Intelligent determination method and system for unknown threats based on multi-modal knowledge graph

Abstract

The application provides a kind of unknown threat intelligent determination method and system based on multi-modal knowledge graph, it is related to computer security detection technical field.Therein, the application first obtains system performance time series data and security log data;Second, construct network security knowledge graph;Then, system performance time series data is converted into the state attribute of asset node in topological structure layer, and simultaneously, security log data is converted into security event node in event sequence layer, to generate dynamic interaction subgraph;Next, based on dynamic interaction subgraph, graph reasoning is carried out, and the correlation confidence is calculated, when the correlation confidence is lower than the pre-set confidence threshold, it is determined that there is abnormal behavior;Finally, according to the difference between the abnormal behavior and the known threat mode, unknown threat is determined, the technical scheme of the application not only improves the depth and accuracy of potential abnormal behavior discovery, but also improves the cognition and defense ability of unknown threat.

Description

Technical Field

[0001] This application relates to the field of computer security detection technology, and in particular to a method and system for intelligent determination of unknown threats based on multimodal knowledge graphs. Background Technology

[0002] In the field of cybersecurity, unknown threats such as advanced persistent threats (APTs) and zero-day attacks are becoming increasingly frequent, with complex and covert attack chains. To address this challenge, there is an urgent need for an intelligent method that can automatically and in real time integrate multi-source heterogeneous data and perform in-depth reasoning and judgment on abnormal behavior, so as to achieve the transformation from passive alerts to proactive discovery of unknown threats.

[0003] Currently, the adopted technical solution is a threat detection method based on graph neural networks. This solution constructs a static network topology graph by modeling network assets as nodes and relationships between assets as edges. At the same time, security events are associated with corresponding asset nodes to form a preliminary association graph. Subsequently, graph neural networks are used to perform representation learning on the graph to identify abnormal nodes or subgraphs that deviate from the normal pattern, thereby alerting potential threats.

[0004] However, the existing scheme has significant limitations. The maps it constructs usually lack in-depth characterization and quantitative analysis of the dynamic interaction between the real-time operating status of assets and security events. It is difficult to effectively assess the causal and confidence relationship between events and changes in asset status, resulting in insufficient accuracy in identifying potential threats, especially unknown attack patterns, and a high false alarm rate. Summary of the Invention

[0005] This application provides a method and system for intelligent identification of unknown threats based on multimodal knowledge graphs, in order to solve the problems of weak ability to analyze dynamic behavior correlations and low accuracy in the discovery of unknown threats in existing technologies.

[0006] Firstly, this application provides a method for intelligently identifying unknown threats based on multimodal knowledge graphs, including:

[0007] Acquire system performance time-series data generated by network devices, servers, and terminal devices, as well as security log data generated by the security platform;

[0008] Construct a cybersecurity knowledge graph, which includes a topology layer and an event sequence layer;

[0009] The system performance time-series data is converted into the state attributes of asset nodes in the topology layer, and the security log data is converted into security event nodes in the event sequence layer.

[0010] Based on the association between the security event node and the asset node within a preset time range, an interaction edge connecting the security event node and the asset node is generated in the network security knowledge graph, thus generating a dynamic interaction subgraph.

[0011] Graph reasoning is performed based on the dynamic interactive subgraph to calculate the association confidence between the state attribute and the security event node. When the association confidence is lower than a preset confidence threshold, it is determined that there is abnormal behavior.

[0012] Unknown threats are identified based on the differences between the described abnormal behavior and known threat patterns.

[0013] Optionally, a cybersecurity knowledge graph is constructed, comprising a topology layer and an event sequence layer, including:

[0014] Extract the physical connection relationships, logical access relationships, and data flow relationships between assets from the pre-stored network architecture configuration file;

[0015] An asset relationship database is constructed based on the physical connection relationship, logical access relationship and data flow relationship, and each asset in the asset relationship database is defined as a node, and the connection or access path between assets is defined as an edge to form a topology layer.

[0016] Define the correspondence between security event types and attack behaviors from the pre-stored threat intelligence database and protocol specifications, construct a security event database based on the correspondence, and define each security event record in the security event database as a security event node to form an event sequence layer;

[0017] Establish a mapping relationship between asset nodes in the asset relationship database and security event nodes in the security event database;

[0018] Based on the mapping relationship, the topology layer is associated with the event sequence layer to generate a network security knowledge graph.

[0019] Optionally, the system performance time-series data is converted into the state attributes of asset nodes in the topology layer, and the security log data is converted into security event nodes in the event sequence layer, including:

[0020] Monitoring data corresponding to each asset is separated from the system performance data stream based on the asset identifier, which includes an IP address and a MAC address;

[0021] Extract CPU utilization, memory usage, and network traffic features from monitoring data to form a feature dataset;

[0022] The feature dataset is bound to the asset node corresponding to the asset identifier in the topology layer, serving as the state attribute of the asset node;

[0023] Parse the security log data generated by the security platform to obtain information such as operation type, source IP, destination IP, timestamp, and operation result;

[0024] Based on predefined attack pattern rules, the operation type is mapped to the standard security event type;

[0025] Multiple log records with the same source IP, destination IP, and standard security event type, and within a preset time period, are merged into a single security transaction.

[0026] The security transaction is created as a security event node in the event sequence layer, and the security event node is associated with the asset node corresponding to the source IP and the destination IP.

[0027] Optionally, based on the association between the security event node and the asset node within a preset time range, an interaction edge connecting the security event node and the asset node is generated in the network security knowledge graph, generating a dynamic interaction subgraph, including:

[0028] Obtain the timestamp information of security event nodes in the event sequence layer;

[0029] Filter out target security event nodes whose timestamps fall within a preset time range;

[0030] Identify the source asset identifier and target asset identifier corresponding to each target security event node;

[0031] Locate the target asset node corresponding to the source asset identifier and the target asset identifier in the topology layer;

[0032] Establish a bidirectional association edge between the target security event node and each target asset node;

[0033] Based on all established bidirectional edges and the target security event nodes and target asset nodes connected by the bidirectional edges, a dynamic interactive subgraph is generated.

[0034] Optionally, a bidirectional association edge is established between the target security event node and each target asset node, including:

[0035] Based on the event type of the target security event node and the asset type of the target asset node, determine the interaction relationship type between the security event node and the asset node;

[0036] Based on the determined interaction relationship type, create the first directed edge from the target security event node to the target asset node, representing the impact of the attack on the asset;

[0037] At the same time, a second directed edge is created from the same target asset node to the target security event node, representing the asset's response status to the attack.

[0038] Set a relation type attribute for the first directed edge to record attack tactics information;

[0039] Set a state feedback attribute for the second directed edge to record changes in the security status of the asset;

[0040] Add the first directed edge and the second directed edge as a pair of bidirectional related edges to the cybersecurity knowledge graph.

