Behavior planning verification method and device based on knowledge graph and semantic reasoning

Abstract

The embodiment of the invention provides a behavior planning verification method and device based on a knowledge graph and semantic reasoning, and the method comprises the steps: carrying out the knowledge extraction, fusion and storage of targets, resources and behavior data from different data sources, and constructing the knowledge graph; performing semantic reasoning and sequence arrangement on the received task information based on the knowledge graph to generate a behavior plan; and performing time conflict verification, resource conflict verification, execution sequence legality verification and multi-target conflict verification on the behavior planning by adopting a constraint-based state transition reasoning method, so that the behavior planning meets time, resource and target constraints. According to the scheme, the performability and optimality of behavior planning can be improved.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of cyberspace behavior planning technology, and more specifically, to a behavior planning verification method, apparatus, and computer-readable storage medium storing a computer program based on knowledge graphs and semantic reasoning. Background Technology

[0002] Cybersecurity involves behaviors that are typically highly complex and diverse. For example, complex causal relationships, time constraints, and resource limitations often exist between behaviors such as network security, resource scheduling, traffic management, and data transmission. The coordination and sequencing of these behaviors require careful consideration of multiple factors, including dependencies between behaviors, resource allocation, and processing time constraints. In such cases, traditional behavior planning methods struggle to meet the demands for efficiency, dynamism, and real-time performance, often encountering problems such as behavior conflicts and resource bottlenecks.

[0003] Different network behaviors have varying resource requirements, and resources are limited, potentially leading to resource conflicts that prevent some behaviors from proceeding as expected. For example, different behaviors may need to access the same network node or computing resources; how to rationally allocate resources and avoid conflicts is a key issue in behavior planning. Furthermore, conflicts between behaviors are not limited to resources but may also involve constraints such as behavior priority and time window limitations, making behavior formulation more complex. Existing behavior planning methods often focus on single-domain or small-scale processing, making it difficult to address the complex, dynamic, and highly interconnected behavior planning problems in cyberspace. Summary of the Invention

[0004] The embodiments described herein provide a behavior planning verification method, apparatus, and computer-readable storage medium storing computer programs based on knowledge graphs and semantic reasoning. These methods aim to solve complex causal relationships, time constraints, and resource limitations among multiple behaviors, and improve the practicality, operability, and flexibility of behavior planning in cyberspace through efficient behavior allocation, sorting, and conflict resolution mechanisms.

[0005] According to a first aspect of this disclosure, a behavior planning verification method based on knowledge graphs and semantic reasoning is provided, comprising: extracting, fusing, and storing knowledge from target, resource, and behavior data from different data sources to construct a knowledge graph; performing semantic reasoning and sequence arrangement on received task information based on the knowledge graph to generate a behavior plan; and using a constraint-based state transition reasoning method to perform time conflict verification, resource conflict verification, execution sequence legality verification, and multi-target conflict verification on the behavior plan, so that the behavior plan meets time, resource, and target constraints.

[0006] In some embodiments of this disclosure, knowledge extraction, fusion, and storage of target, resource, and behavioral data from different data sources to construct a knowledge graph includes: using natural language processing techniques and deep learning models to extract key entity, relationship, and attribute information from multi-type behavioral data; performing data fusion of knowledge extracted from different data sources through entity alignment; storing the extracted and fused entities and their relationships in a graph database to construct a knowledge graph; and incrementally updating the knowledge graph based on new behavioral, resource, and target data.

[0007] In some embodiments of this disclosure, extracting key entity, relation, and attribute information from multi-type behavioral data using natural language processing techniques and deep learning models includes: identifying entities in text using BiLSTM+CRF or BERT deep learning models; simultaneously extracting entities and relationships between entities using a Seq2Seq joint extraction model and generating "head entity-relationship-tail entity" triples; and extracting entity-related attributes using dependency parsing or template matching techniques.

