Cloud platform vulnerability real-time quantitative analysis system based on dynamic knowledge graph

Abstract

The present application relates to the technical field of network security, and more particularly to a cloud platform vulnerability real-time quantitative analysis system based on a dynamic knowledge graph, which comprises a multi-source heterogeneous data acquisition unit, a dynamic knowledge graph construction unit, a vulnerability quantitative evaluation unit, an intelligent response disposal unit and a visual verification unit.The vulnerability quantitative evaluation unit identifies the possible propagation path of the vulnerability through an improved weighted breadth-first search algorithm, and introduces a real-time relationship weight and a path attenuation mechanism.The present application can improve the accuracy of vulnerability propagation path identification and the accuracy of risk level quantification by generating dynamic relationship edge weights through a real-time weight calculation module, combining a path attenuation processing module to adjust the weight of long-term non-vulnerability propagation correlation, and cooperating with the weighted breadth-first search algorithm to identify the vulnerability propagation path, thereby effectively solving the problem that traditional risk assessment relies on static parameters and is easily disturbed by invalid paths.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs. Background Technology

[0002] With the deep application of cloud computing technology, cloud platforms have become a key carrier for the deployment of core business operations. Their assets exhibit heterogeneity (covering servers, containers, network devices, etc.) and dynamism, making vulnerabilities prone to rapid propagation across different assets via network connections, leading to security incidents such as data breaches and service interruptions. Traditional vulnerability analysis methods largely rely on static asset inventories and fixed risk assessment models, making it difficult to capture dynamic changes such as cloud platform asset configuration updates and network connection status switching. This hinders timely and accurate identification of vulnerability propagation paths and risk quantification. Therefore, a technical solution that adapts to the dynamic characteristics of cloud platforms and enables real-time correlation analysis and quantitative assessment is urgently needed.

[0003] In the existing technology, relevant patents have been used to conduct research in the fields of vulnerability knowledge graph construction and vulnerability assessment. For example, Chinese patent CN202311630454.2 discloses a vulnerability severity assessment method and system based on vulnerability knowledge graph. The method includes the following steps: S1, obtaining vulnerability reports based on CVE-ID numbers and processing them to form a vulnerability element annotation set; S2, training an extraction model based on the annotation set to extract target vulnerability elements; S3, constructing a vulnerability knowledge graph by combining target vulnerability elements, description text, vulnerability code, and CVE-ID numbers; S4, representing code nodes and vulnerability description nodes and then concatenating them to form CVE-ID representations, using vulnerability assessment results as labels and CVE-ID representations as input to train a GRU classifier; S5, predicting the severity index of the vulnerability to be assessed and calculating the severity level based on the extraction model, vulnerability knowledge graph, and GRU classifier. This method has the characteristics of strong relevance, high accuracy, and strong operability. Chinese patent CN202211035105.1 discloses a vulnerability association assessment method and system based on knowledge graphs and random walk strategies. It utilizes the graphical storage capabilities of knowledge graphs to intuitively display vulnerability relationships, solving the problem of poor visualization and readability in vulnerability databases. Through the relationships between attacks, attacks and weaknesses, weaknesses and vulnerabilities in the database, and the relationships between vulnerabilities and network nodes, as well as the connectivity relationships between network nodes in actual networks, it achieves efficient organization and reasoning of vulnerability-related data. It transforms the vulnerability knowledge graph into points and lines, so that the vertices of actual vulnerabilities contain information about both the vulnerability entity and the network node entity, enabling separate assessment of the same vulnerability on different network nodes. Based on a random walk strategy, it performs association assessments on the vertices of actual vulnerabilities on the transformed graph to obtain the probability of associated attacks and the losses caused by such attacks.

[0004] Despite the design advantages of the aforementioned technical solutions, they also suffer from the following technical shortcomings: First, the knowledge graph status cannot be synchronized with the dynamic changes of the cloud platform: CN202311630454.2 relies solely on CVE-ID numbers and fixed vulnerability elements to construct the knowledge graph, lacking a real-time update mechanism for adjustments to cloud platform asset configurations and the addition of new vulnerability records, resulting in a long-term static state for the graph; CN202211035105.1's vulnerability knowledge graph relies on preset network nodes and vulnerability association data, making it difficult to respond to dynamic scenarios such as network connection status changes, and neither can match the continuously changing operational characteristics of the cloud platform; Second, risk quantification lacks dynamic parameters and path optimization: CN202311630454.2, through GR... When calculating vulnerability severity, the U-classifier relies solely on static vulnerability elements and fails to incorporate real-time operational parameters from the cloud platform. CN202211035105.1, based on random walks for risk assessment, fails to adequately adjust paths with no long-term vulnerability propagation records, making it susceptible to interference from invalid paths and leading to discrepancies between risk quantification results and actual security status. Thirdly, both CN202311630454.2 and CN202211035105.1 stop at vulnerability assessment or propagation path identification, failing to establish a mechanism linking vulnerability remediation solutions or design functional modules for remediation effect feedback, historical status retrospection, and analysis result verification, thus failing to form a complete management closed loop from vulnerability analysis to effect verification. Therefore, we propose a real-time vulnerability quantification analysis system for cloud platforms based on dynamic knowledge graphs. Summary of the Invention

[0005] The purpose of this invention is to provide a real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs, in order to solve the problems mentioned in the background art, such as the inability of the graph state to synchronize with the dynamic changes of the cloud platform, the lack of dynamic parameters and path optimization for risk quantification, and the lack of a complete link for vulnerability analysis and effect verification.

[0006] To address the aforementioned technical problems, the present invention aims to provide a real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs, comprising:

[0007] The multi-source heterogeneous data acquisition unit is based on a distributed data capture and standardized interface adaptation mechanism. It collects asset attribute data, operation status data and external vulnerability database data containing basic vulnerability hazard parameters from the cloud platform in real time. Through data format conversion and redundancy cleaning, it outputs structured data.

[0008] The dynamic knowledge graph construction unit adopts entity relationship automatic extraction technology and incremental update mechanism to map structured data into a dynamic knowledge graph containing assets, vulnerabilities, network connection entities and related relationships. It also triggers local updates of related entity attributes and relationships by real-time monitoring of data changes to maintain the consistency between the dynamic knowledge graph and the current state of the cloud platform, forming an associated network for vulnerability propagation analysis.

[0009] The vulnerability quantification assessment unit, based on the relationship and attribute characteristics of entities in the dynamic knowledge graph, identifies possible propagation paths of vulnerabilities through an improved weighted breadth-first search algorithm, introduces real-time relationship weights and path decay mechanisms, and calculates the scope of vulnerability impact and risk level by combining the number of assets covered by the path and attribute parameters.

[0010] The intelligent response and handling unit, based on the vulnerability quantitative assessment results, associates the vulnerability remediation schemes stored in the dynamic knowledge graph, generates a remediation strategy containing specific operation steps, and after execution, feeds the results back to the dynamic knowledge graph to update the status of relevant entities.

[0011] The visualization verification unit displays the dynamic knowledge graph and vulnerability analysis results in a node-edge format, provides a historical state backtracking function, and verifies the effectiveness of the system by comparing the analysis results with the actual impact of the vulnerabilities.

[0012] As a further improvement to this technical solution, the multi-source heterogeneous data acquisition unit includes a multi-source data access module and a data format conversion and cleaning module, wherein:

[0013] The multi-source data access module is based on a distributed data crawling framework. It collects asset attribute data, operational status data and external vulnerability database data from the cloud platform through cloud platform API interfaces, log subscription services and standardized interfaces of external vulnerability databases, respectively.