[0041] Optionally, graph reasoning is performed based on the dynamic interaction subgraph to calculate the association confidence between the state attribute and the security event node. When the association confidence is lower than a preset confidence threshold, abnormal behavior is determined to exist, including:

[0042] Iterate through each asset node in the dynamic interaction subgraph and obtain the state attributes of each asset node;

[0043] Identify all target security event nodes connected to their corresponding asset nodes via bidirectional association edges;

[0044] The matching degree between the state attributes and the event characteristics of each connected target security event node is calculated to obtain multiple initial matching values;

[0045] The initial matching values ​​for each asset node are aggregated to generate a comprehensive matching degree for each asset node.

[0046] The overall matching degree of each asset node is compared with a preset confidence threshold. When the overall matching degree is lower than the preset confidence threshold, the asset node is marked as having abnormal behavior.

[0047] Optionally, an unknown threat is determined based on the difference between the anomalous behavior and known threat patterns, including:

[0048] Extract the state attribute change features of asset nodes marked as exhibiting abnormal behavior;

[0049] Obtain the event sequence characteristics of all target security event nodes associated with the asset node exhibiting abnormal behavior within the abnormal time period;

[0050] By combining state attribute change features with event sequence features, an abnormal behavior feature vector is formed;

[0051] The similarity between the abnormal behavior feature vector and the threat feature vector in the known threat pattern library is compared, and the difference between the abnormal behavior feature vector and each known threat feature vector is calculated.

[0052] When all differences exceed the preset difference threshold, the current abnormal behavior feature vector is determined to correspond to an unknown threat, and the self-learning module is triggered to update the knowledge graph.

[0053] Secondly, this application provides an intelligent system for determining unknown threats based on a multimodal knowledge graph, comprising:

[0054] The acquisition module is used to acquire system performance time-series data generated by network devices, servers and terminal devices, as well as security log data generated by the security platform.

[0055] The construction module is used to build a cybersecurity knowledge graph, which includes a topology layer and an event sequence layer.

[0056] The conversion module is used to convert the system performance time-series data into the state attributes of asset nodes in the topology layer, and to convert the security log data into security event nodes in the event sequence layer.

[0057] The generation module is used to generate interactive edges connecting the security event nodes and the asset nodes in the network security knowledge graph based on the association between the security event nodes and the asset nodes within a preset time range, and to generate a dynamic interactive subgraph.

[0058] The calculation module is used to perform graph reasoning based on the dynamic interaction subgraph, calculate the association confidence between the state attribute and the security event node, and determine that there is abnormal behavior when the association confidence is lower than a preset confidence threshold.

[0059] The determination module is used to determine unknown threats based on the differences between the abnormal behavior and known threat patterns.

[0060] Thirdly, this application provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement the intelligent determination method for unknown threats based on a multimodal knowledge graph as described in the first aspect above.

[0061] Fourthly, this application provides a computer storage medium storing a computer program, which, when executed by a computer, implements the method for intelligent determination of unknown threats based on a multimodal knowledge graph as described in the first aspect.

[0062] This application transforms system performance time-series data into real-time state attributes of asset nodes and security logs into event nodes, achieving multimodal fusion of network dynamic operating states and security events within a unified knowledge graph. Based on this, it dynamically generates interaction subgraphs of connection state attributes and security events according to time windows, thereby deeply characterizing the dynamic correlation and impact path between attack behaviors and changes in asset states. By calculating the confidence level of this correlation, it can effectively identify hidden anomalies that exhibit weak correlations, contradictions, or illogicalities between events and states. This solves the problem of superficial analysis and lack of quantitative evaluation in the correlation analysis between dynamic behaviors and states in existing technologies, improving the depth and accuracy of discovering potential abnormal behaviors.

[0063] Furthermore, by combining abnormal state features with associated event sequence features, an abnormal behavior feature vector that comprehensively describes the attack chain is constructed. By systematically comparing this vector with a known threat pattern library, an unknown threat is only identified when it shows significant differences from all known patterns. This process effectively avoids misclassifying new threats as variants of known threats or causing false negatives, ensuring the reliability of unknown threat identification. At the same time, it triggers the knowledge graph's self-learning mechanism, enabling the continuous accumulation of new knowledge, thereby continuously improving the ability to recognize and defend against unknown threats in a closed loop.

[0064] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0065] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0066] Figure 1 A flowchart of an intelligent method for determining unknown threats based on multimodal knowledge graphs, as provided in this application, is shown.

[0067] Figure 2 A schematic diagram of the structure of an intelligent unknown threat determination system based on multimodal knowledge graph provided in this application is shown.

[0068] Figure 3 A schematic diagram of the structure of a computing device provided in this application is shown. Detailed Implementation

[0069] To enable those skilled in the art to better understand the present application, the technical solution of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0070] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0071] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0072] Figure 1 This application provides a flowchart of a method for intelligently determining unknown threats based on multimodal knowledge graphs, as shown below. Figure 1 As shown, the method includes:

[0073] Step 101: Obtain system performance time-series data generated by network devices, servers, and terminal devices, as well as security log data generated by the security platform.

[0074] In this solution, system performance time-series data refers to the indicator data that is periodically collected from the monitored computing device and arranged in chronological order, reflecting its workload and health status. It is used to quantitatively describe the real-time status and change trend of network assets during operation, and is obtained periodically by calling the performance monitoring interface provided by the device itself or by installing a lightweight collection agent program.

[0075] Security log data refers to the information automatically generated by various security protection software and devices deployed in the network when they detect specific activities or rule matches. It is used to faithfully record suspicious behaviors, policy violations or attack events that occur in the network. It is obtained by centrally capturing and receiving data from the standard output interfaces of these security products through a configured log collector.

[0076] In this step, firstly, by calling the built-in system management interfaces of network devices, servers, and terminal devices, such as the SNMP protocol, or by pre-installing and running a resource monitoring program on these devices, the system automatically reads a series of key performance indicators such as CPU utilization, memory usage, network interface inbound and outbound traffic, and disk read / write speeds at pre-set time intervals, such as every 30 seconds or every minute. The results of each read are recorded along with their precise timestamps, forming a continuous time-series data stream of system performance. Secondly, a centralized log collection server is deployed in the network management area, and standard log transmission protocols such as Syslog and Kafka are used to communicate with firewalls and intrusion detection systems. The system establishes connections with multiple security platforms, including the detection system and host security agent, continuously pulling or receiving every alarm record, access audit log, or attack signature matching record generated by these platforms in real time. It then unifies and standardizes the raw logs of varying formats into a structured security log data stream. Finally, the two parallel data streams are transmitted to different storage areas of the backend analysis system through encrypted network channels. For example, timestamped performance metrics are stored in a specially optimized time-series database, while structured security event logs are stored in the search analysis engine. This completes the aggregation and classification of raw data, preparing pre-processed input data for the next stage of in-depth correlation and knowledge construction.

[0077] For example, in an enterprise intranet environment, standard performance monitoring functions are first enabled on the core switch, multiple application servers, and employees' office computers. Secondly, the monitoring system polls these devices every 20 seconds via SNMP to obtain CPU, memory, and network bandwidth usage data, forming continuous system performance time-series data. Simultaneously, the enterprise's next-generation firewall, web application firewall, and host security software installed on the servers send all detected abnormal access requests, vulnerability exploitation attempts, and malicious file alerts to the central log management platform in real time. The central log management platform then receives and parses this information, forming standard-format security log data. Finally, the system performance time-series data and security log data are comprehensively aggregated in the data analysis backend, becoming the starting point for all subsequent analyses.