[0008] In some embodiments of this disclosure, data fusion of knowledge extracted from different data sources through entity alignment includes: constructing and expanding an ontology model to describe various entities and their relationships in the domain; standardizing entity names from different data sources using XPath or regular expressions; calculating the similarity between entities using a graph embedding model and assigning weights using an attention mechanism to automatically align entities from different sources; and using the SHACL tool to verify the logical consistency of triples.

[0009] In some embodiments of this disclosure, the extracted and fused entities and their relationships are stored in a graph database to construct a knowledge graph, and the knowledge graph is incrementally updated based on new behaviors, resources and target data, including: continuously collecting new threat intelligence by using web crawlers or accessing real-time data sources through API interfaces; using graph embedding models to complete missing relationships in the knowledge graph, or improving key paths through path reasoning, and updating the knowledge graph after expert review.

[0010] In some embodiments of this disclosure, semantic reasoning and sequence arrangement of received task information based on knowledge graphs to generate behavior planning includes: decomposing the task into multiple executable subtasks based on the received task information and a unified ontology representation in the knowledge graph; for each subtask, applying causal reasoning and constraint reasoning to determine the relationship between the subsequent state and the previous state of the task, gradually selecting, judging and associating different behaviors, and establishing the interrelationship between behaviors.

[0011] In some embodiments of this disclosure, a constraint-based state transition reasoning method is used to perform time conflict verification, resource conflict verification, execution sequence legality verification, and multi-objective conflict verification on behavior planning, so that behavior planning meets time, resource, and objective constraints. This includes: verifying the pre-state and subsequent state of each task, and verifying whether the behavior execution sequence meets the time, resource, and task requirements; adjusting the behavior order according to the verification results, and re-performing state transition reasoning and constraint verification after each adjustment to ensure that it meets the time, resource, and objective constraints; and collecting the latest information on the external environment and resources in real time, and re-optimizing the behavior planning based on the new information if there is new information or environmental changes.

[0012] In some embodiments of this disclosure, adjusting the behavior sequence based on the verification results, and re-performing state transition reasoning and constraint verification after each adjustment to ensure that it meets time, resource, and target constraints, includes: dynamically selecting appropriate reasoning methods based on task requirements and environmental characteristics, generating a behavior sequence that meets all constraints through repeated reasoning and optimization. The reasoning methods include fuzzy logic reasoning, ontology reasoning, probabilistic reasoning, deep learning augmented reasoning, and case reasoning. Fuzzy logic reasoning is used to fuzzify the input data, and handle imprecise information through rule evaluation, aggregation, and defuzzification of the output. Ontology reasoning is used to describe the relationships between entities using OWL ontology and SWRL rules, and generate defense schemes by associating attacks, vulnerabilities, and defense strategies through ontology association. Probabilistic reasoning is used to process uncertain and dynamic data based on Bayesian networks. Case reasoning is used to compare the current situation with existing cases based on matching in a historical case library to generate corresponding defense strategies.

[0013] According to a second aspect of this disclosure, a behavior planning verification device based on knowledge graphs and semantic reasoning is provided. The device includes at least one processor and at least one memory storing a computer program. When the computer program is executed by the at least one processor, the device performs the following actions: extracts, fuses, and stores knowledge from target, resource, and behavior data from different data sources to construct a knowledge graph; performs semantic reasoning and sequence arrangement on received task information based on the knowledge graph to generate a behavior plan; and uses a constraint-based state transition reasoning method to perform time conflict verification, resource conflict verification, execution sequence legality verification, and multi-target conflict verification on the behavior plan, ensuring that the behavior plan meets time, resource, and target constraints.

[0014] According to a third aspect of this disclosure, a computer-readable storage medium storing a computer program is provided, wherein the computer program, when executed by a processor, implements the steps of the behavior planning and verification method based on knowledge graphs and semantic reasoning as described in the first aspect of this disclosure.