[0014] The data format conversion and cleaning module performs format conversion on the multi-source heterogeneous data collected by the multi-source data access module, converting different format data into a preset structured data format, and outputting structured data after completing data redundancy cleaning through redundant field filtering, missing value filling and outlier correction operations.

[0015] As a further improvement to this technical solution, the dynamic knowledge graph construction unit includes an entity relationship construction module and an incremental update module, and stores the constructed dynamic knowledge graph in a graph database, wherein:

[0016] The entity relationship construction module extracts three core entities—assets, vulnerabilities, and network connections—from structured data based on fields directly related to vulnerability analysis. Asset entities are associated with unique hardware identifiers and core resource configuration parameters; vulnerability entities are associated with standardized vulnerability numbers and their impact scope; and network connection entities are associated with source and target endpoint identifiers and transmission protocols. Key relationships are constructed through entity field matching rules, including the "inclusion" relationship between assets and vulnerabilities, the "bearing" relationship between assets and network connections, and the "dependency triggering" relationship between vulnerabilities. Entities and relationships are then mapped to nodes and edges in a dynamic knowledge graph.

[0017] The incremental update module monitors changes in structured data output by the multi-source heterogeneous data acquisition unit in real time. When it detects changes in asset resource configuration parameters, updates to the scope of vulnerability impact, switching of network connection status, or the addition of a vulnerability record with a standardized number, it triggers the update process. Based on the unique identifier of the entity, it locates the corresponding node and associated edge, updates only the attribute fields of the node or the attribute parameters of the edge, and does not reconstruct the overall structure of the dynamic knowledge graph.

[0018] As a further improvement to this technical solution, the dynamic knowledge graph construction unit also includes a graph storage module, wherein:

[0019] The graph storage module uses a graph database to store the node and edge data of the dynamic knowledge graph. It establishes attribute index tables for three types of entities: assets, vulnerabilities, and network connections, and edge index tables for relationships between entities. The edge index tables include the relationship type, the identifier of the associated entity, and the relationship attribute parameters. It supports precise queries based on the unique identifier of the entity and related queries based on the relationship type. It adapts to the incremental update requirements of the dynamic knowledge graph through a data sharding mechanism.

[0020] As a further improvement to this technical solution, the vulnerability quantification assessment unit includes a real-time weight calculation module. The real-time weight calculation module quantifies the possibility of risk transmission between entities based on the association attributes of entities in the dynamic knowledge graph, and generates relation edge weights that are dynamically updated with the cloud platform's operating status, providing basic parameters for vulnerability propagation path identification.

[0021] The real-time weight calculation module generates dynamically updated relational edge weights that are subject to the cloud platform's operating status, including the following steps:

[0022] S310.1 Extract the original attribute data of the relationship from the dynamic knowledge graph, specifically including: extracting the actual number of connections per hour between assets and the percentage of stable network connection duration within 24 hours from the "bearing" relationship between assets and network connections; extracting the ratio of successful vulnerability exploitation to total number of attempts from the "inclusion" relationship between assets and vulnerabilities.

[0023] S310.2. Standardize the extracted raw attribute data, and linearly map the actual number of connections per hour between assets to a connection frequency factor in the interval [0,1]. The percentage of successful exploits is directly used as the exploit success rate factor in the [0,1] interval. The percentage of stable network connection runtime is directly used as the connection stability factor in the [0,1] interval. ;

[0024] S310.3, fusion using a weighted summation method Generate real-time weights The weight allocation is achieved through nonnegative coefficients. Achieve, and nonnegative coefficients The value is dynamically configured based on the cloud platform's business priority. The value is updated hourly based on the original attribute data in S310.1;

[0025] S310.4, Through the graph database interface The "weight attribute" field of the corresponding relationship edge in the dynamic knowledge graph is written as the basic weight parameter when the weighted breadth-first search algorithm identifies the vulnerability propagation path.

[0026] As a further improvement to this technical solution, the vulnerability quantification and evaluation unit also includes a path decay processing module, which is based on the real-time weights output by the real-time weight calculation module. The vulnerability propagation records of relation edges in the dynamic knowledge graph are used to adjust the weights of associations that have not propagated vulnerabilities for a long time, thereby reducing the search priority of invalid paths. The weight adjustment by the path decay processing module includes the following steps:

[0027] S320.1: Real-time acquisition of vulnerability propagation records for each relation edge in the dynamic knowledge graph via the graph monitoring interface, and statistical analysis of the continuous non-propagation duration for each relation edge from the last successful propagation to the current state. ;

[0028] S320.2: Preset propagation monitoring window, when Maintain real-time weights if the window duration has not been exceeded. Unchanged; when When the window duration is exceeded, the decay adjustment mechanism is activated;

[0029] S320.3: According to The time gradient descent weights specifically include: For each additional unit of time, the weight value decreases by a preset ratio, and the decrease ratio follows... Increase and improve, generating effective weights ,when When the set threshold is exceeded, Fixed at a lower weight value;

[0030] S320.4: Will The "effective weight attribute" field of the corresponding relationship edge in the dynamic knowledge graph is written as the core parameter for the weighted breadth-first search algorithm to sort the path priority.

[0031] As a further improvement to this technical solution, the vulnerability quantification assessment unit also includes a risk level assessment module, which is based on the effective weights output by the path decay processing module. The vulnerability propagation path is identified through weighted breadth-first search. Combining the asset characteristics covered by the path with the vulnerability's own hazard attributes, a multi-dimensional vulnerability risk level is generated. The risk level assessment module generates the multi-dimensional vulnerability risk level through the following steps:

[0032] S330.1: Starting with the target vulnerable entity, invoke a weighted breadth-first search algorithm to traverse the dynamic knowledge graph, according to... Search for relation edges in descending order of priority, identify all reachable asset entities, and form a complete set of vulnerability propagation paths;

[0033] S330.2: For each path, count the number of assets covered, extract the core resource allocation parameters of each asset, and calculate the total importance of the assets covered by the path based on the standardized scores of the resource allocation parameters;

[0034] S330.3: Extract the basic hazard parameters of the corresponding vulnerability from the data of the external vulnerability database, and merge the total importance of the asset with the basic hazard parameters according to a preset ratio to generate a path risk value;

[0035] S330.4: Based on the distribution range of path risk values, map them into three risk levels: high, medium, and low, and associate the risk levels with the corresponding vulnerability entities in the dynamic knowledge graph to complete the quantitative assessment closed loop.

[0036] As a further improvement to this technical solution, the intelligent response and handling unit includes a repair scheme matching module. The repair scheme matching module extracts the risk level, affected asset type, and network node characteristics involved in the propagation path of the vulnerability from the vulnerability quantitative assessment results to form a multi-dimensional matching label. It calls the graph query interface of the dynamic knowledge graph to retrieve the set of repair schemes with the highest correlation with the multi-dimensional matching label, and writes the top 3 repair schemes with the highest matching degree as candidate repair schemes into a temporary cache area for generating a repair strategy.

[0037] As a further improvement to this technical solution, the intelligent response and handling unit also includes a repair strategy generation and execution module. The repair strategy generation and execution module is used to receive candidate repair schemes output by the repair scheme matching module, combine the asset dependencies in the propagation path, sort the repair operation steps in the order of "core assets first, then edge assets", convert the sorted steps into an instruction format that the cloud platform can recognize to generate a structured repair strategy, execute the structured repair strategy through the cloud platform management interface and monitor the return status of each step in real time, and map the execution result to the "repair status" attribute (not repaired / repairing / repaired / repair failed) of the corresponding vulnerability entity in the dynamic knowledge graph and the "security status" attribute of the asset entity, forming a closed loop of status update.