[0078] Step 102: Construct a cybersecurity knowledge graph, which includes a topology layer and an event sequence layer.

[0079] Optionally, step 102 may specifically include:

[0080] Step 1021: Extract the physical connection relationships, logical access relationships, and data flow relationships between assets from the pre-stored network architecture configuration file.

[0081] Step 1022: Construct an asset relationship database based on the physical connection relationship, logical access relationship and data flow relationship, and define each asset in the asset relationship database as a node, and define the connection or access path between assets as an edge to form a topology layer.

[0082] Step 1023: Define the correspondence between security event types and attack behaviors from the pre-stored threat intelligence database and protocol specifications, construct a security event database based on the correspondence, and define each security event record in the security event database as a security event node to form an event sequence layer.

[0083] Step 1024: Establish a mapping relationship between asset nodes in the asset relationship database and security event nodes in the security event database.

[0084] Step 1025: Based on the mapping relationship, associate the topology layer with the event sequence layer to generate a network security knowledge graph.

[0085] In this step, a cybersecurity knowledge graph refers to a structured semantic network used to describe and associate various entities and their complex relationships in the cybersecurity field. It is used to integrate scattered asset information, topological relationships, and security events into a unified and interconnected knowledge model.

[0086] The topology layer refers to a subgraph in a knowledge graph that represents the composition and connection relationships of network infrastructure. It is used to visually display the physical and logical connection status between network devices, servers, and other assets. It is constructed by parsing the network architecture configuration file and defining assets as nodes and the relationships between assets as edges.

[0087] The event sequence layer refers to a subgraph in the knowledge graph used to organize and record security events and their attributes in a timeline. It is used to structurally record security event information such as attack behaviors and alarms and their temporal relationships. It is formed by integrating threat intelligence, protocol specifications and defining events as nodes.

[0088] Pre-stored network architecture configuration files refer to electronic documents that are saved in advance and describe the hardware composition, connection methods and communication rules of the network system. They are used to provide the underlying connection and access policy information required to build the network topology and are exported from network management.

[0089] Physical connectivity refers to the relationship between network devices that are directly connected through physical media such as cables and ports, and is used to characterize the hardware connectivity at the network layer.

[0090] Logical access relationships refer to the communication or access permission relationships established between network assets based on logical rules such as IP address, port, and protocol, and are used to characterize the communication paths of upper-layer applications.

[0091] Data flow relationships refer to the direction and sequence of data flow among multiple network assets in a specific business or service, and are used to characterize the information exchange links at the business level.

[0092] An asset relationship database is a structured collection that stores all network asset entities and their physical, logical, and data flow relationships, used to provide standardized node and edge data for the topology layer of a knowledge graph.

[0093] A pre-stored threat intelligence database refers to a pre-established database containing information such as known attack patterns, malware characteristics, and hacker organization tactics. It is used to provide knowledge for identifying and classifying security incidents and is obtained by integrating internal historical attack data.

[0094] Security incident types refer to the standardized classification of security alerts or abnormal behaviors according to dimensions such as attack methods and affected targets, which are used to uniformly identify and understand the security threats represented by different security logs.

[0095] An attack refers to a series of specific technical actions taken by hackers or malware to achieve their goals, and is used to describe the malicious nature of a security incident.

[0096] A security event database is a structured collection that stores all security event records that have been standardized, categorized, and described. It is used to provide node data for the event sequence layer of a knowledge graph and is constructed by integrating threat intelligence knowledge and defining the attributes of each record.

[0097] An asset node refers to a graph node in the knowledge graph topology layer that represents a specific network device, server, or terminal entity and is used to uniquely identify and carry the attribute information of that asset in the graph.

[0098] A security event node refers to a graph node in the event sequence layer of a knowledge graph that represents a specific security alert or attack event record. It is used to uniquely identify and carry the attribute information of the event in the graph.

[0099] In this step, firstly, an automated script is written to call the file reading and text parsing module to read and analyze the pre-stored network architecture configuration file. This script will identify key information in the file, such as device names, IP addresses, connection ports, access control lists, and descriptions of business data flow. It will then extract which devices are physically connected via network cables, which IP addresses are allowed to access specific server ports, and which servers specific business data will flow through sequentially, thus obtaining the physical connection relationships, logical access relationships, and data flow relationships between assets. Secondly, a data table called "Asset Relationship Database" is created using a graph database. Each extracted network asset, such as a switch or server, is defined as an independent record in this graph database, i.e., an asset node. Then, the three relationships of physical connection, logical access, and data flow are defined and stored as edges with different types of attributes connecting two asset nodes, thus completely constructing the topology layer of the knowledge graph.

[0100] Again, by querying and analyzing the pre-stored threat intelligence database and common network protocol specification documents, a standard security event classification system is defined through a rule engine. For example, port scanning, brute-force attacks, and Trojan communication are defined as standard security event types. Then, based on this classification system, a security event database is created. Every historical or real-time reported attack behavior record that matches a certain type is standardized into a record containing fields such as event type, timestamp, and source / destination addresses. A corresponding security event node is created for each record in the knowledge graph, thus forming an event sequence layer. Next, an association matching algorithm, typically based on IP address, main... Common identifiers such as machine names are compared between the asset relationship database and the security event database. When the source address or destination address in the security event record matches the address information of a certain asset node, a potential mapping relationship is established between the security event node and the corresponding asset node. Finally, through the knowledge graph construction engine, the established mapping relationship is used as the association rule to integrate all asset nodes in the topology layer and related security event nodes in the event sequence layer into the same graph data structure. This graph data structure is ultimately generated into a complete network security knowledge graph that contains a static connection view of the network and also associates dynamic security event flows.

[0101] For example, following the specific implementation of the previous step, firstly, the configuration file recording the core network structure is handed over to the analysis platform to automatically parse the file. It is found that core switch A is physically connected to the gateway of server cluster B via fiber optic cable, indicating a physical connection relationship. Simultaneously, the access control policy allows all internal terminals C to access port 80 of server B, indicating a logical access relationship. Secondly, these relationships are stored in an asset relationship database, where devices A, B, and C become asset nodes, and the connections between them become edges in the topology layer. Then, referring to a publicly available threat knowledge base, SQL injection attacks are defined as a standard security attack. All event types are recorded and entered into the security event database. When the Web Application Firewall E reports an attack log, it is classified as an SQL injection attack event based on its attack characteristics, and a security event node is created for it at the event sequence layer. Then, the source and target IPs of this attack log are checked. If the source IP is the address of terminal C and the target IP is the address of server B, a mapping relationship is established between the two asset nodes C and B and the security event node. Finally, the engine integrates asset nodes, edges, security event nodes and the mapping relationships between them into a unified, visualized and computable network security knowledge graph.

