Network security domain knowledge graph construction method, system and device, processor and computer readable storage medium thereof

Abstract

The invention relates to a network security domain knowledge graph construction method. The method comprises the steps of (1) performing named entity extraction for a network security domain based on multi-model cooperative verification, and training a lightweight model; (2) segmenting a long text based on an entity perception multi-dimensional scoring dynamic sliding window; (3) performing named entity and relation extraction and lightweight entity relation identification model construction based on multi-model collaborative network security; and (4) based on the extracted and disambiguated entities and relationships, designing a knowledge graph mode to construct a network security knowledge graph. The invention also relates to a corresponding system, device, processor and computer readable storage medium. By adopting the network security domain knowledge graph construction method, system and device, the processor and the computer readable storage medium, the computing power demand of a large model during element extraction is effectively reduced, and the accuracy and recognition types of network security entities and relationships thereof when the large model processes a long text are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method, system, device, processor, and computer-readable storage medium for constructing a knowledge graph in the field of network security. Background Technology

[0002] Knowledge graphs in the cybersecurity field are a crucial foundation for security threat early warning, analysis, response, and tracing. They also serve as a fundamental vehicle for deep intelligent analysis such as organizational analysis and relationship analysis, and have wide applications in aviation, insurance, education, and industry. Traditional methods for constructing cybersecurity knowledge graphs can be categorized into the following four types: Large-model-based methods utilize large language models (LLMs) to construct knowledge graphs. By leveraging the few-shot learning capabilities of GPT, data annotation and augmentation are achieved, generating datasets for fine-tuning smaller language models (7B). This method performs topic classification on collected reports, extracts entities and relationships, and extracts tactics, techniques, and procedures (TTPs) from attack descriptions, ultimately constructing a threat intelligence knowledge graph. Its advantages lie in the high accuracy of named entity recognition and TTP classification, enabling automated analysis of textual threat intelligence. However, this method suffers from drawbacks such as high costs associated with manually constructing datasets, high model parameter requirements, and poor performance in handling long texts.

[0003] Transformer-based methods. These methods construct a dedicated transformer model, such as SecureBERT (a Transformer model optimized for cybersecurity) or a framework based on attention-based Bidirectional Long Short-Term Memory (BiLSTM) networks. By combining domain ontology and inference models, they improve the accuracy of entity and relation extraction. This approach excels in handling the complex language and diverse threat terminology of the cybersecurity domain, effectively reducing error propagation and improving extraction accuracy. However, it relies on domain ontology and pre-trained models, potentially requiring significant domain expertise and data for optimization, and may need model readjustment when facing new threat types or terminology.

[0004] This approach is based on traditional natural language processing and machine learning methods. These methods break down the knowledge graph construction process into sub-tasks, and then build dedicated small models for each sub-task, such as building named entity recognition and relation extraction models for entity and relation recognition. These methods place high demands on the performance of the natural language processing module, especially when handling special characters and complex structures in security contexts, and require a large amount of labeled data for training. They may also need to be readjusted to new report formats.

[0005] In summary, although existing open-source methods for constructing cybersecurity threat knowledge graphs have made some progress in entity and relation extraction and knowledge integration, they still have shortcomings. Most methods rely on large amounts of labeled data for training, and obtaining high-quality labeled data requires significant human and time resources; many methods require domain experts to design the ontology and optimize the model, making it difficult to quickly adapt to new threat types or terms; methods based on large language models may suffer from high computational resource consumption, randomness, and illusions, affecting the accuracy and reliability of the knowledge graph; existing methods cannot analyze and process long cybersecurity texts, and the use of fixed-length text segmentation methods carries the risk of interrupting related paragraphs, reducing the accuracy of extraction. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, system, device, processor, and computer-readable storage medium for constructing a knowledge graph in the field of network security with high precision, low computing power, and support for long text processing.