[0038] As a further improvement to this technical solution, the visualization verification unit includes a graph visualization display module and a verification analysis module, wherein:

[0039] The graph visualization module maps asset entities and vulnerability entities in the dynamic knowledge graph to nodes of different shapes. The size of the nodes is positively correlated with the importance of the asset or the risk level of the vulnerability, and the color of the nodes changes dynamically with the security status (green for normal, yellow for warning, and red for high risk). The relationships between entities are mapped to edges with weights, and the thickness of the edges corresponds to the effective weight. Proportional to the relationship, displaying relationship attribute details on hover; and providing zoom, pan, and node filtering functions, supporting filtering of displayed content by risk level or asset type;

[0040] The verification and analysis module is based on the timestamp version mechanism of the dynamic knowledge graph, storing hourly graph snapshots. It supports backtracking and displaying the vulnerability propagation path and risk level change trajectory within a selected time interval. It extracts risk level and impact range data from historical analysis results and compares them with the asset impact records of actual vulnerability events to calculate two verification indicators: risk level accuracy and path matching degree. The verification indicators and differences are associated with the "System Verification Log" attribute field of the dynamic knowledge graph as a basis for evaluating the accuracy of the vulnerability quantitative analysis results.

[0041] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0042] 1. This invention uses the incremental update module of the dynamic knowledge graph construction unit to monitor changes in structured data such as cloud platform asset configuration modifications, vulnerability impact range updates, and network connection status switching in real time. Based on the unique identifier of the entity, it locates the corresponding node and associated edge and updates only local attributes or parameters. Without rebuilding the overall graph structure, it enables the dynamic knowledge graph to synchronize with the cloud platform's operating status in real time, ensuring the consistency between the vulnerability propagation analysis associated network and the current state of the cloud platform. This effectively solves the problem that traditional static graphs cannot adapt to the dynamic changes of the cloud platform.

[0043] 2. This invention uses the real-time weight calculation module of the vulnerability quantification assessment unit to generate dynamic relation edge weights by integrating real-time operating parameters of the cloud platform. Then, it combines the path decay processing module to adjust the weights of the associations that have not propagated vulnerabilities for a long time. With the weighted breadth-first search algorithm to identify vulnerability propagation paths, it can improve the accuracy of vulnerability propagation path identification and the accuracy of risk level quantification. It effectively solves the problems of traditional risk assessment relying on static parameters and being easily interfered with by invalid paths.

[0044] 3. This invention matches vulnerability remediation solutions and executes structured remediation strategies through an intelligent response and handling unit, feeding back the execution results to a dynamic knowledge graph to update entity states. Simultaneously, it relies on a visual verification unit to store graph snapshots to achieve historical state backtracking. By comparing and analyzing the results with actual vulnerability events through risk level accuracy and path matching indicators, a complete management closed loop of "vulnerability quantitative analysis - remediation execution - status feedback - effect verification" is formed. This effectively solves the problem of traditional technologies lacking a complete analysis and verification chain, ensuring the effectiveness and traceability of vulnerability analysis results. Attached Figure Description

[0045] Figure 1 This is a schematic diagram of the system framework of the present invention;

[0046] The meanings of the labels in the diagram are as follows:

[0047] 100. Multi-source heterogeneous data acquisition unit; 110. Multi-source data access module; 120. Data format conversion and cleaning module;

[0048] 200. Dynamic Knowledge Graph Construction Unit; 210. Entity Relationship Construction Module; 220. Incremental Update Module; 230. Knowledge Graph Storage Module;

[0049] 300. Vulnerability Quantitative Assessment Unit; 310. Real-time Weight Calculation Module; 320. Path Decay Processing Module; 330. Risk Level Assessment Module;

[0050] 400. Intelligent Response and Handling Unit; 410. Repair Solution Matching Module; 420. Repair Strategy Generation and Execution Module;

[0051] 500. Visualization Verification Unit; 510. Graph Visualization Display Module; 520. Verification Analysis Module. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0053] like Figure 1 As shown, this embodiment provides a real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs, including:

[0054] The multi-source heterogeneous data acquisition unit 100 is based on a distributed data capture and standardized interface adaptation mechanism. It collects asset attribute data, operation status data and external vulnerability database data containing basic vulnerability hazard parameters from the cloud platform in real time. Through data format conversion and redundancy cleaning, it outputs structured data.

[0055] In this embodiment, the multi-source heterogeneous data acquisition unit 100 includes a multi-source data access module 110 and a data format conversion and cleaning module 120, wherein:

[0056] The multi-source data access module 110 is based on a distributed data capture framework. It collects asset attribute data, operational status data and external vulnerability database data from the cloud platform through cloud platform API interfaces, log subscription services and standardized interfaces of external vulnerability databases, respectively.

[0057] Specifically, the distributed data acquisition framework that the multi-source data access module 110 can use is the industry-mature Spark Streaming or Flink distributed computing framework. This framework supports parallel acquisition and stream processing of multiple nodes, which can effectively avoid data loss caused by single-point acquisition delay or failure, and ensure the real-time performance of acquisition.

[0058] Furthermore, the collection of cloud platform asset attribute data is achieved by calling the cloud platform's native API interfaces, including cloud server instance API, container service cluster API, network switch API, etc. The API call frequency is configured to be once every 5 minutes to capture asset configuration changes in real time (such as CPU core count adjustment, memory expansion, network segment change, etc.).

[0059] Furthermore, the collection of cloud platform operation status data is achieved through the cloud platform log subscription service. The subscribed log types cover real-time asset performance logs (CPU utilization, memory utilization, disk I / O, network bandwidth usage), process operation logs (process start / stop status, resource usage), and network connection logs (source IP, destination IP, port number, transmission protocol, connection establishment / disconnection time). The log subscription service adopts a "real-time push streaming" mode, transmitting log data to the multi-source data access module 110 with millisecond-level latency.

[0060] Furthermore, the collection of data from external vulnerability databases, which includes basic vulnerability hazard parameters, is achieved through standardized interfaces for external vulnerability databases. Specifically, the external vulnerability databases to be connected may include the U.S. National Vulnerability Database, the CVEDetails vulnerability database, and the National Information Security Vulnerability Database. The interface call frequency is configured to be once per hour. The data fields collected cover the vulnerability's unique identifier, vulnerability type (remote code execution, buffer overflow, privilege escalation, etc.), basic hazard parameters (CVSS basic score, affected system version, vulnerability exploitation difficulty), vulnerability release time, and remediation suggestions.

[0061] The data format conversion and cleaning module 120 performs format conversion on the multi-source heterogeneous data collected by the multi-source data access module 110, converting different format data into a preset structured data format, and outputting structured data after completing data redundancy cleaning through redundant field filtering, missing value filling and outlier correction operations.

[0062] Specifically, the preset structured data format can be JSON-LD, which supports structured data storage and preserves the relationships between data, facilitating the subsequent construction of dynamic knowledge graphs.

[0063] Furthermore, the format conversion process specifically includes: uniformly mapping the JSON format asset attribute data returned by the cloud platform API interface, the JSON format runtime status data transmitted by the log subscription service, and the XML / JSON format vulnerability data returned by the external vulnerability database interface to the preset JSON-LD structured format. The mapping rules are defined through the configuration file. For example, the "instanceId" field in the asset attribute data is mapped to the "unique asset ID" field in JSON-LD, and the "cvssBaseScore" field in the external vulnerability database data is mapped to the "vulnerability base CVSS score" field in JSON-LD.

[0064] Furthermore, the redundant field filtering process specifically involves filtering out redundant fields unrelated to vulnerability analysis (such as asset purchase time and redundant identifier fields in logs) and duplicate data (such as repeatedly collected operational status data of the same asset at the same timestamp, and duplicate CVE-ID vulnerability records in different vulnerability databases). The filtering rules are implemented through a field whitelist mechanism, retaining only the preset core fields.