[0015] According to the behavior planning verification method and apparatus based on knowledge graphs and semantic reasoning provided in this disclosure, by constructing a knowledge graph, the relationships between behavioral elements such as goals, resources, and time can be modeled, allowing for a better understanding of the dependencies, conflicts, and constraints between tasks, thereby generating reasonable behavior plans. Verifying the behavior plans through semantic reasoning enables real-time adjustments based on actual conditions, ensuring the feasibility and optimality of the action plan. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments will be briefly described below. It should be understood that the drawings described below only relate to some embodiments of this disclosure and are not intended to limit this disclosure, wherein: Figure 1 This is an exemplary flowchart of a behavior planning and verification method based on knowledge graphs and semantic reasoning according to embodiments of this disclosure; Figure 2 This is a schematic block diagram of a behavior planning verification device based on knowledge graphs and semantic reasoning according to embodiments of the present disclosure.

[0017] It should be noted that the elements in the attached diagram are schematic and not drawn to scale. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are also within the scope of protection of this disclosure.

[0019] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this subject matter pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having meanings consistent with their meanings in the context of the specification and in the relevant art, and shall not be interpreted in an idealized or overly formal form unless otherwise explicitly defined herein. Furthermore, terms such as “first” and “second” are used only to distinguish one component (or part of a component) from another component (or another part of a component).

[0020] This embodiment of the disclosure, by combining knowledge graphs and semantic reasoning, can generate feasible and optimal behavior plans after multiple rounds of reasoning, verification and optimization, ensuring high practicality and effectiveness even in complex environments. Figure 1This is an exemplary flowchart of a behavior planning and verification method based on knowledge graphs and semantic reasoning according to embodiments of this disclosure. Figure 1 In the method 100 shown at box S102, knowledge is extracted, fused and stored from target, resource and behavioral data from different data sources to construct a knowledge graph.

[0021] Data sources include a variety of data such as task descriptions, goal planning, and resource management. These data sources can be structured data (such as databases and tables), semi-structured data (such as JSON and XML), or unstructured data (such as text and logs).

[0022] According to one embodiment of this disclosure, natural language processing techniques and deep learning models are used to extract key entity, relation, and attribute information from multi-source data. For unstructured data, BiLSTM+CRF or BERT deep learning models can be used to identify entities in the text; for structured data, it is transformed through an ETL pipeline and finally associated in a knowledge graph. For example, "Resource A" and "Task B" are identified as entities using a BiLSTM+CRF model. The bidirectional nature of BiLSTM and the conditional random field mechanism of CRF can effectively improve extraction accuracy. A Seq2Seq joint extraction model is used to simultaneously extract entities and relationships between entities, generating "head entity-relationship-tail entity" triples. For example, "Task A needs resource B" or "Task B depends on task A". Dependency parsing or template matching techniques are used to extract entity-related attributes, such as resource availability, task priority, vulnerability CVSS score, attack time, etc. When labeled data is scarce, knowledge extraction can be performed by combining domain dictionaries (such as CPE and CVE terms) and pre-trained models (such as ALBERT). Customized models can be trained in conjunction with specific task domains (such as military, industrial, and project management) to improve extraction accuracy and semantic understanding capabilities.

[0023] Then, knowledge extracted from different data sources is fused through entity alignment. According to one embodiment of this disclosure, an ontology model is constructed and extended to describe various entities and their relationships in the domain. For example, a unified cybersecurity ontology (UCO) is used to integrate various standard terminology systems (e.g., CVE, CVSS, CPE, etc.), and semantic consistency is ensured through OWL attribute constraints. This process ensures that data from different sources can be mapped to the same entity. For example, the "Heartbleed vulnerability" may use different names in different sources, but through ontology design, it can be uniformly mapped to CVE-2014-0160. With changes in cybersecurity technologies, such as AI-driven APT attacks, the ontology needs to be dynamically extended. A bottom-up extension mechanism can be used to add new classes and attributes based on new attack patterns, maintaining the ontology's scalability.

[0024] Standardize entity names from different data sources using XPath or regular expressions. Calculate similarity between entities using graph embedding models such as TransE, and automatically align entities from different sources by assigning weights using an attention mechanism. Finally, tools like SHACL (Shapes Constraint Language) can be used to perform consistency and logical verification on the knowledge graph data, automatically identifying and marking conflicts from different sources. This ensures that the knowledge graph contains no erroneous or contradictory data.