[0007] To achieve the above objectives, the present invention provides a method, system, apparatus, processor, and computer-readable storage medium for constructing a knowledge graph in the field of cybersecurity, as follows: The main feature of this knowledge graph construction method in the field of cybersecurity is that the method includes the following steps: (1) Based on multi-model collaborative verification, name entity extraction is performed in the network security field and a lightweight extraction model is constructed: the original dataset of network security name entities is constructed, and the original dataset of network security name entities is extracted based on the network security entity extraction model to obtain name entities in the network security field. The network security name entities are then collaboratively verified and corrected to generate high-quality entity extraction results. At the same time, the network security entity extraction model is fine-tuned and name entity disambiguation is performed. (2) Long text segmentation based on entity perception multidimensional scoring dynamic sliding window: The long text in the network security field is segmented based on the high-quality entity extraction results extracted by the network security entity extraction model, and a multidimensional scoring function is designed to intelligently block the segmentation results to ensure semantic integrity. (3) Entity anchoring-based constraint relationship extraction and lightweight entity relationship model construction: The entity-first anchoring mechanism is adopted, and the network security entity extraction model is used to extract standard entities as anchor points for entity relationship extraction. Entity relationship extraction and verification are performed based on the entity relationship type constraint matrix. (4) Knowledge graph construction: Based on the extracted and disambiguated named entities and relationships, a knowledge graph pattern is designed to construct a network security knowledge graph.

[0008] Preferably, step (1) includes: (1.1) Constructing the original dataset of network security named entities: Collect long texts related to network security, perform document segmentation and segmentation, merge them, and deduplicate data with high similarity to obtain the original dataset of network security named entities; (1.2) The network security entity extraction model uses the first major language model combined with the constructed background-target-notes-example prompting project to extract named entities from the original network security named entity dataset, and uses the second major language model to perform collaborative verification and correction on the extracted named entities to generate high-quality entity extraction results. (1.3) Use the named entity extraction base model to fine-tune the parameters of the verified and corrected named entities to form an entity extraction model; (1.4) Based on the entity extraction model described above, the extracted long text named entities are disambiguated to unify the same entity in different paragraphs.

[0009] Preferably, step (1.2) specifically includes: The first language model is used for initial named entity extraction. The output and prompt words are submitted to the second language model for confirmation and correction. If there is an error, the output is corrected and the corrected information is input back into the first language model for final confirmation; otherwise, the error is directly output.

[0010] Preferably, step (1.3) specifically includes: The LoRA model was used to fine-tune the parameters of the high-quality named entity dataset. The named entity extraction base model used was Qianwen 3-1.7B, and its parameter settings included: learning rate 5e-4, batch size of 2, LoRA rank of 32, LoRA scaling factor of 64, and training epochs of 2.

[0011] Preferably, step (2) includes: (2.1) Given a network security long text document, use the dynamic sliding window method to segment the long text of the document based on the obtained named entity extraction results, wherein the document contains paragraph And the full-text entity generated after entity extraction in step (1). There are a total of k entities; (2.2) Set the semantic input and output specifications as follows: Set input paragraph list Paragraph-Entity Matrix ,in Paragraph Contains entities , For real numbers, the global entity list There are a total of k global entities, and a length constraint. ; According to the above specifications, the output of the network security long text document is segmented into blocks. There are a total of m blocks, among which... , This is a list of paragraph indices, containing 1 item. (2.3) Based on entity coverage, entity coherence, semantic similarity, threat continuity, and length constraints, a multi-dimensional scoring function is designed for intelligent block processing. Its expression is: ; in, For entity coverage, For entity continuity, For semantic similarity, To threaten continuity, This is a length penalty function; It is a multi-dimensional scoring function; All weights satisfy .

