries, and maps them to the predefined semantic framework.

[0086] After semantic annotation, the original potential threat events are converted into semantic threat events, each of which has a clear semantic structure, including attack subject (attacker), attack object (victim target), attack behavior, attack result, and related context information such as time, space, and method.

[0087] The semantic threat event is matched with the initial knowledge graph for entity association, and the purpose is to establish a mapping relationship between the entities in the newly discovered threat event and the entities in the existing knowledge graph. The entity association matching module implements multi-dimensional entity recognition and association algorithms: the precise matching algorithm directly establishes the entity correspondence through unique identifiers (such as IP addresses, domain names, file hash values, etc.); the fuzzy matching algorithm processes entities with naming variants or attribute differences by calculating the similarity of entity attributes; the semantic matching algorithm uses the semantic relationship between entities to infer potential entity correspondence.

[0088] In the entity association matching process, the system calculates multiple similarity indicators for each pair of candidate entities, including attribute similarity, relationship similarity, and context similarity, and obtains a comprehensive similarity score through weighted fusion. When the comprehensive similarity exceeds a predetermined threshold, the system considers that the two entities have a mapping relationship. For new entities that cannot be directly matched, the system marks them as entities to be added, preparing for subsequent knowledge graph expansion.

[0089] The entity mapping relationship, as the result of entity association matching, records the mapping of each entity in the semantic threat event to the corresponding entity in the initial knowledge graph, providing a basis for subsequent attack chain path analysis. The entity mapping relationship is represented as a set of triples, each triple containing a source entity, a target entity, and a mapping confidence.

[0090] Based on the established entity mapping relationship, the system performs path analysis on attack chain fusion information to identify target attack chain paths. The attack chain path analysis module implements path mining functions based on graph algorithms: the path search algorithm takes the identified attack source entity as the starting point and the victim target entity as the end point, searching for possible attack paths in the knowledge graph; the path evaluation algorithm calculates the threat score for each candidate path, considering factors such as path length, threat level of nodes in the path, and path integrity; the path optimization algorithm generates an optimal set of attack chain paths by removing redundant nodes and merging similar paths.

[0091] The path analysis process uses an improved shortest path algorithm to convert the node relationships in the knowledge graph into a weighted directed graph, where the weight values reflect the difficulty or probability of attack. The algorithm prioritizes paths corresponding to known attack patterns during the search process and combines prior knowledge from attack models such as MITRE ATT&CK to improve the accuracy of path analysis.

[0092] The target attack chain path, as the result of attack chain path analysis, is represented in the form of a directed subgraph, clearly describing the complete attack process from initial access to the final target. Each node represents an attack step or technology, and the edges between nodes represent the timing or causal relationship between attack steps.

[0093] The system performs node relationship incremental adjustment on the target attack chain path according to the initial knowledge graph, and generates an incremental knowledge subgraph. The node relationship incremental adjustment module implements a local update mechanism for the knowledge graph: the node expansion function adds newly discovered entities to the knowledge graph and establishes their relationships with existing entities; the relationship update function adjusts the relationship weights or attributes between existing entities according to new threat intelligence; and the knowledge fusion function integrates new patterns discovered in path analysis with existing knowledge to enrich the semantic expression of the knowledge graph.

[0094] The incremental adjustment process adopts a dual verification mechanism based on rules and statistics to evaluate the reliability of each node relationship to be adjusted. The system checks whether the new knowledge conflicts with existing knowledge through predefined knowledge consistency rules, and evaluates the strength of the supporting evidence for the new knowledge through statistical analysis. For node relationship adjustments with high reliability, the system directly applies them to the knowledge graph; for adjustments with medium reliability, the system marks them as candidate adjustment items and waits for further evidence confirmation; and for adjustments with low reliability, the system temporarily saves them in the alternative knowledge base and does not immediately apply them to the main knowledge graph.

[0095] The incremental knowledge subgraph, as the processing result of node relationship incremental adjustment, contains knowledge updates for a specific attack event, including newly added nodes, newly added relationships, and adjusted node attributes and relationship weights.

[0096] The initial knowledge graph is iteratively updated and optimized based on the incremental knowledge subgraph, ultimately forming a complete network security knowledge graph. The knowledge graph iterative update and optimization module implements global knowledge optimization and integration functions: the knowledge merging function merges new knowledge in the incremental knowledge subgraph into the main knowledge graph; the knowledge reasoning function infers implicit entity relationships based on existing knowledge to enrich the semantic network of the knowledge graph; and the knowledge cleaning function periodically checks and removes outdated or low-value knowledge to maintain the timeliness and simplicity of the knowledge graph.

[0097] The iterative update process adopts an incremental update strategy, updating only the relevant parts of the knowledge graph related to the incremental knowledge subgraph, rather than rebuilding the entire knowledge graph, thereby improving update efficiency. The update operation is executed under transaction control to ensure the consistency and integrity of the knowledge graph during the update process. After the update is complete, the system performs global consistency checks on the knowledge graph to verify whether the update operation has introduced knowledge conflicts or structural defects.