[0025] Finally, the extracted and merged entities and their relationships are stored in a graph database to construct a knowledge graph, which is then incrementally updated based on new tasks, resources, and target data. For example, graph databases such as Neo4j can be used to store entities and their relationships, supporting efficient graph traversal and querying. For instance, nodes such as vulnerabilities and attack patterns can be connected through "attack chains" for easy visualization and analysis. In some scenarios, RDF triple (resource-predicate-object) format is used to store data to facilitate interconnection with external knowledge bases, enhancing the breadth and depth of the knowledge graph.

[0026] New threat intelligence can be continuously collected through web crawlers or accessed via API interfaces to connect to real-time data sources. This information can then be combined with the ComplEx graph embedding model to complete missing relationships in the knowledge graph, or path reasoning can be used to refine critical paths. Expert feedback is then invited, and the knowledge graph is updated after expert review to ensure its quality and timeliness. Through these technologies, the cybersecurity knowledge graph can continuously evolve within a closed loop of "collection-fusion-verification-update," maintaining both efficiency and accuracy.

[0027] Subsequently Figure 1At box S104, semantic reasoning and sequence arrangement are performed on the received task information based on the knowledge graph to generate a behavior plan.

[0028] To ensure proper coordination between various actions, effective resource utilization, and smooth execution, according to one embodiment of this disclosure, the task can be decomposed into multiple executable subtasks based on the received task information and a unified ontology representation in a knowledge graph. Key information (such as objectives, constraints, and resource requirements) from the task is extracted using rules defined by the ontology. Based on the task's complexity and objectives, the task is then broken down into multiple executable subtasks. Each subtask can be executed independently and has its own independent execution objective. For example, if the task is to perform a cybersecurity action, it can be decomposed into multiple subtasks such as data collection, vulnerability scanning, and attack response.

[0029] The connection between the subsequent state and the previous state of each subtask depends on certain reasoning rules, which include: Time sequence reasoning: Determine the start and end times of each action based on the task's time requirements, ensuring no time conflicts; Resource allocation reasoning: Ensure that the resources required for each action are available during execution, avoiding resource conflicts or shortages; Dependency reasoning: Ensure that the execution of an action does not violate the completion conditions of its predecessor actions, avoiding plan failures due to incorrect task dependencies. Based on the reasoning rules in the rule base and combined with the existing model library, it is possible to determine whether resource conflicts exist, whether time requirements are met, and whether dependencies exist.

[0030] For each subtask, causal reasoning and constraint reasoning can be applied to determine the relationship between the subsequent state and the preceding state, progressively selecting, judging, and associating different behaviors to establish interrelationships between them. For example, the execution of a certain behavior may affect the feasibility or priority of other behaviors. Reasoning rules are used to determine whether a certain behavior can be executed in the current time period. In each round of reasoning, based on the current state and known constraints, behaviors that meet the requirements are selected, and their feasibility is judged.

[0031] To fully verify the feasibility of behavioral planning, the reasoning and verification process can revolve around the following relationships: 1. Behavior-behavior reasoning Reasoning is performed between behavioral tasks to ensure that the order of actions, resource usage, etc., do not conflict. For example, action B may depend on the completion status of action A; precondition and postcondition reasoning can ensure that tasks are executed sequentially. Each action may only be executed within a specific time window, requiring reasoning to determine the time period for each action.

[0032] 2. Behavior-Task Reasoning Reasoning at the task level ensures a reasonable order of tasks and resource allocation. Based on task priority, the execution order of corresponding actions should be rationally arranged to prevent low-priority tasks from affecting the completion of high-priority tasks. If tasks share certain critical resources, the reasoning process needs to ensure the reasonable scheduling of resources to avoid conflicts.