[0012] Preferably, the entity coverage is determined according to the ratio of the entity set contained in each block to the total entity set in the long text document for network security, specifically: ; in, For block The collection of entities contained therein A collection of all entities in a long text document related to network security; The entity coherence mentioned above is determined by calculating the average entity similarity of all paragraphs within each block, specifically as follows: ; ; in, For the first Each block, For the first One paragraph, For the first One paragraph, For the first Group entities, For the first Group entities, For the weight function, For entities; The semantic similarity mentioned above uses TF-IDF vectors to calculate the degree of semantic association between paragraphs, specifically: ; in, For activation function, It is term frequency - inverse document frequency; The threat continuity mentioned above is used to assess the temporal integrity of threat events within a chunk, specifically: ; in, For block The set of threat entities included. As a threatening entity The sequence of paragraphs appearing in the document. For paragraph and The positional interval between them; The length penalty function is used to ensure that each block meets the length constraint, and it is represented by a piecewise function: ; This completes the construction of the aforementioned multi-dimensional scoring function.

[0013] Preferably, step (3) includes: (3.1) Entity anchoring stage: For the text blocks after intelligent segmentation, the network security entity extraction model is used to extract entities and generate a standard entity list; a globally unique identifier Entity_ID is assigned to each extracted entity, and an entity ID mapping table is constructed to record the text position, type, attributes and segmentation information of the entity; (3.2) Construction of Entity Relationship Type Constraint Matrix: Based on cybersecurity domain knowledge and threat intelligence standards, construct the entity relationship type constraint matrix. ,in, The number of header entity types, For the number of relation types, Number of tail entity types; matrix elements The type is Head entities can be defined by relation types. Connected to type The tail entity; This indicates that the triple is semantically invalid; (3.3) Relationship extraction based on anchored entities: Construct a relationship extraction prompt project based on entity anchoring, the input of which includes: original text block content, anchored entity list and entity relationship type constraints; Relation extraction is performed using the first major language model described above; The output of the first language model and the anchored entity list are submitted to the second language model for collaborative verification. If the second language model finds an error, it outputs the corrected relation triples and feeds the correction information back to the first language model for final confirmation. (3.4) Perform type consistency verification on all extracted relation triples: If the entity relationship type constraint matrix is ​​queried in step (3.2) and the value is 0, it is determined to be an illegal relationship, triggering the conflict resolution process, and performing type correction, direction correction or relationship downgrading on the entity relationship type constraint matrix. (3.5) Based on the relation triplets after the large model collaborative verification and constraint verification in steps (3.3) and (3.4), construct a network security entity relation training dataset, and perform manual verification, entity type enhancement, parameter fine-tuning and multi-task joint training on it to complete the training of the lightweight entity relation extraction model; (3.6) Use the fine-tuned entity relation extraction model to extract relations for all blocks of the long text, and perform global disambiguation on the extracted relations; (3.7) Output the final set of entity relation triples after deduplication, disambiguation and verification, as input for knowledge graph construction.

[0014] Preferably, the entity disambiguation in steps (1) and (3) adopts different strategies for different types of entities, including: prioritizing number matching for vulnerable entities, and calculating name semantic similarity when there is no number; calculating name semantic similarity for malware, organizations, and hacker entities; and performing accurate matching after normalizing IP addresses and domain names.

[0015] Preferably, step (4) specifically includes: (4.1) Based on the extracted results of named entities and entity relationships, design a knowledge graph pattern for the cybersecurity field, including entity types and relationship types, and define a corresponding attribute set for each type of entity; (4.2) Convert the entity and entity relationship data after disambiguation processing of the named entity and entity relationship extraction model into a standard format suitable for graph databases, including: Entity unique identifiers are assigned to ensure that nodes in the graph are not duplicated; Relational data normalization processing includes determining the starting node, target node, and relation type of a relation; Unified conversion of attribute data types; and Data cleaning, handling special characters and missing values; (4.3) Design a three-level import strategy: a basic data batch import mechanism for initial large-scale data processing; an incremental data import mechanism for periodic data updates; and a real-time data import interface for emergency threat intelligence integration. (4.4) Design a dedicated indexing strategy for the network security knowledge graph: including entity uniqueness constraint design, key attribute index design, relation attribute index design, and composite index design; (4.5) Establish a quality assessment system for network security knowledge graphs, including: data integrity assessment methods, relationship consistency verification mechanisms, statistical analysis of knowledge graph size and density, and critical path verification mechanisms; (4.6) Design a hierarchical knowledge graph application interface, including a basic query interface, a security analysis interface, a knowledge reasoning interface, and a graph maintenance interface; (4.7) Establish a continuous update mechanism for the cybersecurity knowledge graph, including incremental data collection strategies, automated entity relationship extraction processes, entity alignment and knowledge fusion algorithms, conflict detection and resolution strategies, and graph version management mechanisms, so as to form the final cybersecurity knowledge graph.