[0102] This step constructs a cybersecurity knowledge graph that integrates static topology and dynamic events. It integrates the originally scattered network asset information, connection relationships, and security events into a unified, computable, and associative knowledge model. This provides a precise and structured global association foundation for subsequent in-depth analysis of the dynamic impact relationship between security events and asset status. It effectively solves the problem of isolated network structure, asset attributes, and security alarm information in traditional methods, making collaborative analysis difficult. This provides a core knowledge framework for achieving intelligent threat assessment.

[0103] Step 103: Convert the system performance time-series data into the state attributes of asset nodes in the topology layer, and convert the security log data into security event nodes in the event sequence layer.

[0104] Optionally, step 103 may specifically include:

[0105] Step 1031: Separate monitoring data corresponding to each asset from the system performance data stream based on the asset identifier, which includes IP address and MAC address.

[0106] Step 1032: Extract CPU utilization, memory usage, and network traffic feature points from the monitoring data to form a feature dataset.

[0107] Step 1033: Bind the feature dataset to the asset node corresponding to the asset identifier in the topology layer as the state attribute of the asset node.

[0108] Step 1034: Parse the security log data generated by the security platform to obtain the operation type, source IP, destination IP, timestamp, and operation result information.

[0109] Step 1035: Map the operation type to the standard security event type according to the predefined attack pattern rules.

[0110] Step 1036: Merge multiple log records with the same source IP, destination IP, and standard security event type within a preset time period into a single security transaction.

[0111] Step 1037: Create a security transaction as a security event node in the event sequence layer, and associate the security event node with the asset nodes corresponding to the source IP and destination IP.

[0112] In this step, the state attributes of an asset node refer to a series of dynamically changing numerical indicators attached to the asset node in the topology layer of the network security knowledge graph. These indicators are used to quantitatively characterize the network device's operating load and health status at a specific moment.

[0113] Monitoring data refers to the set of raw performance readings belonging to a specific network device, filtered from the continuously collected system performance time-series data stream based on unique identifiers such as IP address or MAC address, and used as the basis for analyzing the individual behavior and status of that device.

[0114] CPU utilization refers to the percentage of time that the central processing unit (CPU) spends executing non-idle tasks per unit of time, and is used to measure the degree of computing resource consumption of a computing device.

[0115] Memory usage refers to the physical memory capacity occupied by all currently running programs, and is used to measure the consumption of temporary data storage resources on computing devices.

[0116] Network traffic characteristic points refer to several key indicators that are monitored on network interfaces and reflect the status of data transmission and reception, such as the number of data packets sent per second or the number of bytes transmitted per second. They are used to measure the network communication activity and bandwidth usage of computing devices.

[0117] A feature dataset refers to a set of values, such as CPU utilization, memory usage, and network traffic feature points, that are calculated and extracted from the monitoring data of an asset and arranged in chronological order. It is used to comprehensively and quantitatively describe the operating status curve of the asset over a period of time.

[0118] Operation type refers to the specific activity category recorded in a single security log and identified by the security device, used to initially describe the nature of the security event reflected in the log.

[0119] The source IP refers to the Internet Protocol address of the originating device that initiated the connection or request in a network activity record, and is used to trace the source of a security incident.

[0120] The destination IP refers to the Internet Protocol address of the target device that received the connection or request in a network activity record, and is used to locate the attack target of a security event.

[0121] A timestamp records the specific date and time of an event, used to determine the chronological order and timing of events.

[0122] Operation result information refers to the actions taken or the judgments made by the security equipment in response to the operation it detected, such as allowing passage, generating an alarm, or directly blocking, which is used to explain the final handling status of the event.

[0123] Predefined attack pattern rules refer to a set of logical judgment conditions formulated in advance by security experts, which associate the characteristics of raw logs with standardized attack classifications, and are used to automatically classify messy security logs.

[0124] Standard security incident types refer to a unified and standardized security incident classification and naming system predefined based on authoritative threat intelligence and industry best practices, used to standardize and structure the identification of emerging attack methods.

[0125] A security transaction refers to the aggregation of multiple independent but related security log records from the same source, with the same target, and belonging to the same attack type within a preset time period into a single logical unit representing a complete attack activity. This is used to simplify the granularity of analysis and more clearly reflect the overall picture of an attack attempt.

[0126] In this step, firstly, a data distribution program is written to read the acquired raw system performance time-series data stream. This program checks the IP address or MAC address field in each performance data record, and then filters and categorizes all performance data records belonging to the same network device, server, or terminal based on these identifiers, thereby separating the unique monitoring data for each known asset. Secondly, a feature extraction module processes the monitoring data of each separated asset. This feature extraction module calculates and extracts key indicators such as CPU utilization, memory usage, and network inflow and outflow traffic for each monitoring time point, and organizes these values ​​in chronological order to form a feature dataset describing the asset's state changes. Next, through a graph update interface, the corresponding asset node is found in the constructed network security knowledge graph based on the asset identifier. Then, the generated feature dataset is appended to the attribute information of the asset node as a dynamic data block called state attribute. In this way, the static asset node in the network security knowledge graph has dynamic attributes reflecting its real-time operating status.

[0127] Meanwhile, in another processing flow, a log parsing engine decodes the acquired security log data. This engine can understand the various log formats generated by different security platforms and extract information such as the operation type (login attempt or port scan), the source IP address of the attack, the destination IP address of the attacked entity, the timestamp of the event, and whether the operation was allowed or blocked. Then, a rule matching engine compares the parsed operation type with a predefined attack pattern rule base. For example, if a log entry indicates multiple failed login attempts, and the rule base defines this pattern as corresponding to a brute-force attack, then the log entry will be mapped and classified as a brute-force attack—a standard security event type. Finally, a transaction aggregation algorithm scans all the classified logs. The system records multiple logs that, within a preset short time window, share the same source IP, destination IP, and belong to the same standard security event type, and merge them into a single security transaction. For example, merging 10 brute-force attack logs from the same IP targeting the same server within one minute into a single brute-force attack transaction represents a concentrated attack attempt by the attacker. Finally, using the knowledge graph's node creation function, a new security event node is created in the event sequence layer for each security transaction. This security event node records a summary of the transaction. Simultaneously, based on the source IP and destination IP of the transaction, the system searches for corresponding asset nodes in the topology layer and establishes a preliminary association between this new security event node and these two asset nodes, thereby anchoring dynamic security events onto the static network topology graph.

[0128] For example, following the specific implementation of the previous step, firstly, the collected CPU and memory data streams containing their IP addresses are automatically identified and categorized as monitoring data of asset terminal C; secondly, the average CPU utilization of terminal C over the past 5 minutes is calculated to be 15% and the memory utilization to be 40%, forming its feature dataset. This feature dataset is then used as a state attribute and bound to the asset node representing terminal C in the knowledge graph. Simultaneously, firewall D reports multiple logs of external IPs (let's say X) attempting SQL injection attacks on port 80 of server B and being blocked. The log parsing engine then extracts information such as the operation type being SQL injection attack, the source IP being X, and the destination IP being server B's IP. The rule engine then maps this to the standard event type SQL injection attack. Since these logs occurred intensively within 2 minutes, the aggregation algorithm merges them into a single SQL injection attack security transaction from IP X targeting server B. Finally, a new security event node is created at the event sequence layer of the knowledge graph to represent this transaction, and an attack-affected association edge is established between this security event node and the asset node server B. Furthermore, due to the IP... X is an external address, and there may not be a corresponding asset node for it in the graph.