[0033] 3. Behavior-Resource Reasoning Analyze the relationship between actions and resources to ensure effective resource utilization and prevent resource conflicts. Reason about the resource usage required for each action, optimize resource allocation, and avoid resource waste. For situations where multiple tasks or actions contend for the same resource, reason about feasible execution sequences to avoid conflicts caused by resource competition.

[0034] Finally, in box S106, a constraint-based state transition reasoning method is used to perform time conflict verification, resource conflict verification, execution sequence legality verification, and multi-objective conflict verification on the behavior planning, so that the behavior planning meets the time, resource, and objective constraints.

[0035] After the behavior plan is generated, to ensure its feasibility and optimality, a series of rule checks and boundary checks must be performed to ensure the efficient execution of the plan, avoid time and resource conflicts, and optimize the task execution sequence. The core of this process is the iterative reasoning and verification of the behavior sequence to ensure that each task is performed as expected and meets various constraints.

[0036] Specifically, the preceding and subsequent states of each task can be verified, and the execution sequence of actions can be checked to ensure it meets time, resource, and task requirements. According to one embodiment of this disclosure, graph theory methods can be used to model dependencies and resource conflicts between tasks. A directed acyclic graph (DAG) model is used to represent dependencies between tasks, where each task is a node in the graph, and data transfer or sequence constraints between tasks are represented by directed edges. Based on the DAG, the binding relationship between tasks and resources can also be represented by a graph. As resource states change, the DAG structure needs to be adjusted. For example, virtual nodes can represent resource waiting, thus affecting the task scheduling order. Nodes in a task-resource allocation graph (T-RAG) represent the combination of tasks and resources (e.g., task A and server X), while edges represent constraints on resource usage, such as data transfer volume and network bandwidth. A time-varying resource graph (TVRG) is used to represent the changes in resource states over time and space. It can jointly model computing, storage, and communication resources, and is particularly suitable for resource scheduling problems in dynamic environments. If two tasks share the same resources (such as GPUs or data files), conflicts will occur between them, which can be represented by edges in a conflict graph. The behavior sequence is adjusted based on the verification results. After each adjustment, the state transition reasoning and constraint verification are performed again to ensure that the time, resource and target constraints are met.

[0037] Based on task requirements and environmental characteristics, appropriate reasoning methods can be dynamically selected, and behavioral sequences that meet all constraints can be generated through repeated reasoning and optimization. Reasoning methods include fuzzy logic reasoning, ontology reasoning, probabilistic reasoning, deep learning augmented reasoning, and case-based reasoning.

[0038] Among these, fuzzy logic reasoning handles imprecise information through fuzzified input (such as threat indicators), rule evaluation (83 fuzzy rules), and defuzzified output. Ontology reasoning describes the relationships between cybersecurity entities using OWL ontology and SWRL rules. Taking the OntoCSD model as an example, the ontology associates attacks, vulnerabilities, and defense strategies, thereby automatically generating defense solutions. Probabilistic reasoning handles uncertainty and dynamic data using statistical methods such as Bayesian networks and evidence theory. Deep learning-enhanced reasoning, using algorithms like Yunyi Wuxiang, combines knowledge graphs and deep learning technologies to analyze massive amounts of vulnerability data in real time and generate probabilistic protection strategy suggestions. Case-based reasoning matches the current context with a historical case library, enabling rapid generation of solutions adapted to the current environment. Utilizing attack patterns and defense solutions in the case library, it matches real-time attack features through semantic similarity matching to generate corresponding response strategies.

[0039] According to one embodiment of this disclosure, fuzzy logic reasoning and deep learning models are preferentially selected for threat detection. Ontology reasoning and rule-based reasoning are employed for policy verification. Rule-based reasoning is used for structured data, while knowledge graphs and deep learning are combined to process unstructured data and support complex decision-making. Utilizing techniques such as rule-based reasoning, probabilistic reasoning, and case-based reasoning, the system can automatically adjust decision-making strategies in dynamic environments and dynamically combine reasoning methods based on task and data characteristics through an adaptive selection mechanism, ensuring accurate implementation and timely response of network security behavior planning.