[0016] This knowledge graph construction system in the field of cybersecurity is used to implement the methods described above, and its main features include: The named entity extraction module is used to perform named entity extraction based on multi-model collaborative verification and lightweight model training; The long text processing module is used to perform long text segmentation based on a dynamic sliding window; The entity relationship extraction module is used to perform entity relationship extraction based on multi-model collaborative verification and lightweight model training; The entity disambiguation module is used to disambiguate entities and relationships extracted from long texts. The knowledge graph construction module is used for knowledge graph schema design, data preprocessing, data import, index construction, and knowledge graph generation.

[0017] The main feature of this knowledge graph construction device in the field of cybersecurity is that the device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the network security knowledge graph construction method described above.

[0018] The main feature of this network security knowledge graph construction processor is that the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the steps of the network security knowledge graph construction method described above are implemented.

[0019] The main feature of this computer-readable storage medium is that it stores a computer program that can be executed by a processor to implement the steps of the above-described method for constructing a knowledge graph in the field of network security.

[0020] The knowledge graph construction method, system, device, processor, and computer-readable storage medium of this invention in the field of cybersecurity achieve a significant improvement in end-to-end processing efficiency, with a very high degree of automation throughout the entire process from raw text to structured knowledge. This method can handle a large number of entity nodes and relational edges, supporting the processing of large batches of newly added security intelligence documents. Processing performance is linearly related to resource investment, supporting horizontal scaling and thus avoiding performance bottlenecks. Attached Figure Description

[0021] Figure 1 This is a schematic diagram illustrating the construction of a network security named entity relationship extraction model in practical applications of the present invention.

[0022] Figure 2 This is a schematic diagram illustrating the construction of a network security named entity extraction model in practical applications of the present invention. Detailed Implementation

[0023] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.

[0024] Before describing the embodiments of the present invention in detail, it should be noted that, in the following, the terms “comprising,” “including,” or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0025] The following will further explain in detail the method for constructing a knowledge graph in the field of cybersecurity, with reference to specific embodiments. Specifically, the method includes: 1. Named entity extraction in the cybersecurity domain based on multi-model collaborative verification 1.1 Construction of the Original Dataset for Network Security Named Entities Articles and policy articles on cybersecurity are collected from the internet. These articles are then segmented into sections, which are then merged. The segmented text is divided into sections of 512-1024 characters to ensure that the amount of text information processed by the model is appropriate. Finally, based on SentenceBERT paragraph vector similarity comparison, duplicate data with high similarity are removed.

[0026] 1.2 Multi-model collaborative network security named entity extraction Construct a prompting project based on Background-Objective-Notes-Example. The Background section explains the task context of security element named entity extraction; the Objective section specifies the types and specific fields of the named entities to be extracted; and the Notes section outlines considerations for the model to ensure the extracted information is concise and accurate, facilitating subsequent entity disambiguation, such as identifying all specific entities and knowing their names or specific models. Avoid extracting general entities, such as "a university," "a researcher," "enterprise browser," or "FTP server." Treat complex hardware-software integrated systems, such as the Shanghai Metro system, as software systems. Name extraction needs to be concise, removing location and function information, and extracting only the name. Pay attention to distinguishing between software systems with geographical locations and the concept of geographical location itself.