[0129] This step efficiently converts dynamic performance data and security logs into real-time status attributes of asset nodes and standardized event nodes in the event sequence layer of the knowledge graph, and establishes a direct relationship between the two. This allows the originally independent device operating status and discrete security alarms to be integrated into interconnected and uniformly analyzable structured information in the knowledge graph, providing a direct and structured data foundation for subsequent association confidence calculation and unknown threat determination.

[0130] Step 104: Based on the association between the security event node and the asset node within a preset time range, generate an interaction edge connecting the security event node and the asset node in the network security knowledge graph, and generate a dynamic interaction subgraph.

[0131] Optionally, step 104 may specifically include:

[0132] Step 1041: Obtain the timestamp information of the security event nodes in the event sequence layer.

[0133] Step 1042: Filter out target security event nodes whose timestamps fall within a preset time range.

[0134] Step 1043: Identify the source asset identifier and target asset identifier corresponding to each target security event node.

[0135] Step 1044: Locate the target asset node corresponding to the source asset identifier and the target asset identifier in the topology layer.

[0136] Step 1045: Establish a bidirectional association edge between the target security event node and each target asset node.

[0137] Optionally, step 1045 may include the following steps: determining the interaction relationship type between the security event node and the asset node based on the event type of the target security event node and the asset type of the target asset node; creating a first directed edge from the target security event node to the target asset node according to the determined interaction relationship type, representing the impact of the attack on the asset; simultaneously creating a second directed edge from the same target asset node to the target security event node, representing the asset's response status to the attack; setting a relationship type attribute for the first directed edge to record attack tactics information; setting a status feedback attribute for the second directed edge to record changes in the asset's security status; and adding the first and second directed edges as a set of bidirectional related edges to the network security knowledge graph.

[0138] Step 1046: Generate a dynamic interactive subgraph based on all established bidirectional association edges and the target security event nodes and target asset nodes connected by the bidirectional association edges.

[0139] In this step, the dynamic interactive subgraph refers to a local graph structure dynamically extracted from the complete network security knowledge graph according to a preset time window. It is used to focus on analyzing the real-time interaction and impact relationship between security events and related network assets within a specific time period. It is obtained by performing time filtering, node location and bidirectional association edge generation operations.

[0140] Timestamp information refers to data recorded in the attributes of a security event node that identifies the exact time point when the event occurred, and is used to determine the chronological order and position of events on the timeline.

[0141] A preset time range refers to a time interval pre-defined by the analyst to limit the time span of security events that need to be included in the current analysis.

[0142] Source asset identifiers refer to information about network assets stored in the attributes of security event nodes that uniquely identify the initiator of an attack. They are usually source IP addresses and are used to locate the asset node corresponding to the source of the attack in the knowledge graph. They are obtained by parsing the attributes of the security event node.

[0143] Target asset identifier refers to information stored in the attributes of security event nodes that uniquely identifies the network asset of the party that suffered the attack. It is usually the destination IP address and is used to locate the asset node corresponding to the attacked target in the knowledge graph.

[0144] A bidirectional association edge refers to a set of two directed edges in a knowledge graph that connect a security event node and an asset node, with opposite directions and complementary semantics, used to jointly characterize the complete relationship between the interaction between security events and assets.

[0145] Interaction type refers to a category used to describe the specific impact of a security incident on an asset, such as vulnerability exploitation or data breach.

[0146] The first directed edge refers to a unidirectional edge in a bidirectional association edge that points from a security event node to an asset node, used to represent the direction in which an attack affects an asset.

[0147] The second directed edge refers to a unidirectional edge in a bidirectional association edge that points from an asset node to a security event node, used to represent the direction of state feedback generated by an asset in response to an attack.

[0148] The relation type attribute is a descriptive field attached to the first directed edge, used to record detailed information such as the specific tactics, techniques and processes used in this attack. It is assigned by setting the attribute value when the edge is created in the graph.

[0149] The status feedback attribute is a descriptive field attached to the second directed edge, used to record information about changes in the security or operational status of the asset after the attack. It is assigned by setting the attribute value when the edge is created in the graph.

[0150] In this step, firstly, a graph query interface is used to read the timestamp information carried by all security event nodes in the event sequence layer; secondly, a time filtering algorithm is used to compare the timestamp of each security event node with a preset time range, filtering out all security event nodes whose timestamps fall within this range and marking them as target security event nodes; next, an attribute reading module is used to extract two key fields from the attributes of each target security event node, namely the source asset identifier representing the source of the attack and the target asset identifier representing the target of the attack; then, a graph node search function is used to search in the topology layer using the extracted source asset identifier and target asset identifier to locate two asset nodes that completely match them and identify them as target asset nodes.

[0151] Then, through a relationship creation and edge attribute setting module, each target security event node is processed sequentially. This edge attribute setting module first queries a predefined rule mapping table based on the event type represented by the current target security event node, such as brute-force attack or malware communication, and the device type of the target asset node it connects to, such as database server or web server, to determine the specific interaction relationship type between them, such as attempting to brute-force the database. Subsequently, the edge attribute setting module creates a directed edge from the security event node to the target asset node, which is the first directed edge, and sets an attribute called "relationship type" for this edge, the value of which is the previously determined interaction relationship type, used to describe the specific attack tactics. At the same time, the edge attribute setting module creates a directed edge from the same target asset node back to the security event node, which is the second directed edge, and sets an attribute called "state feedback" for this edge, the initial value of which can be empty, waiting to be filled with the actual state changes of the asset later. This pair of directed edges in opposite directions constitutes a complete set of bidirectional related edges, which are added to the network security knowledge graph at the same time.

[0152] Finally, after adding bidirectional edges between all selected target security event nodes and their corresponding target asset nodes within the target time period, a subgraph extraction algorithm is used to extract an independent, tightly connected small graph structure from the massive full knowledge graph using all these newly added bidirectional edges and all the target security event nodes and target asset nodes they connect as elements. This small graph structure is the dynamic interaction subgraph, which centrally depicts the interaction between all security events and their related assets that occur within the preset time period.