[0040] The system collects the latest information on the external environment and resources in real time. If new information or environmental changes occur, the behavior plan is re-optimized based on the new information. The constraint-based state transition reasoning method not only improves the feasibility and optimality of behavior planning, but also provides strong support for complex task arrangements. Through iterative reasoning, the behavior plan is adjusted and optimized to achieve the expected goal.

[0041] Figure 2 This is a schematic block diagram of a behavior planning and verification apparatus based on knowledge graphs and semantic reasoning, according to embodiments of the present disclosure. Figure 2 As shown, the device 200 may include a processor 210 and a memory 220 storing a computer program. When the computer program is executed by the processor 210, the device 200 is made capable of performing actions such as... Figure 1The steps of the method are shown. In one example, device 200 can extract, fuse, and store knowledge from target, resource, and behavioral data from different data sources to construct a knowledge graph; based on the knowledge graph, it can perform semantic reasoning and sequence arrangement on the received task information to generate a behavior plan; and it can use a constraint-based state transition reasoning method to perform time conflict verification, resource conflict verification, execution sequence legality verification, and multi-target conflict verification on the behavior plan to ensure that the behavior plan meets time, resource, and target constraints.

[0042] In some embodiments of this disclosure, the device 200 can use natural language processing techniques and deep learning models to extract key entity, relation, and attribute information from multi-source data; perform data fusion of knowledge extracted from different data sources through entity alignment; store the extracted and fused entities and their relations in a graph database to construct a knowledge graph; and incrementally update the knowledge graph according to new tasks, resources, and target data.

[0043] In some embodiments of this disclosure, the device 200 can identify entities in text using a BiLSTM+CRF or BERT deep learning model; use a Seq2Seq joint extraction model to extract entities and relationships between entities simultaneously, and generate triples of “head entity-relationship-tail entity”; and use dependency parsing or template matching techniques to extract entity-related attributes.

[0044] In some embodiments of this disclosure, the apparatus 200 can construct and extend an ontology model to describe various entities and their relationships in a domain; standardize entity names from different data sources using XPath or regular expressions; calculate the similarity between entities using a graph embedding model and assign weights using an attention mechanism to automatically align entities from different sources; and use the SHACL tool to perform logical consistency verification on triples.

[0045] In some embodiments of this disclosure, the device 200 can continuously collect new threat intelligence by using a web crawler or access a real-time data source through an API interface; use a graph embedding model to complete the missing relationships in the knowledge graph, or improve the critical path through path reasoning, and update the knowledge graph after expert review.

[0046] In some embodiments of this disclosure, the device 200 can decompose the task into multiple executable subtasks based on the received task information and a unified ontology representation in the knowledge graph; for each subtask, causal reasoning and constraint reasoning are applied to determine the relationship between the subsequent state and the previous state of the task, and different behaviors are selected, judged, and associated step by step to establish the interrelationship between behaviors; the optimization algorithm in the model library is used to optimize the recommendation scheme, and the previous and subsequent states of each recommendation scheme are verified to generate a specific behavior sequence; the latest information on the external environment and resources is collected in real time, and multi-dimensional analysis is performed in combination with task requirements and external information to identify the optimal execution path.

[0047] In some embodiments of this disclosure, the device 200 can verify the pre-state and post-state of each task, and verify whether the behavior execution sequence meets the time, resource and task requirements; adjust the behavior order according to the verification results, and re-perform state transition reasoning and constraint verification after each adjustment to ensure that it meets the time, resource and target constraints; collect the latest information on the external environment and resources in real time, and if there is new information or environmental changes, re-optimize the behavior planning according to the new information.