[0065] Furthermore, for missing numerical fields (such as asset memory capacity, vulnerability CVSS score), the average score of similar assets in the same period or the average score of similar vulnerabilities in the vulnerability database is used to fill them; for missing character fields (such as the network segment to which the asset belongs, the system version affected by the vulnerability), the default value of "unmarked" is filled in.

[0066] Furthermore, the outlier correction process is as follows: based on business rules, abnormal data is identified. For example, running status data with CPU utilization exceeding 100% is corrected to 100%, records with negative network bandwidth usage are corrected to 0, and vulnerability data with CVSS scores exceeding the 0-10 range are marked as "pending manual verification" and temporarily stored in the abnormal data buffer. After subsequent manual confirmation, they will be processed (for example, valid data is added to the structured data pool through format conversion, and invalid data is marked as "discarded" and recorded in the log).

[0067] The dynamic knowledge graph construction unit 200 adopts entity relationship automatic extraction technology and incremental update mechanism to map structured data into a dynamic knowledge graph containing assets, vulnerabilities, network connection entities and related relationships. By real-time monitoring of data changes, it triggers local updates of related entity attributes and relationships, maintains the consistency between the dynamic knowledge graph and the current state of the cloud platform, and forms an associated network for vulnerability propagation analysis.

[0068] In this embodiment, the dynamic knowledge graph construction unit 200 includes an entity relationship construction module 210 and an incremental update module 220, and stores the constructed dynamic knowledge graph in a graph database, wherein:

[0069] The entity relationship construction module 210 extracts three core entities—assets, vulnerabilities, and network connections—from structured data based on fields directly related to vulnerability analysis. Asset entities are associated with unique hardware identifiers and core resource configuration parameters; vulnerability entities are associated with standardized vulnerability numbers and impact ranges; and network connection entities are associated with source and target endpoint identifiers and transmission protocols. Key relationships are constructed through entity field matching rules, including the "inclusion" relationship between assets and vulnerabilities, the "bearing" relationship between assets and network connections, and the "dependency triggering" relationship between vulnerabilities. Entities and relationships are then mapped to nodes and edges in a dynamic knowledge graph.

[0070] Specifically, the "Hardware Unique Identifier" of an asset entity corresponds to the instance ID (such as ECS instance ID, container ID) in the asset attribute data of the structured data, and the "Core Resource Configuration Parameters" corresponds to fields such as the number of CPU cores, memory capacity, and network segment to which it belongs; the "Standardized Vulnerability Number" of a vulnerability entity corresponds to the CVE-ID or CNNVD-ID in the external vulnerability database, and the "Scope of Impact" corresponds to fields such as the operating system and applications affected; the "Source and Target Endpoint Identifiers" of a network connection entity correspond to the source IP + port and target IP + port in the runtime status data, and the "Transmission Protocol" corresponds to the protocol type (such as TCP, HTTP) field;

[0071] Furthermore, key relationships are constructed through field matching rules: the "inclusion" relationship between assets and vulnerabilities is constructed by matching the "affected asset identifier" in the vulnerability field with the asset's "hardware unique identifier"; the "bearer" relationship between assets and network connections is constructed by matching the network connection endpoint IP with the asset IP; and the "dependency triggering" relationship between vulnerabilities is constructed by matching the "pre-dependent vulnerability number" in the vulnerability field with the "standardized vulnerability number" of another vulnerability.

[0072] Thus, the three types of entities are ultimately mapped to graph nodes (node ​​IDs are named with "entity type_unique identifier", such as "asset_ecs-123"), and the three types of relationships are mapped to edges between nodes (edge ​​IDs are named with "source node ID_relationship type_target node ID", such as "asset_ecs-123_contains_vuln_CVE-2024-123").

[0073] The incremental update module 220 monitors changes in structured data output by the multi-source heterogeneous data acquisition unit 100 in real time. When it detects changes in asset resource configuration parameters, updates to the scope of vulnerability impact, network connection status switching, or the addition of a vulnerability record with a standardized number, it triggers the update process. Based on the unique identifier of the entity, it locates the corresponding node and associated edge, updates only the attribute fields of the node or the attribute parameters of the edge, and does not reconstruct the overall structure of the dynamic knowledge graph.

[0074] Specifically, the incremental update module 220 monitors changes to structured data in real time through a message queue that interfaces with the multi-source heterogeneous data acquisition unit 100. The change notification includes "data type," "change type," "entity unique identifier," and "change fields." Specifically, it includes:

[0075] When a modification to asset resource configuration parameters is detected, the asset node is located by the entity's unique identifier, and only the configuration parameter fields are updated.

[0076] When an update to the scope of a vulnerability is detected, the vulnerability node is located and the scope of impact field is updated. If new affected assets are added, an "inclusion" relationship edge is added.

[0077] When a network connection state change is detected, locate the network connection node and the "bearer" relationship edge, and update the state attributes;

[0078] When a new vulnerability record with a standardized number is detected, a vulnerability node is created and an "inclusion" relationship edge is constructed by matching the asset.

[0079] Moreover, all updates only adjust node attributes or edge parameters and do not rebuild the overall graph structure.

[0080] In addition, when the incremental update module 220 handles concurrent modifications of the same node from multiple sources, it adopts a timestamp priority strategy: for modification requests initiated at the same time, it uses the timestamp of the data generation as the basis and only retains the modification content with the latest timestamp; at the same time, it introduces a transaction lock mechanism to lock the read and write operations of a node when a single node is modified, and releases the lock after the current modification is completed to avoid data inconsistency.

[0081] In this embodiment, the dynamic knowledge graph construction unit 200 further includes a graph storage module 230, wherein:

[0082] The graph storage module 230 uses a graph database to store the node and edge data of the dynamic knowledge graph. It establishes attribute index tables for three types of entities: assets, vulnerabilities, and network connections, and edge index tables for relationships between entities. The edge index tables include the relationship type, the identifier of the associated entity, and the relationship attribute parameters. It supports precise queries based on the unique identifier of the entity and related queries based on the relationship type. It adapts to the incremental update requirements of the dynamic knowledge graph through a data sharding mechanism.

[0083] Specifically, the graph storage module 230 uses a graph database that supports large-scale graph data storage, and establishes attribute index tables for three types of entities: the asset index table uses "unique hardware identifier" as the primary key, including fields such as resource configuration; the vulnerability index table uses "standardized vulnerability number" as the primary key, including fields such as impact scope; and the network connection index table uses "endpoint identifier + protocol" as the primary key, including fields such as connection status. An edge index table is also established for relationships, using "unique edge identifier" as the primary key, including fields such as relationship type and associated entity identifier. It supports precise queries based on entity unique identifiers and relational queries based on relationship types, and adapts to the storage efficiency requirements of incremental updates through a data sharding mechanism of "entity type + time range".

[0084] The vulnerability quantification assessment unit 300 is based on the relationship and attribute characteristics of entities in the dynamic knowledge graph. It identifies possible propagation paths of vulnerabilities through an improved weighted breadth-first search algorithm, introduces real-time relationship weights and path decay mechanisms, and calculates the scope of vulnerability impact and risk level by combining the number of assets covered by the path and attribute parameters.

[0085] In this embodiment, the vulnerability quantification assessment unit 300 includes a real-time weight calculation module 310. The real-time weight calculation module 310 quantifies the possibility of risk transmission between entities based on the relationship attributes of entities in the dynamic knowledge graph, and generates relationship edge weights that are dynamically updated with the cloud platform's operating status, providing basic parameters for vulnerability propagation path identification.