[0153] For example, following the specific implementation of the previous step, firstly, assuming the current analysis time range is set to the most recent 5 minutes, we check the timestamps of all security event nodes in the event sequence layer. We find that the timestamp of the security event node representing the SQL injection attack is within this 5-minute period, thus identifying it as the target security event node. Next, we read the attributes of this target security event node to obtain its source IP (external IP X) and the target IP (server B's IP). Then, in the topology layer, based on the target IP, we locate the target asset node, server B. Because of the external IP... X is not in the internal asset database, so it may only be located at server B. Then, the connection edges are established. Based on the event type SQL injection attack and the asset type Web server, the interaction relationship type is determined to be attempted Web application injection. A directed edge is created from the SQL injection attack event node to the server B asset node, and its relationship type attribute is set to attempted Web application injection. At the same time, a directed edge is created from the server B asset node back to the SQL injection attack event node, and its status feedback attribute is to be filled. Finally, this new event node, the server B asset node, and the pair of bidirectional edges between them are extracted from the entire large graph to form a dynamic interaction subgraph that only contains these elements and focuses on the attack dynamics of the last 5 minutes.

[0154] This step extracts an interaction subgraph from the global knowledge graph, focusing on security events and related assets within a specific time period, through time-based filtering and dynamic association. This subgraph, using bidirectional association edges, not only depicts the direction of the impact of attack behavior on assets but also provides a structure for recording asset status feedback. This effectively constructs an association model between events and assets with temporal context and causal orientation, providing a direct and rich structured relationship foundation for the next step of quantitatively analyzing the confidence level of the association between the two.

[0155] Step 105: Perform graph reasoning based on the dynamic interaction subgraph, calculate the association confidence between the state attribute and the security event node, and determine that there is abnormal behavior when the association confidence is lower than the preset confidence threshold.

[0156] Optionally, step 105 may specifically include:

[0157] Step 1051: Traverse each asset node in the dynamic interaction subgraph and obtain the state attributes of each asset node.

[0158] Step 1052: Identify all target security event nodes connected to the corresponding asset nodes via bidirectional association edges.

[0159] Step 1053: Calculate the matching degree between the state attribute and the event characteristics of each connected target security event node to obtain multiple initial matching values.

[0160] Step 1054: Aggregate the initial matching values ​​corresponding to each asset node to generate the comprehensive matching degree corresponding to each asset node.

[0161] Step 1055: Compare the overall matching degree of each asset node with a preset confidence threshold. When the overall matching degree is lower than the preset confidence threshold, mark the asset node as having abnormal behavior.

[0162] In this step, the association confidence score is a numerical indicator used to quantify the logical consistency and causal support between the real-time operating status of an asset node and the activities represented by its associated security event node within a specific time period. It is used to assess whether the security event may be a reasonable cause of the change in the asset's status. It is obtained by calculating the matching degree between the status attributes and event characteristics and performing aggregation processing.

[0163] The preset confidence threshold refers to a numerical threshold set in advance by security experts, which serves as a dividing line for judging whether the confidence of the association is high enough. When the calculated overall matching degree is lower than this threshold, an anomaly judgment is triggered.

[0164] The initial matching value refers to the intermediate values ​​obtained by comparing the state attributes of a single asset node with the event characteristics of its associated single target security event node one by one, which reflect the degree of matching between the two in a single dimension.

[0165] The overall matching degree refers to the final single numerical result obtained after processing all the initial matching values ​​corresponding to an asset node through a specific mathematical aggregation method. It is used to represent the overall matching level between the asset status and all its associated security events.

[0166] In this step, a graph traversal algorithm is first used to visit each asset node sequentially, starting from the first asset node in the dynamic interaction subgraph. When visiting each asset node, the state attributes bound to that node are read and obtained. These attributes contain a sequence of performance data such as CPU utilization and memory usage of the asset node in the recent period. Secondly, by querying the edge connections in the graph, all security event nodes connected to the currently being processed asset node through bidirectional edges are identified. These security event nodes are marked as target security event nodes.

[0167] Next, a matching degree calculation function compares the status attribute data of the current asset node with the event characteristics of each connected target security event node. For example, if the security event is a brute-force login, and the asset status shows that its CPU and memory usage spiked abnormally when the event occurred, the calculated matching value may be high; if the status shows no change, the matching value will be low. This calculation process generates an initial matching value for the current asset node and each security event node it is associated with. Then, an aggregation function, such as averaging or weighted averaging, processes all the initial matching values ​​corresponding to the current asset node, merging these multiple values ​​into a single value that can comprehensively reflect the overall matching degree. This value is the overall matching degree of the asset node.

[0168] Finally, through a comparison logic, the overall matching degree of each asset node is calculated and compared with a pre-set confidence threshold. If the overall matching degree of an asset node is lower than the pre-set confidence threshold, it means that there is no reasonable and expected correlation between its current state change and the security attack event it has suffered. In this case, the asset node will be judged to have abnormal behavior and will be marked.

[0169] For example, following the specific implementation of the previous step, firstly, in the dynamic interaction subgraph containing the server B asset node and the SQL injection attack security event node, the server B node is traversed, and its state attribute is obtained, namely, the data showing that the CPU utilization rate has suddenly increased from 5% to 80% in the last 5 minutes; secondly, the unique target security event node connected to server B through a bidirectional association edge is identified, namely the SQL injection attack node; then, the state feature of the sudden increase in server B's CPU utilization rate is compared with the features of the SQL injection attack event to calculate the matching degree. Since the two are logically highly correlated, this calculation may produce a... A high initial matching value is used; subsequently, since server B is only associated with one security event in this dynamic interaction subgraph, its overall matching degree is equal to this initial matching value; finally, this overall matching degree is compared with a preset confidence threshold. If the calculated matching degree is very high, exceeding the threshold, it is considered that this SQL injection attack is likely a reasonable cause of the CPU spike and belongs to the expected association; if the matching degree is abnormally low, such as when the CPU does not change during the attack event and the overall matching degree is below the threshold, it will be determined that server B's behavior in this attack is abnormal and does not meet expectations, thus marking it as having abnormal behavior.

[0170] This step transforms the qualitative description of the relationship between asset status and security events into a quantifiable confidence index by performing reasoning calculations on the dynamic interactive subgraph. By calculating and comparing the comprehensive matching degree, it can effectively identify abnormal situations where the status changes are clearly inconsistent with the security events suffered and lack logical rationality. This enables a refined assessment of the actual impact of security events and the actual response of assets, providing a key quantitative basis for accurately locating truly suspicious and abnormal behaviors that deviate from normal attack paradigms from massive alarms.

[0171] Step 106: Determine the unknown threat based on the difference between the abnormal behavior and the known threat pattern.

[0172] Optionally, step 106 may specifically include:

[0173] Step 1061: Extract the state attribute change features of asset nodes marked as having abnormal behavior.

[0174] Step 1062: Obtain the event sequence characteristics of all target security event nodes associated with the asset node exhibiting abnormal behavior during the abnormal time period.

[0175] Step 1063: Combine the state attribute change features with the event sequence features to form an abnormal behavior feature vector.

[0176] Step 1064: Compare the similarity between the abnormal behavior feature vector and the threat feature vector in the known threat pattern library, and calculate the difference between the abnormal behavior feature vector and each known threat feature vector.

[0177] Step 1065: When all differences are greater than the preset difference threshold, determine that the current abnormal behavior feature vector corresponds to an unknown threat and trigger the self-learning module to update the knowledge graph.