[0048] In some embodiments of this disclosure, the device 200 can dynamically select appropriate reasoning methods based on task requirements and environmental characteristics, and generate a behavior sequence that meets all constraints through repeated reasoning and optimization. The reasoning methods include fuzzy logic reasoning, ontology reasoning, probabilistic reasoning, deep learning augmented reasoning, and case reasoning. Fuzzy logic reasoning is used to fuzzify the input data and process imprecise information through rule evaluation, aggregation, and defuzzification of the output. Ontology reasoning is used to describe the relationships between entities using OWL ontology and SWRL rules, and generate defense schemes by associating attacks, vulnerabilities, and defense strategies with ontology. Probabilistic reasoning is used to process uncertain and dynamic data based on Bayesian networks. Case reasoning is used to compare the current situation with existing cases based on matching with a historical case library to generate corresponding defense strategies.

[0049] In embodiments of this disclosure, processor 210 may be, for example, a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a processor based on a multi-core processor architecture, etc. Memory 220 may be any type of memory implemented using data storage technologies, including but not limited to random access memory, read-only memory, semiconductor-based memory, flash memory, disk storage, etc.

[0050] Furthermore, in embodiments of this disclosure, device 200 may also include input device 230, such as a keyboard, mouse, etc. Additionally, device 200 may also include output device 240, such as a display, etc.

[0051] In other embodiments of this disclosure, a computer-readable storage medium storing a computer program is also provided, wherein the computer program, when executed by a processor, is capable of performing the following functions: Figure 1 The steps of the behavior planning verification method based on knowledge graphs and semantic reasoning are shown.

[0052] In summary, the behavior planning verification method and apparatus based on knowledge graphs and semantic reasoning according to embodiments of this disclosure can model the relationships between behavioral elements such as goals, resources, and time by constructing a knowledge graph, thereby better understanding the dependencies, conflicts, and constraints between tasks and generating reasonable behavior plans. Verifying the behavior plans through semantic reasoning allows for real-time adjustments based on actual conditions, ensuring the feasibility and optimality of the action plan.

[0053] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatuses and methods according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0054] Unless otherwise expressly indicated by the context, the singular form of words used herein and in the appended claims includes the plural form, and vice versa. Thus, when referring to the singular, the plural form of the corresponding term is generally included. Similarly, the terms “comprising” and “including” shall be interpreted as including rather than exclusively. Likewise, the terms “including” and “or” shall be interpreted as including unless such interpretation is expressly prohibited herein. Where the term “example” is used herein, particularly when it follows a set of terms, “example” is merely exemplary and illustrative and should not be considered exclusive or extensive.

[0055] Further aspects and scope of adaptation become apparent from the description provided herein. It should be understood that various aspects of this application may be implemented individually or in combination with one or more other aspects. It should also be understood that the descriptions and specific embodiments herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0056] Several embodiments of this disclosure have been described in detail above. However, it is obvious that those skilled in the art can make various modifications and variations to the embodiments of this disclosure without departing from the spirit and scope of this disclosure. The scope of protection of this disclosure is defined by the appended claims.