[0086] The real-time weight calculation module 310 generates dynamically updated relational edge weights that are based on the cloud platform's operating status, including the following steps:

[0087] S310.1 Extract the original attribute data of the relationship from the dynamic knowledge graph, specifically including: extracting the actual number of connections per hour between assets and the percentage of stable network connection duration within 24 hours from the "bearing" relationship between assets and network connections; extracting the ratio of successful vulnerability exploitation to total number of attempts from the "inclusion" relationship between assets and vulnerabilities.

[0088] S310.2. Standardize the extracted raw attribute data, and linearly map the actual number of connections per hour between assets to a connection frequency factor in the interval [0,1]. The percentage of successful exploits is directly used as the exploit success rate factor in the [0,1] interval. The percentage of stable network connection runtime is directly used as the connection stability factor in the [0,1] interval. ;

[0089] S310.3, fusion using a weighted summation method Generate real-time weights The weight allocation is achieved through nonnegative coefficients. Achieve, and nonnegative coefficients The value is dynamically configured based on the cloud platform's business priority. The value is updated hourly based on the original attribute data in S310.1;

[0090] S310.4, Through the graph database interface The "weight attribute" field of the corresponding relationship edge in the dynamic knowledge graph is written as the basic weight parameter when the weighted breadth-first search algorithm identifies the vulnerability propagation path.

[0091] Specifically, the steps for generating relational edge weights that are dynamically updated according to the cloud platform's operating status are as follows:

[0092] First, raw attribute data is extracted from the attribute fields of the corresponding edges in the dynamic knowledge graph, including the actual number of connections per hour from the "carrying" relationship between assets and network connections. Percentage of stable runtime within 24 hours (In decimal form), extract the number of successful exploits from the "containment" relationship between assets and vulnerabilities. Total number of attempts And calculate the success rate. (Decimal form); If there are no vulnerability attempts recorded within the statistical period (i.e.) ), then The value of is set to 0 (or a default value, such as 0.5, is configured according to the cloud platform security policy) to ensure the computability of the formula in all scenarios;

[0093] Next, the extracted raw data is standardized, and the connectivity frequency factor is calculated. ,in This represents the historical peak number of hourly connections for similar "bearer" relationship edges on the cloud platform over the past 30 days. The value range is [0,1], using the success rate factor. Directly adopt (Values ​​range [0,1]), Connection stability factor Directly adopt (The value range is [0,1]);

[0094] Then, using the weighted summation formula Generate real-time weights The coefficient value is dynamically configured based on the cloud platform's business priority (e.g., when carrying financial transaction business). Configure when carrying e-commerce business ),and The value is updated hourly based on the original attribute data;

[0095] Finally, the graph database interface (such as the UPDATEEDGE statement) is used to... Write the "weight" attribute field of the corresponding relation edge to complete the construction and storage of real-time weights.

[0096] In this embodiment, the vulnerability quantification and evaluation unit 300 further includes a path attenuation processing module 320, which is based on the real-time weights output by the real-time weight calculation module 310. The vulnerability propagation records of relation edges in the dynamic knowledge graph are used to adjust the weights of relationships that have not propagated vulnerabilities for a long time, thereby reducing the search priority of invalid paths. The weight adjustment by the path decay processing module 320 includes the following steps:

[0097] S320.1: Real-time acquisition of vulnerability propagation records for each relation edge in the dynamic knowledge graph via the graph monitoring interface, and statistical analysis of the continuous non-propagation duration for each relation edge from the last successful propagation to the current state. ;

[0098] S320.2: Preset propagation monitoring window, when Maintain real-time weights if the window duration has not been exceeded. Unchanged; when When the window duration is exceeded, the decay adjustment mechanism is activated;

[0099] S320.3: According to The time gradient descent weights specifically include: For each additional unit of time, the weight value decreases by a preset ratio, and the decrease ratio follows... Increase and improve, generating effective weights ,when When the set threshold is exceeded, Fixed at a lower weight value;

[0100] S320.4: Will The "effective weight attribute" field of the corresponding relationship edge in the dynamic knowledge graph is written as the core parameter for the weighted breadth-first search algorithm to sort the path priority.

[0101] Specifically, the steps for weight adjustment are as follows:

[0102] First, the "lastExploitTime" attribute field (which stores the timestamp of the last successful vulnerability propagation) of each relation edge is read through the graph monitoring interface, and the duration of continuous non-propagation is calculated. ,in This is the current system timestamp. Both the timestamp of the last successful vulnerability propagation and the timestamp of the vulnerability propagation are converted to hours for calculation.

[0103] Next, a 72-hour transmission monitoring window was preset, when At the hourly mark, the relationship edge is determined to still be in the "active propagation potential" state, and its real-time weight is maintained. Unchanged, when The attenuation adjustment mechanism is activated at hourly intervals.

[0104] Subsequently, according to Calculate effective weights using time gradient Specifically, it includes:

[0105] when At hour, ;

[0106] when At hour, ;

[0107] when At hour, ;

[0108] when When the hour (set to a fixed weight decay threshold), Fixed at 0.1 (lower weight value);

[0109] Finally, through the graph database interface... Write the “effectiveWeight” attribute field of the corresponding relation edge as the core parameter for subsequent weighted breadth-first search algorithm to sort the path priority.

[0110] Understandable is the path decay weight. The decreasing rate increases with the duration of continuous non-propagation. The weighting increases with the number of hours added, with the specific rule being: for every additional 24 hours, the weight decreases by 30% (or an exponential decreasing formula is used). ,in The attenuation coefficient can be configured according to the cloud platform's risk sensitivity, for example... ; It is the base of the natural logarithm.

[0111] In this embodiment, the vulnerability quantification assessment unit 300 further includes a risk level assessment module 330, which assesses the effective weights output by the path decay processing module 320. By identifying vulnerability propagation paths through weighted breadth-first search, and combining the asset characteristics covered by the path with the vulnerability's own hazard attributes, a multi-dimensional vulnerability risk level is generated. The risk level assessment module 330 generates multi-dimensional vulnerability risk levels through the following steps:

[0112] S330.1: Starting with the target vulnerable entity, invoke a weighted breadth-first search algorithm to traverse the dynamic knowledge graph, according to... Search for relation edges in descending order of priority, identify all reachable asset entities, and form a complete set of vulnerability propagation paths;

[0113] S330.2: For each path, count the number of assets covered, extract the core resource allocation parameters of each asset, and calculate the total importance of the assets covered by the path based on the standardized scores of the resource allocation parameters;

[0114] S330.3: Extract the basic hazard parameters of the corresponding vulnerability from the data of the external vulnerability database, and merge the total importance of the asset with the basic hazard parameters according to a preset ratio to generate a path risk value;

[0115] S330.4: Based on the distribution range of path risk values, map them into three risk levels: high, medium, and low, and associate the risk levels with the corresponding vulnerability entities in the dynamic knowledge graph to complete the quantitative assessment closed loop.

[0116] It is understandable that the risk level assessment module 330 is based on the effective weights output by the path decay processing module 320. An improved weighted breadth-first search algorithm is used to identify vulnerability propagation paths. This, combined with the asset characteristics covered by the path and the vulnerability's own hazard attributes, generates a multi-dimensional vulnerability risk level. The core improvement of the weighted breadth-first search algorithm compared to the traditional breadth-first search is: [The text abruptly ends here, likely due to an incomplete sentence or missing information.] As a basis for traversal priority (according to) (Search relation edges in order of priority) and merge. Dynamism and The effectiveness of the search results should be ensured to avoid invalid paths interfering with the search results.

[0117] Specifically, the steps for generating multi-dimensional vulnerability risk levels are as follows:

[0118] First, starting with the target vulnerable entity, the improved algorithm described above is invoked to traverse the dynamic knowledge graph, identify all reachable asset entities, and form a complete set of vulnerability propagation paths.