[0178] In this step, the known threat pattern library refers to a pre-built and continuously maintained dataset containing various identified attack behavior characteristics. It serves as a benchmark for determining whether newly emerging abnormal behaviors belong to known threats. It is built and updated by integrating publicly available threat knowledge frameworks such as MITRE ATT&CK and internal historical attack data.

[0179] Unknown threats refer to malicious attacks or anomalous activities that appear for the first time in the target network environment and whose behavioral characteristics are significantly different from any record in the known threat pattern library. They are used to refer to new security risks that are not covered by existing rule and feature libraries.

[0180] State attribute change characteristics refer to key indicators that are representative and reflect abnormal state change patterns extracted from the historical state attribute data of asset nodes marked as having abnormal behavior. They are used to quantitatively describe the specific manifestations of the asset's operating state deviating from the normal pattern during abnormal time periods.

[0181] Event sequence features refer to the structured descriptions of information such as event type, occurrence order, time interval, and attack path extracted from all target security event nodes associated with the abnormal asset node. They are used to characterize the overall behavioral pattern of a series of security events acting on the asset within an abnormal time period.

[0182] An abnormal behavior feature vector is a multidimensional mathematical vector formed by combining state attribute change features and event sequence features through specific rules. It is used to represent a complete abnormal behavior in a holistic and unique way from both state and event dimensions.

[0183] Threat feature vectors are multi-dimensional mathematical vectors formed after standardization for each known threat record in a known threat pattern library. They are used to characterize the features of a known attack pattern in mathematical space.

[0184] The difference degree refers to a numerical value calculated by a specific similarity comparison algorithm, which is used to quantify the degree of dissimilarity between an abnormal behavior feature vector and a known threat feature vector, and is used to measure the size of the gap between the two.

[0185] The preset difference threshold refers to a numerical threshold set by the system in advance, which is used as a dividing line to judge whether the difference is large enough. When the difference between the abnormal behavior feature vector and all known threat feature vectors is greater than this threshold, it is determined to be an unknown threat.

[0186] In this step, a feature extraction module first reads the complete historical data of the state attributes of the asset node marked as having abnormal behavior before and after the abnormal time period. The feature extraction module analyzes this time series data to calculate key features that can represent its abnormal change pattern, such as the specific pattern of CPU utilization suddenly soaring from a low level and oscillating at a high level in a short period of time, or the trend of abnormally increasing network outflow traffic. These calculation results are extracted as state attribute change features.

[0187] Secondly, by querying the graph relationships, we can obtain detailed information on all target security event nodes that are connected to the abnormal asset node through bidirectional association edges within the same abnormal time period. We can extract key information such as event type sequence, event time interval distribution, and attack path from these abnormal asset nodes and structure this information into event sequence features.

[0188] Next, a vector combiner is used to concatenate and combine the extracted state attribute change features and event sequence features according to a preset dimensional order to form a unified, high-dimensional mathematical vector. This vector is the abnormal behavior feature vector, which comprehensively encodes all the key information of this abnormal behavior on the state side and the event side.

[0189] Then, a similarity comparison algorithm, such as the cosine similarity algorithm, is used to compare the newly generated abnormal behavior feature vector with each known threat feature vector in the known threat pattern library one by one. Each comparison will calculate a specific difference value. This value quantifies the difference between the current abnormal behavior and a certain known threat pattern in the library. The larger the difference value, the less similar the two are.

[0190] Finally, a judgment logic compares all the calculated difference values ​​with a preset difference threshold. If the difference calculated between the current abnormal behavior feature vector and each known threat feature vector in the known threat pattern library is greater than the preset difference threshold, it means that this abnormal behavior is significantly different from all known threat patterns, and it will be determined to correspond to an unknown threat. Once determined to be an unknown threat, the self-learning module will be immediately triggered to add this new abnormal behavior feature vector and related graph context information as a new pattern example to the knowledge graph or update the feature library to enhance the ability to identify similar threats in the future.

[0191] For example, following the specific implementation of the previous step, server B is first marked as exhibiting abnormal behavior due to a low match between changes in CPU usage and an SQL injection attack. Next, the state attribute change features of server B during the abnormal time period are extracted, revealing that its CPU usage shows no significant change during the attack, but instead experiences a brief spike one minute after the attack ends. Then, the event sequence features associated with server B during this time period are obtained, indicating an SQL injection attack. These two features are then combined to form an abnormal behavior feature vector describing no CPU change during the SQL injection attack and a brief CPU spike one minute after the attack ends. This vector is then compared for similarity with all vectors in a known threat pattern library. For example, it shows a significant difference from pattern vectors indicating sustained high CPU load due to typical SQL injection, and also a large difference from pattern vectors indicating normal login behavior. The calculation results show that its difference from all known patterns in the library exceeds a preset difference threshold, thus determining that this abnormal behavior is an unknown threat. Finally, a self-learning mechanism is triggered to store this new behavioral pattern feature along with relevant contextual information to enrich future identification capabilities.

[0192] This step, by systematically comparing abnormal behavioral characteristics with known threat patterns, can accurately identify new threats that are significantly different from all known attacks, thereby achieving accurate judgment of unknown threats. This process not only effectively overcomes the problem of missed detection of new threats by traditional methods, but its triggered self-learning mechanism can also transform newly discovered threats into system knowledge, forming a closed loop from perception and judgment to self-enhancement, continuously improving the security system's proactive defense capability against unknown threats.

[0193] Figure 2 This application provides a schematic diagram of the structure of an intelligent unknown threat determination system based on multimodal knowledge graphs, such as... Figure 2 As shown, the system includes:

[0194] Module 21 is used to acquire system performance time-series data generated by network devices, servers and terminal devices, as well as security log data generated by the security platform;

[0195] Module 22 is used to construct a cybersecurity knowledge graph, which includes a topology layer and an event sequence layer.

[0196] The conversion module 23 is used to convert the system performance time-series data into the state attributes of asset nodes in the topology layer, and to convert the security log data into security event nodes in the event sequence layer.

[0197] The generation module 24 is used to generate an interaction edge connecting the security event node and the asset node in the network security knowledge graph based on the association between the security event node and the asset node within a preset time range, and to generate a dynamic interaction subgraph.

[0198] The calculation module 25 is used to perform graph reasoning based on the dynamic interaction subgraph, calculate the association confidence between the state attribute and the security event node, and determine that there is abnormal behavior when the association confidence is lower than a preset confidence threshold.

[0199] The determination module 26 is used to determine the unknown threat based on the difference between the abnormal behavior and the known threat pattern.

[0200] Figure 2 The aforementioned intelligent unknown threat determination system based on multimodal knowledge graph can perform... Figure 1 The implementation principle and technical effects of the intelligent unknown threat determination method based on multimodal knowledge graphs described in the illustrated embodiment will not be repeated here. The specific methods by which each module and unit performs operations in the intelligent unknown threat determination system based on multimodal knowledge graphs in the above embodiments have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0201] In one possible design, Figure 2 The illustrated embodiment of an intelligent unknown threat determination system based on a multimodal knowledge graph can be implemented as a computing device, such as... Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0202] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are invoked and executed by the processing component 32.