[0098] As the final processing result of iterative update optimization, the network security knowledge graph is a dynamically evolving knowledge base that integrates initial domain knowledge and real-time security event analysis results, and can comprehensively reflect the latest state and development trend of network security threats. The knowledge graph is stored in the form of a graph database, supports efficient knowledge query and reasoning, and provides knowledge support for security analysis, threat warning, attack tracing and other applications.

[0099] The network security knowledge graph construction method of the embodiment realizes dynamic iterative update of the knowledge graph, so that the knowledge graph can evolve with changes in the network security situation. The method effectively identifies potential threat events through an anomaly detection filtering mechanism, significantly reduces the false positive rate, and improves the accuracy of threat discovery. The semantic labeling technology converts raw event data into structured semantic threat events, enhancing the explainability and analyzability of event data. Entity association matching and attack chain path analysis can effectively restore the complete attack chain, helping security analysts quickly understand attack methods and intentions. The node relationship incremental adjustment mechanism ensures the accuracy of knowledge update and avoids introducing false knowledge, and the iterative update optimization process ensures the timeliness and consistency of the knowledge graph. The knowledge graph constructed by the method can provide comprehensive, accurate and timely knowledge support for security situation awareness, threat intelligence analysis, attack tracing and early warning prediction, significantly improving the network security protection capability.

[0100] Reference Figure 2 The application provides a network security knowledge graph construction device, which is applied to the network security knowledge graph construction method of any one of the above, and comprises the following steps: A collection module is configured to collect multi-source data of a network security application scenario, perform distributed processing, and obtain a security data set; An analysis module is configured to perform structured storage management and security knowledge extraction on the security data set, and obtain an initial knowledge graph; A processing module is configured to perform zero-day attack prediction construction based on the initial knowledge graph, and obtain potential attack data; A control module is configured to perform path fusion association on the potential attack data and the initial knowledge graph, and obtain attack chain fusion information; An execution module is configured to obtain real-time event data of a network security application scenario, perform dynamic iterative update on the initial knowledge graph in combination with the attack chain fusion information, and obtain a network security knowledge graph.

[0101] The network security knowledge graph construction device provided by the application has the following beneficial effects: By distributed processing and structured storage management of multi-source data, the network security data structure can be more comprehensively and accurately constructed, thereby improving the completeness and accuracy of the initial knowledge graph. Compared to traditional methods that rely on a single data source, this method integrates information from multiple data sources, enabling the knowledge graph to more comprehensively reflect the complex knowledge system in the network security field. By extracting security entity knowledge from the network security data structure, various security entities and their relationships can be effectively identified and represented, providing a reliable foundation for the construction of the initial knowledge graph. This process not only enhances the ability to identify known attack patterns, but also provides data support for subsequent knowledge reasoning and fusion. Based on the initial knowledge graph, zero-day attack prediction construction can be performed to identify potential attack data in advance and provide early warning for unknown threats. By fusing and correlating potential attack data with the initial knowledge graph, attack chain fusion information is formed, which can better reveal the internal logical relationships of complex attack chains and improve the ability to identify advanced persistent threats. This fusion process helps to achieve comprehensive analysis and deep understanding of attack paths, thereby providing more accurate information support for security defense decisions. Real-time acquisition of security event data in network security application scenarios and dynamic iterative updating with attack chain fusion information can ensure the timeliness and practicality of the network security knowledge graph.

[0102] Referring to Figure 3 The application also provides a network security knowledge graph construction device, comprising: a memory for storing programs; a processor for executing programs to implement each step of the network security knowledge graph construction method of any one of the above.

[0103] In this embodiment, the processor and the memory can be connected through a bus or other means. The memory can include volatile memory, such as random access memory, and non-volatile memory, such as read-only memory, flash memory, hard disk or solid state disk. The processor can be a general-purpose processor, such as a central processing unit, a digital signal processor, an application-specific integrated circuit, or one or more integrated circuits configured to implement embodiments of the application.

[0104] The application also provides a storage medium storing computer instructions for causing a computer to execute the method of any one of the above.

[0105] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system and each module can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0106] The above merely describes preferred embodiments of the present application, and is not intended to limit the patent scope of the present application, and any equivalent structure or equivalent process conversion, or direct or indirect application in other related technical fields, which are made by using the content of the present application specification and drawings, are also included in the patent protection scope of the present application.