[0119] Then, calculate the total importance of assets covered by the path, first determining the importance of individual assets based on their core resource allocation parameters. ,in A standardized score is assigned to the asset's CPU configuration, with the following scoring rule: if the asset has 4 or fewer CPU cores, then... If the asset's CPU core count is greater than 4 cores and less than or equal to 8 cores (i.e., falls within the range of 4 cores (inclusive) to 8 cores (inclusive), then If the asset has more than 8 CPU cores, then ; A standardized score is assigned to the asset's memory configuration, with the following scoring rule: if the asset's memory capacity is less than or equal to 8GB, then... If the asset's memory capacity is greater than 8GB and less than or equal to 32GB (i.e., within the range of 8GB (inclusive) to 32GB (inclusive), then If the asset's memory capacity is greater than 32GB, then Then, the total importance of path assets is calculated using the following formula. ,in The number of assets covered by this path. For the first in the path Importance rating of each asset;

[0120] Next, calculate the path risk value. First, follow the formula ,Will Normalized to the interval [0, 10], where For assets covered by a single vulnerability propagation path during the historical operation of the cloud platform. Then, the basic vulnerability parameter CVSS (with a value range of [0,10]) is extracted from the external vulnerability database and fused to generate the path risk value. ;

[0121] Finally, based on the path risk value Distribution range mapping risk level:

[0122] when At that time, it is mapped as "high risk";

[0123] when At that time, it is mapped to "medium risk";

[0124] when When the risk level is low, it is mapped to "low risk". The risk level and the corresponding propagation path set are associated with the "riskLevel" and "riskAnalysisRecord" attribute fields of the corresponding vulnerability entity in the dynamic knowledge graph, thus completing the closed loop of vulnerability quantitative assessment.

[0125] The intelligent response and handling unit 400, based on the vulnerability quantitative assessment results, associates the vulnerability remediation schemes stored in the dynamic knowledge graph, generates a remediation strategy containing specific operation steps, and after execution, feeds the results back to the dynamic knowledge graph to update the status of relevant entities.

[0126] In this embodiment, the intelligent response and handling unit 400 includes a repair scheme matching module 410. The repair scheme matching module 410 extracts the risk level, affected asset type and network node characteristics involved in the propagation path of the vulnerability from the vulnerability quantitative assessment results to form a multi-dimensional matching label. It calls the graph query interface of the dynamic knowledge graph to retrieve the set of repair schemes with the highest correlation with the multi-dimensional matching label, and writes the top 3 repair schemes with the highest matching degree as candidate repair schemes into the temporary cache area for generating a repair strategy.

[0127] Specifically, the multi-dimensional matching tag generation includes extracting information from the "risk level," "affected asset type," and "network node characteristics involved in the propagation path" output by the vulnerability quantification assessment unit 300 to form multi-dimensional matching tags. Among them, the "risk level" directly adopts the classification results of "high risk," "medium risk," and "low risk"; the "affected asset type" is extracted as the hardware type of the asset (such as ECS instance, container, physical server, etc.); and the "network node characteristics" are extracted as the protocol type (such as TCP, HTTP), source / target port range, etc. of the network connections in the propagation path.

[0128] Specifically, the remediation solution retrieval process includes: calling the graph query interface of the dynamic knowledge graph, using multi-dimensional matching tags as search criteria, and filtering remediation solution nodes that have a "remediation solution association" relationship with the vulnerability entity. For example, for the tag "risk level = high risk, affected asset type = ECS instance, network node characteristic = TCP protocol", a query statement is executed to obtain all associated remediation solution nodes.

[0129] Specifically, the relevance calculation and candidate solution selection process includes: calculating the relevance of the remediation solution set obtained from the above retrieval based on the "number of matching tag dimensions". After sorting the relevance from high to low, the top 3 remediation solutions are selected as candidate remediation solutions and written to a temporary cache area through a caching interface for subsequent use.

[0130] Furthermore, the specific method for calculating the correlation degree through the "number of matched tag dimensions" is as follows: First, clarify the dimensions included in the multi-dimensional matching tags of the vulnerability (such as risk level, affected asset type, network node characteristics, etc., assuming a total of 3 dimensions). Then, extract the applicable tags of the remediation scheme to be evaluated from the dynamic knowledge graph (which contain the same dimensions as the vulnerability tags). Subsequently, compare each dimension of the vulnerability tag and the remediation scheme tag one by one. If the content of a certain dimension is completely consistent (such as the vulnerability "risk level = high risk" and the remediation scheme "applicable risk level = high risk"), it is counted as "matching 1 dimension". Finally, count the total number of all matched dimensions. This total number is the correlation degree between the remediation scheme and the vulnerability (for example, when all 3 dimensions are matched, the correlation degree = 3; when 2 dimensions are matched, the correlation degree = 2, and so on). This method can intuitively distinguish the degree of matching between different remediation schemes and vulnerabilities. The higher the correlation degree value, the stronger the adaptability of the remediation scheme and the vulnerability.

[0131] In this embodiment, the intelligent response and handling unit 400 further includes a repair strategy generation and execution module 420. The repair strategy generation and execution module 420 is used to receive candidate repair schemes output by the repair scheme matching module 410, combine the asset dependencies in the propagation path, sort the repair operation steps in the order of "core assets first, then edge assets", convert the sorted steps into an instruction format that the cloud platform can recognize to generate a structured repair strategy, execute the structured repair strategy through the cloud platform management interface and monitor the return status of each step in real time, and map the execution result to the "repair status" attribute (not repaired / repairing / repaired / repair failed) of the corresponding vulnerability entity in the dynamic knowledge graph and the "security status" attribute of the asset entity, forming a closed loop of status update.

[0132] Specifically, the implementation process of the repair strategy generation and execution module 420 is as follows:

[0133] First, receive the candidate remediation schemes output by the remediation scheme matching module 410, combine the asset dependency relationship of the vulnerability propagation path in the dynamic knowledge graph, define the core assets and peripheral assets (such as assets that carry critical business as core assets), and sort the remediation operation steps according to "core assets first, then peripheral assets".

[0134] Subsequently, the sorted steps are converted into a command format that the cloud platform can recognize, generating a structured remediation strategy (clearly defining the target, content, expected effect, and execution order). For example, for cloud servers, the command "install the official patch for the vulnerability and restart the relevant service" is generated; for containers, the command "update the base image containing the patch and restart the container" is generated; and for network devices, the command "configure access control rules to block the vulnerability propagation path" is generated.

[0135] Next, the strategy is executed through the cloud platform management interface, and the operation return status is monitored in real time: if "execution successful" is returned and the expected effect is met (such as vulnerability elimination), the step is determined to be completed; if it times out or "execution failed" is returned, it is determined to be abnormal.

[0136] Finally, based on the execution results, the dynamic knowledge graph is updated through the graph database interface: the vulnerability entity's "remediation status" is updated to "remediation in progress", "remediation completed" or "remediation failed", and the asset entity's "security status" is updated accordingly (if the remediation is successful, it changes from "vulnerability risk exists" to "vulnerability has been remediated"), forming a closed loop of "remediation execution - status feedback - graph update".

[0137] Furthermore, "core assets first, peripheral assets later" means prioritizing the remediation steps according to the importance of the assets to the business: core assets are the carriers of critical business operations or the hubs for vulnerability propagation, while peripheral assets are auxiliary functions or the end points of propagation; core assets are remediated first, and then peripheral assets are dealt with, in order to protect core business operations, block the propagation chain, and reduce remediation risks.