Claims

1. A behavior planning verification method based on a knowledge graph and semantic reasoning, characterized in that, The method comprises the following steps: knowledge extraction, fusion and storage of target, resource and behavior data from different data sources to build a knowledge graph; semantic reasoning and sequence arrangement of received task information based on the knowledge graph to generate a behavior plan; and time conflict checking, resource conflict checking, execution sequence legality checking and multi-target conflict checking of the behavior plan by using a constraint-based state transition reasoning method to make the behavior plan meet time, resource and target constraints. 2.The behavior planning verification method based on a knowledge graph and semantic reasoning according to claim 1, wherein, The knowledge extraction, fusion and storage of target, resource and behavior data from different data sources to build a knowledge graph comprises the following steps: extracting key entity, relationship and attribute information from multi-source data using natural language processing technology and deep learning models; data fusion of knowledge extracted from different data sources through entity alignment; and storing the extracted and fused entities and their relationships in a graph database to build a knowledge graph, and incrementally updating the knowledge graph according to new task, resource and target data. 3.The behavior planning verification method based on a knowledge graph and semantic reasoning according to claim 2, characterized in that, The step of extracting key entity, relationship and attribute information from multi-source data using natural language processing technology and deep learning models comprises the following steps: identifying entities in the text through a BiLSTM+CRF or BERT deep learning model; simultaneously extracting entities and relationships between entities using a Seq2Seq joint extraction model, and generating "head entity-relation-tail entity" triples; and extracting attributes related to the entity using dependency syntax analysis or template matching technology. 4.The behavior planning verification method based on a knowledge graph and semantic reasoning according to claim 3, characterized in that, The step of data fusion of knowledge extracted from different data sources through entity alignment comprises the following steps: building and extending an ontology model to describe various entities and their relationships in the field; standardizing entity names in different data sources using XPath or regular expression; calculating the similarity between entities through a graph embedding model, and assigning weights by combining attention mechanisms to automatically align entities from different sources; and using SHACL tools to verify the logical consistency of the triples. 5.The behavior planning verification method based on a knowledge graph and semantic reasoning according to claim 2, characterized in that, The step of storing the extracted and fused entities and their relationships in a graph database to build a knowledge graph, and incrementally updating the knowledge graph according to new task, resource and target data comprises the following steps: continuously collecting new threat intelligence using a crawler tool or accessing real-time data sources through an API interface; completing missing relationships in the knowledge graph using a graph embedding model, or perfecting key paths through path reasoning, and updating the knowledge graph after expert review. 6.The behavior planning verification method based on a knowledge graph and semantic reasoning according to claim 1, wherein, The step of semantic reasoning and sequence arrangement of received task information based on the knowledge graph to generate a behavior plan comprises the following steps: based on the received task information, decomposing the task into multiple executable subtasks according to the unified ontology representation in the knowledge graph; for each subtask, applying causal relationship reasoning and constraint reasoning to judge the relationship between the subsequent state and the pre-state of the task, and gradually selecting, judging and associating different behaviors to establish the mutual relationship between behaviors. 7.The behavior planning verification method based on a knowledge graph and semantic reasoning according to claim 1, wherein, The constraint-based state transition reasoning method is used to check the behavior planning for time conflict, resource conflict, execution sequence legality, and multi-objective conflict, so that the behavior planning meets the time, resource, and target constraints, including: The pre-state and post-state of each task are checked, and whether the behavior execution sequence meets the time, resource, and task requirements is checked; According to the checking result, the behavior sequence is adjusted, and after each adjustment, state transition reasoning and constraint checking are performed again to make it meet the time, resource, and target constraint conditions; and Real-time collection of the latest information of external environment and resources, if there is new information or environmental change, the behavior planning is re-optimized according to the new information. 8.The behavior planning verification method based on a knowledge graph and semantic reasoning according to claim 7, characterized in that, The constraint-based state transition reasoning method is used to check the behavior planning for time conflict, resource conflict, execution sequence legality, and multi-objective conflict, so that the behavior planning meets the time, resource, and target constraints, including: According to the task requirements and environmental characteristics, a suitable reasoning method is dynamically selected to generate a behavior sequence that meets all constraint conditions through repeated reasoning and optimization, the reasoning method including fuzzy logic reasoning, ontology reasoning, probability reasoning, deep learning enhanced reasoning, and case reasoning, The fuzzy logic reasoning is used to fuzz the input data, and through rule evaluation, aggregation, and de-fuzzing output, it processes inaccurate information; the ontology reasoning is used to describe the relationship between entities using OWL ontology and SWRL rules, and through ontology association attack, vulnerability, and defense strategy generation, a defense scheme is generated; the probability reasoning is used to process uncertainty and dynamic data based on Bayesian network; the case reasoning is used to match the current situation with existing cases based on the historical case library, and the corresponding defense strategy is generated. 9.A behavior planning verification device based on a knowledge graph and semantic reasoning, characterized in that, The device includes: At least one processor; and At least one memory storing a computer program; When the computer program is executed by the at least one processor, the device performs the steps of the behavior planning verification method based on knowledge graph and semantic reasoning according to any one of claims 1 to 8.

10. A computer readable storage medium storing a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the behavior planning verification method based on knowledge graph and semantic reasoning according to any one of claims 1 to 8.

Images