Claims

1. A method for constructing a network security knowledge graph, characterized in that, The application comprises the following steps: obtaining multi-source data of a network security application scenario, performing distributed processing, and obtaining a security data set; performing structured storage management and security knowledge extraction on the security data set, and obtaining an initial knowledge graph; performing zero-day attack prediction construction based on the initial knowledge graph, and obtaining potential attack data; performing path fusion association on the potential attack data and the initial knowledge graph, and obtaining attack chain fusion information; obtaining real-time event data of the network security application scenario, and performing dynamic iterative updating on the initial knowledge graph based on the attack chain fusion information, and obtaining a network security knowledge graph. 2.The method of claim 1, wherein, The method comprises the following steps: performing data sharding on the multi-source data, and distributing the data to corresponding distributed computing nodes to obtain node data shards; performing feature conversion on the node data shards to obtain security feature data; performing event clustering based on the security feature data to obtain security event clustering results; performing label mode matching on the security event clustering results and a preset threat model library to obtain labeled security data; performing association rule integration on the labeled security data to obtain the security data set. 3.The method of claim 1, wherein, The method comprises the following steps: performing semantic annotation mapping on the security data set to obtain semantic attribute information; performing ontology structure definition representation based on the semantic attribute information to obtain an initial target representation; identifying the entity boundaries of the initial target representation, and performing relationship association to obtain multiple types of associated relationships; performing graph structure merging on the multiple types of associated relationships between entities and the initial target representation to obtain a relationship-enhanced graph structure; performing sharding storage and index optimization on the relationship-enhanced graph structure to obtain the network security data structure; performing security entity knowledge extraction on the network security data structure to obtain the initial knowledge graph.

4. The method of claim 3, wherein, The method comprises the following steps: performing security entity identification on the network security data structure to obtain a preliminary security entity set; performing entity type classification on the preliminary security entity set to obtain a security entity type library; performing attribute feature extraction on the preliminary security entity set based on the security entity type library to obtain a security entity attribute table; performing semantic relationship identification on the security entity attribute table to obtain a semantic relationship triple; performing relationship reasoning and graph construction on the semantic relationship triple and the network security data structure to obtain the initial knowledge graph. 5.The method of claim 1, wherein, The method comprises the following steps: performing entity node extraction and attack mode analysis based on the initial knowledge graph to obtain an implicit attack mode; performing multi-hop edge prediction on the implicit attack mode based on a preset graph attention network to obtain potential connection information; performing heterogeneous hierarchical construction and graph structure attack identification based on the potential connection information to obtain an attack virtual node set; Zero-day feature extraction is performed on the attack virtual node set to obtain a zero-day attack vector; Network topology vulnerability identification is performed on the potential connection information, and combined penetration analysis is performed with the zero-day attack vector to obtain vulnerability chain analysis information; The vulnerability chain analysis information is fused with the initial knowledge graph to obtain the potential attack data.

6. The method of claim 1, wherein, The potential attack data and the initial knowledge graph are path-fused and associated to obtain attack chain fusion information, including: According to the potential attack data, hierarchical similar clustering is performed on the initial knowledge graph to obtain an attack association structure; According to the attack association structure, path search is performed on the initial knowledge graph to obtain a potential attack path set; Attack probability evaluation is performed on the potential attack path set to obtain a weighted attack path; According to the weighted attack path, edge relationship construction is performed on the initial knowledge graph and the potential attack data to obtain a semantic attack chain; According to the semantic consistency attack chain, information fusion is performed on the potential attack data and the initial knowledge graph to obtain the attack chain fusion information.

7. The method of claim 1, wherein, The real-time event data of the network security application scenario is obtained, and the initial knowledge graph is dynamically iteratively updated with the attack chain fusion information to obtain a network security knowledge graph, including: Abnormal detection and semantic labeling are performed on the real-time event data to obtain semantic threat events; Entity association matching is performed between the semantic threat events and the initial knowledge graph to obtain an entity mapping relationship; According to the entity mapping relationship, path analysis is performed on the attack chain fusion information to obtain a target attack chain path; According to the initial knowledge graph, node relationship incremental adjustment is performed on the target attack chain path to obtain an incremental knowledge subgraph; According to the incremental knowledge subgraph, the initial knowledge graph is iteratively updated and optimized to obtain the network security knowledge graph. 8.A network security knowledge graph construction apparatus, characterized in that, The network security knowledge graph construction method of any one of claims 1-7, comprising: A collection module is configured to collect multi-source data of a network security application scenario, perform distributed processing, and obtain a security data set; An analysis module is configured to structure the security data set for storage management and security knowledge extraction to obtain an initial knowledge graph; A processing module is configured to predict zero-day attacks based on the initial knowledge graph to obtain potential attack data; A control module is configured to path-fuse and associate the potential attack data with the initial knowledge graph to obtain attack chain fusion information; An execution module is configured to obtain real-time event data of the network security application scenario and dynamically iteratively update the initial knowledge graph with the attack chain fusion information to obtain a network security knowledge graph. 9.A network security knowledge graph construction device, characterized in that, including: A memory for storing programs; A processor for executing the programs to implement the steps of the network security knowledge graph construction method of any one of claims 1-7.

10. A storage medium, characterized by computer program element for making a computer execute the method according to any one of claims 1 to 7.

Images