[0138] The Visualization Verification Unit 500 visualizes the dynamic knowledge graph and vulnerability analysis results in a node-edge format, and provides a historical state backtracking function. It verifies the effectiveness of the system by comparing the analysis results with the actual impact of vulnerabilities.

[0139] In this embodiment, the visualization verification unit 500 includes a map visualization display module 510 and a verification analysis module 520, wherein:

[0140] The graph visualization module 510 maps asset entities and vulnerability entities in the dynamic knowledge graph to nodes of different shapes. The size of the nodes is positively correlated with the importance of the asset or the risk level of the vulnerability, and the color of the nodes changes dynamically with the security status (green for normal, yellow for warning, and red for high risk). The relationships between entities are mapped to edges with weight labels, and the thickness of the edges is related to the effective weight. It is proportional to the relationship attribute details when hovering; and provides zoom, pan, and node filtering functions, supporting filtering of displayed content by risk level or asset type.

[0141] Specifically, the graph visualization module 510 maps asset entities in the dynamic knowledge graph to square nodes and vulnerability entities to circular nodes. The node size is proportionally associated with the asset importance score (the higher the score, the larger the node) or the vulnerability risk level (the higher the level, the larger the node). The node color is dynamically adjusted according to the asset's "security status" or the vulnerability's "remediation status". For example, the node is green when the asset is "vulnerable and patched" or the vulnerability is "patched", yellow when the asset is "at risk of vulnerability" or the vulnerability is "being patched", and red when the asset is "affected by a high-risk vulnerability" or the vulnerability is "high-risk and not patched".

[0142] Furthermore, the relationships between entities are represented by weighted line segments, with the edge thickness corresponding to the effective weight. Proportional (i.e.) The larger the border, the thicker it is. When hovering the mouse, it displays the relationship type (such as "contains" or "carries"), weight value, and last update time. It also provides basic interactive functions, supports mouse wheel zooming and dragging to pan the view, and allows filtering of nodes by risk level (such as only displaying high risk) or asset type (such as only displaying ECS ​​instances) through the sidebar filter box to focus on displaying key content.

[0143] The verification and analysis module 520 is based on the timestamp version mechanism of the dynamic knowledge graph, storing hourly graph snapshots. It supports backtracking and displaying the vulnerability propagation path and risk level change trajectory within a selected time interval. It extracts risk level and impact range data from historical analysis results and compares them with the asset impact records of actual vulnerability events to calculate two verification indicators: risk level accuracy and path matching degree. The verification indicators and differences are associated with the "System Verification Log" attribute field of the dynamic knowledge graph as a basis for evaluating the accuracy of the vulnerability quantitative analysis results.

[0144] Specifically, the verification and analysis module 520 relies on the timestamp versioning mechanism of the dynamic knowledge graph to automatically generate and store a graph snapshot (including node attributes, edge attributes, and topology) every hour. The snapshots are named with timestamps in the format "YYYYMMDDHH" and associated with an index. After the user selects a historical interval through the time selector, the verification and analysis module 520 calls the snapshot data to retrospectively display the vulnerability propagation path (the display status of the edges changes with the historical weight) and the risk level evolution trajectory (the node color switches according to the historical status) for the corresponding period.

[0145] During verification, the verification analysis module 520 extracts "predicted risk level" and "predicted scope of affected assets" from historical analysis results and compares them with the "assets affected" records of actual vulnerability events (such as the actual affected assets and the actual severity recorded in the logs). It then calculates two metrics: risk level accuracy (the percentage of vulnerabilities whose predicted risk level matches the actual risk level) and path matching degree (the percentage of assets whose predicted impact matches the actual impact). Finally, the calculation results and discrepancies (such as vulnerability IDs with incorrectly judged risk levels and undetected affected assets) are written into the "System Verification Log" attribute field of the dynamic knowledge graph, providing a traceable basis for evaluating the accuracy of the vulnerability quantitative analysis results.

[0146] Furthermore, the specific calculation method for risk level accuracy and path matching degree is as follows:

[0147] The risk level accuracy is the number of vulnerabilities whose predicted risk level matches the actual vulnerability level, divided by the total number of vulnerabilities participating in the verification; for example, if 7 out of 10 verified vulnerabilities have the same risk level, the accuracy is 7 / 10.

[0148] The path matching degree is the number of assets that are predicted to be affected and the assets that are actually affected, divided by the total number of assets that are actually affected; for example, if 6 assets are actually affected, and 3 of them are predicted, then the matching degree is 3 / 6.

[0149] Those skilled in the art will understand that the process of implementing all or part of the steps of the above embodiments can be carried out by hardware or by a program instructing the relevant hardware.

[0150] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs, characterized in that: include: Multi-source heterogeneous data acquisition unit (100), the multi-source heterogeneous data acquisition unit (100) is based on distributed data capture and standardized interface adaptation mechanism, collects asset attribute data, operation status data and external vulnerability database data containing basic vulnerability hazard parameters of cloud platform in real time, and outputs structured data through data format conversion and redundancy cleaning; The dynamic knowledge graph construction unit (200) adopts entity relationship automatic extraction technology and incremental update mechanism to map structured data into a dynamic knowledge graph containing assets, vulnerabilities, network connection entities and related relationships. It also triggers local updates of related entity attributes and relationships by real-time monitoring of data changes to maintain the consistency between the dynamic knowledge graph and the current state of the cloud platform, forming an associated network for vulnerability propagation analysis. The vulnerability quantification assessment unit (300) is based on the relationship and attribute characteristics of entities in the dynamic knowledge graph. It identifies possible propagation paths of vulnerabilities through an improved weighted breadth-first search algorithm, introduces real-time relationship weights and path decay mechanisms, and calculates the scope of vulnerability impact and risk level by combining the number of assets covered by the path and attribute parameters. The vulnerability quantification assessment unit (300) includes a real-time weight calculation module (310). The real-time weight calculation module (310) quantifies the possibility of risk transmission between entities based on the association attributes of entities in the dynamic knowledge graph, generates the relationship edge weights that are dynamically updated with the cloud platform's operating status, and provides basic parameters for vulnerability propagation path identification. The real-time weight calculation module (310) generates relation edge weights that are dynamically updated according to the cloud platform's operating status, including the following steps: S310.1 Extract the original attribute data of the relationship from the dynamic knowledge graph, specifically including: extracting the actual number of connections between assets per hour and the percentage of stable network connection duration within 24 hours from the "bearing" relationship between assets and network connections; extracting the ratio of successful vulnerability exploitation to total number of attempts from the "containment" relationship between assets and vulnerabilities. S310.