[0203] The processing component 32 is used for the above Figure 1 The embodiment describes an intelligent method for determining unknown threats based on a multimodal knowledge graph.

[0204] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for intelligently identifying unknown threats based on multimodal knowledge graphs, characterized in that, include: Acquire system performance time-series data generated by network devices, servers, and terminal devices, as well as security log data generated by the security platform; Construct a cybersecurity knowledge graph, which includes a topology layer and an event sequence layer; The system performance time-series data is converted into the state attributes of asset nodes in the topology layer, and the security log data is converted into security event nodes in the event sequence layer. Based on the association between the security event node and the asset node within a preset time range, an interaction edge connecting the security event node and the asset node is generated in the network security knowledge graph, thus generating a dynamic interaction subgraph. Graph reasoning is performed based on the dynamic interactive subgraph to calculate the association confidence between the state attribute and the security event node. When the association confidence is lower than a preset confidence threshold, it is determined that there is abnormal behavior. Unknown threats are identified based on the differences between the described abnormal behavior and known threat patterns.

2. The method according to claim 1, characterized in that, Constructing a cybersecurity knowledge graph, which includes a topology layer and an event sequence layer, including: Extract the physical connection relationships, logical access relationships, and data flow relationships between assets from the pre-stored network architecture configuration file; An asset relationship database is constructed based on the physical connection relationship, logical access relationship and data flow relationship, and each asset in the asset relationship database is defined as a node, and the connection or access path between assets is defined as an edge to form a topology layer. Define the correspondence between security event types and attack behaviors from the pre-stored threat intelligence database and protocol specifications, construct a security event database based on the correspondence, and define each security event record in the security event database as a security event node to form an event sequence layer; Establish a mapping relationship between asset nodes in the asset relationship database and security event nodes in the security event database; Based on the mapping relationship, the topology layer is associated with the event sequence layer to generate a network security knowledge graph.

3. The method according to claim 1, characterized in that, The system performance time-series data is converted into the state attributes of asset nodes in the topology layer, and the security log data is converted into security event nodes in the event sequence layer, including: Monitoring data corresponding to each asset is separated from the system performance data stream based on the asset identifier, which includes an IP address and a MAC address; Extract CPU utilization, memory usage, and network traffic features from monitoring data to form a feature dataset; The feature dataset is bound to the asset node corresponding to the asset identifier in the topology layer, serving as the state attribute of the asset node; Parse the security log data generated by the security platform to obtain information such as operation type, source IP, destination IP, timestamp, and operation result; Based on predefined attack pattern rules, the operation type is mapped to the standard security event type; Multiple log records with the same source IP, destination IP, and standard security event type, and within a preset time period, are merged into a single security transaction. The security transaction is created as a security event node in the event sequence layer, and the security event node is associated with the asset node corresponding to the source IP and the destination IP.

4. The method according to claim 1, characterized in that, Based on the association between the security event node and the asset node within a preset time range, an interaction edge connecting the security event node and the asset node is generated in the network security knowledge graph, generating a dynamic interaction subgraph, including: Obtain the timestamp information of security event nodes in the event sequence layer; Filter out target security event nodes whose timestamps fall within a preset time range; Identify the source asset identifier and target asset identifier corresponding to each target security event node; Locate the target asset node corresponding to the source asset identifier and the target asset identifier in the topology layer; Establish a bidirectional association edge between the target security event node and each target asset node; Based on all established bidirectional edges and the target security event nodes and target asset nodes connected by the bidirectional edges, a dynamic interactive subgraph is generated.

5. The method according to claim 4, characterized in that, Establish a bidirectional association edge between the target security event node and each target asset node, including: Based on the event type of the target security event node and the asset type of the target asset node, determine the interaction relationship type between the security event node and the asset node; Based on the determined interaction relationship type, create the first directed edge from the target security event node to the target asset node, representing the impact of the attack on the asset; At the same time, a second directed edge is created from the same target asset node to the target security event node, representing the asset's response status to the attack. Set a relation type attribute for the first directed edge to record attack tactics information; Set a state feedback attribute for the second directed edge to record changes in the security status of the asset; Add the first directed edge and the second directed edge as a pair of bidirectional related edges to the cybersecurity knowledge graph.

6. The method according to claim 1, characterized in that, Based on the dynamic interaction subgraph, graph reasoning is performed to calculate the association confidence between the state attribute and the security event node. When the association confidence is lower than a preset confidence threshold, abnormal behavior is determined to exist, including: Iterate through each asset node in the dynamic interaction subgraph and obtain the state attributes of each asset node; Identify all target security event nodes connected to their corresponding asset nodes via bidirectional association edges; The matching degree between the state attributes and the event characteristics of each connected target security event node is calculated to obtain multiple initial matching values; The initial matching values ​​for each asset node are aggregated to generate a comprehensive matching degree for each asset node. The overall matching degree of each asset node is compared with a preset confidence threshold. When the overall matching degree is lower than the preset confidence threshold, the asset node is marked as having abnormal behavior.

7. The method according to claim 1, characterized in that, Based on the differences between the anomalous behavior and known threat patterns, unknown threats are identified, including: Extract the state attribute change features of asset nodes marked as exhibiting abnormal behavior; Obtain the event sequence characteristics of all target security event nodes associated with the asset node exhibiting abnormal behavior within the abnormal time period; By combining state attribute change features with event sequence features, an abnormal behavior feature vector is formed; The similarity between the abnormal behavior feature vector and the threat feature vector in the known threat pattern library is compared, and the difference between the abnormal behavior feature vector and each known threat feature vector is calculated. When all differences exceed the preset difference threshold, the current abnormal behavior feature vector is determined to correspond to an unknown threat, and the self-learning module is triggered to update the knowledge graph.

8. A system for intelligently identifying unknown threats based on multimodal knowledge graphs, characterized in that, include: The acquisition module is used to acquire system performance time-series data generated by network devices, servers and terminal devices, as well as security log data generated by the security platform. The construction module is used to build a cybersecurity knowledge graph, which includes a topology layer and an event sequence layer. The conversion module is used to convert the system performance time-series data into the state attributes of asset nodes in the topology layer, and to convert the security log data into security event nodes in the event sequence layer. The generation module is used to generate interactive edges connecting the security event nodes and the asset nodes in the network security knowledge graph based on the association between the security event nodes and the asset nodes within a preset time range, and to generate a dynamic interactive subgraph. The calculation module is used to perform graph reasoning based on the dynamic interaction subgraph, calculate the association confidence between the state attribute and the security event node, and determine that there is abnormal behavior when the association confidence is lower than a preset confidence threshold. The determination module is used to determine unknown threats based on the differences between the abnormal behavior and known threat patterns.

9. A computing device, characterized in that, It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement the intelligent determination method for unknown threats based on a multimodal knowledge graph as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that, The device contains a computer program that, when executed by a computer, implements a method for intelligently determining unknown threats based on a multimodal knowledge graph as described in any one of claims 1 to 7.

Images