2. Standardize the extracted raw attribute data, and linearly map the actual number of connections per hour between assets to a connection frequency factor in the interval [0,1]. The percentage of successful exploits is directly used as the exploit success rate factor in the [0,1] interval. The percentage of stable network connection runtime is directly used as the connection stability factor in the [0,1] interval. ; S310.3, fusion using a weighted summation method Generate real-time weights The weight allocation is achieved through nonnegative coefficients. Achieve, and nonnegative coefficients The value is dynamically configured based on the cloud platform's business priority. The value is updated hourly based on the original attribute data in S310.1; S310.4, Through the graph database interface Write the "weight attribute" field of the corresponding relationship edge in the dynamic knowledge graph as the basic weight parameter when the weighted breadth-first search algorithm identifies the vulnerability propagation path; The vulnerability quantification assessment unit (300) further includes a path decay processing module (320), which calculates the path decay based on the real-time weights output by the real-time weight calculation module (310). The vulnerability propagation records of relation edges in the dynamic knowledge graph are used to adjust the weights of associations that have not propagated vulnerabilities for a long time, thereby reducing the search priority of invalid paths; the weight adjustment by the path decay processing module (320) includes the following steps: S320.1: Real-time acquisition of vulnerability propagation records for each relation edge in the dynamic knowledge graph via the graph monitoring interface, and statistical analysis of the continuous non-propagation duration for each relation edge from the last successful propagation to the current state. ; S320.2: Preset propagation monitoring window, when Maintain real-time weights if the window duration has not been exceeded. Unchanged; when When the window duration is exceeded, the decay adjustment mechanism is activated; S320.3: According to The time gradient descent weights specifically include: For each additional unit of time, the weight value decreases by a preset ratio, and the decrease ratio follows... Increase and improve, generating effective weights ,when When the set threshold is exceeded, Fixed at a lower weight value; S320.4: Will Write the "effective weight attribute" field of the corresponding relationship edge in the dynamic knowledge graph as the core parameter for the weighted breadth-first search algorithm to sort the path priority; The intelligent response and handling unit (400) generates a repair strategy containing specific operation steps based on the vulnerability quantitative assessment results, and then feeds the results back to the dynamic knowledge graph to update the status of related entities. The visualization verification unit (500) displays the dynamic knowledge graph and vulnerability analysis results in a node-edge format, provides a historical state backtracking function, and verifies the effectiveness of the system by comparing the analysis results with the actual vulnerability impact.

2. The real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs according to claim 1, characterized in that, The multi-source heterogeneous data acquisition unit (100) includes a multi-source data access module (110) and a data format conversion and cleaning module (120), wherein: The multi-source data access module (110) is based on a distributed data crawling framework and collects asset attribute data, running status data and external vulnerability database data from the cloud platform through cloud platform API interfaces, log subscription services and external vulnerability database standardized interfaces, respectively. The data format conversion and cleaning module (120) performs format conversion on the multi-source heterogeneous data collected by the multi-source data access module (110), converts different format data into a preset structured data format, and outputs structured data after completing data redundancy cleaning through redundant field filtering, missing value filling and outlier correction operations.

3. The real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs according to claim 2, characterized in that, The dynamic knowledge graph construction unit (200) includes an entity relationship construction module (210) and an incremental update module (220), and stores the constructed dynamic knowledge graph in a graph database, wherein: The entity relationship construction module (210) extracts three core entities—assets, vulnerabilities, and network connections—based on fields directly related to vulnerability analysis in structured data. Asset entities are associated with unique hardware identifiers and core resource configuration parameters; vulnerability entities are associated with standardized vulnerability numbers and impact ranges; and network connection entities are associated with source and target endpoint identifiers and transmission protocols. Key relationships are constructed through entity field matching rules, including the "inclusion" relationship between assets and vulnerabilities, the "bearing" relationship between assets and network connections, and the "dependency triggering" relationship between vulnerabilities. Entities and relationships are mapped to nodes and edges of a dynamic knowledge graph. The incremental update module (220) monitors the changes in structured data output by the multi-source heterogeneous data acquisition unit (100) in real time. When it detects changes in asset resource configuration parameters, updates in the scope of vulnerability impact, switching of network connection status, or the addition of vulnerability records with standardized numbers, it triggers the update process. Based on the unique identifier of the entity, it locates the corresponding node and associated edge, updates only the attribute fields of the node or the attribute parameters of the edge, and does not rebuild the overall structure of the dynamic knowledge graph.

4. The real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs according to claim 3, characterized in that, The dynamic knowledge graph construction unit (200) further includes a graph storage module (230), wherein: The graph storage module (230) uses a graph database to store the node and edge data of the dynamic knowledge graph. It establishes attribute index tables for three types of entities: assets, vulnerabilities, and network connections, and establishes edge index tables for the relationships between entities. The edge index tables include the relationship type, the identifier of the associated entity, and the relationship attribute parameters. It supports precise queries based on the unique identifier of the entity and related queries based on the relationship type. It adapts to the incremental update requirements of the dynamic knowledge graph through a data sharding mechanism.

5. The real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs according to claim 4, characterized in that, The vulnerability quantification assessment unit (300) also includes a risk level assessment module (330), which assesses the effective weights output by the path decay processing module (320). By identifying vulnerability propagation paths through weighted breadth-first search, and combining the asset characteristics covered by the path with the vulnerability's own harmful attributes, a multi-dimensional vulnerability risk level is generated; the risk level assessment module (330) generates the multi-dimensional vulnerability risk level through the following steps: S330.1: Starting with the target vulnerable entity, invoke a weighted breadth-first search algorithm to traverse the dynamic knowledge graph, according to... Search for relation edges in descending order of priority, identify all reachable asset entities, and form a complete set of vulnerability propagation paths; S330.2: For each path, count the number of assets covered, extract the core resource allocation parameters of each asset, and calculate the total importance of the assets covered by the path based on the standardized scores of the resource allocation parameters; S330.3: Extract the basic hazard parameters of the corresponding vulnerability from the data of the external vulnerability database, and merge the total importance of the asset with the basic hazard parameters according to a preset ratio to generate a path risk value; S330.4: Based on the distribution range of path risk values, map them into three risk levels: high, medium, and low, and associate the risk levels with the corresponding vulnerability entities in the dynamic knowledge graph to complete the quantitative assessment closed loop.

6. The real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs according to claim 5, characterized in that, The intelligent response and handling unit (400) includes a repair scheme matching module (410). The repair scheme matching module (410) extracts the risk level, affected asset type and network node characteristics involved in the propagation path of the vulnerability from the vulnerability quantitative assessment results to form a multi-dimensional matching label. It calls the graph query interface of the dynamic knowledge graph to retrieve the set of repair schemes with the highest correlation with the multi-dimensional matching label, and writes the top 3 repair schemes with the highest matching degree as candidate repair schemes into the temporary cache area for generating a repair strategy.

7. The real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs according to claim 6, characterized in that, The intelligent response and handling unit (400) further includes a repair strategy generation and execution module (420). The repair strategy generation and execution module (420) is used to receive candidate repair schemes output by the repair scheme matching module (410), combine the asset dependencies in the propagation path, sort the repair operation steps in the order of "core assets first, then peripheral assets", convert the sorted steps into an instruction format that the cloud platform can recognize to generate a structured repair strategy, execute the structured repair strategy through the cloud platform management interface and monitor the return status of each step in real time, and map the execution result to the "repair status" attribute of the corresponding vulnerability entity and the "security status" attribute of the asset entity in the dynamic knowledge graph, forming a closed loop of status update.

8. The real-time quantitative analysis system for cloud platform vulnerabilities based on dynamic knowledge graphs according to claim 7, characterized in that, The visualization verification unit (500) includes a map visualization display module (510) and a verification analysis module (520), wherein: The graph visualization module (510) maps asset entities and vulnerability entities in the dynamic knowledge graph to nodes of different shapes. The size of the nodes is positively correlated with the importance of the asset or the risk level of the vulnerability, and the color of the nodes changes dynamically with the security status. The relationships between entities are mapped to edges with weight labels, and the thickness of the edges is related to the effective weight. Proportional to the relationship, displaying relationship attribute details on hover; and providing zoom, pan, and node filtering functions, supporting filtering of displayed content by risk level or asset type; The verification and analysis module (520) is based on the timestamp version mechanism of the dynamic knowledge graph, stores hourly graph snapshots, and supports backtracking and displaying the vulnerability propagation path and risk level change trajectory within a selected time interval; it extracts the risk level and impact range data from the historical analysis results and compares them with the asset impact records of the actual vulnerability events, and calculates two verification indicators: risk level accuracy and path matching degree; it associates the verification indicators and differences with the "system verification log" attribute field of the dynamic knowledge graph as the basis for evaluating the accuracy of the vulnerability quantitative analysis results.

Images