[0027] The network security named entities extracted by this technical solution include vulnerabilities (including name, number, and affected system), malware (including name, family, and target), hackers and their organizations, non-hacker individuals (including name and organization) and non-hacker organizations, software and hardware, geographical location, and network identifiers.

[0028] All relevant models are output in standard JSON format, which facilitates subsequent parsing, disambiguation, and performance testing.

[0029] In practical applications, the first major language model uses the Qianwen 3-235B-A3B model for named entity extraction. The output content, along with prompts, is then submitted to the second major language model, the Deepseek-R1 model, for verification. If errors are found, the output content is corrected; otherwise, it is output as correct. The corrected information is then input back into the Qianwen 3-235B-A3B model for further verification, ensuring the high quality of the named entity extraction fine-tuning dataset.

[0030] 1.2 Construction of a Lightweight Named Entity Extraction Model This technical solution uses the Qianwen 3-1.7B model as the base model for named entity extraction. This model strikes a good balance between performance and parameter quantity, and can effectively extract named entities in the field of network security.

[0031] The LoRA fine-tuning method was used for parameter fine-tuning, with the following parameters: learning rate 5e-4, batch size set to 2, LoRA rank 32, LoRA scaling factor 64, and training epochs 2.

[0032] 1.3 Named Entity Disambiguation for Long Texts To support subsequent long text segmentation and knowledge graph construction, entities in a long text need to be extracted and disambiguated. The same entity appearing in different paragraphs is disambiguated and given the same name. Simultaneously, all entities in the text are renumbered. This patent employs different disambiguation methods for different entities. For vulnerabilities, number comparison is performed first; if no number exists, SentenceBert is used for name comparison. For malware, organizations, and hackers, SentenceBert is used to extract vectors for vector similarity comparison. For IP addresses, direct comparison is performed.

[0033] 2. Long text segmentation method based on dynamic sliding window This paper proposes an entity-driven semantic-aware segmentation mechanism. By constructing a paragraph-entity matrix to explicitly model the semantic skeleton of the text, an intelligent segmentation algorithm based on multi-dimensional scoring is proposed. This algorithm comprehensively considers dimensions such as entity coverage, entity coherence, semantic similarity, and threat continuity to achieve optimal segmentation of long texts related to cybersecurity. The algorithm dynamically evaluates the optimal sub-block combination within a controllable window, significantly reducing computational complexity and improving processing efficiency, making it suitable for rapid segmentation of long documents. Simultaneously, a multi-objective fusion scoring function is designed. By adjusting the upper and lower limits of the text character count, semantic density and entity dispersion are effectively controlled, providing a balanced information input foundation for subsequent tasks such as multi-block summarization. This maintains semantic integrity while avoiding semantic shift caused by the repetition of high-frequency entities.

[0034] 3. Extraction of constraint relationships based on entity anchoring 3.1 Entity Anchoring Stage: Standard Entity Extraction and ID Mapping For the text blocks after intelligent segmentation, the aforementioned network security entity extraction model is used to extract entities and generate a standard entity list; Assign a globally unique identifier (Entity_ID) to each extracted entity and build an entity ID mapping table to record the entity's text location, type, attributes, and block information; The entity anchoring mechanism ensures the consistency of entity boundaries during subsequent relationship extraction, avoiding inconsistencies in the boundaries of extraction results from different models.

[0035] 3.2 Construction of Entity Relationship Type Constraint Matrix Based on cybersecurity knowledge and threat intelligence standards, an entity relationship type constraint matrix is ​​constructed. ,in, The number of header entity types, For the number of relation types, Number of tail entity types; matrix elements The type is Head entities can be defined by relation types. Connected to type The tail entity; This indicates that the triple is semantically invalid; Constraint rules include, but are not limited to: Vulnerable entities can only be connected to software / hardware entities through "impact" relationships, and cannot be connected to organizational entities through "attack" relationships; Malware entities can connect to organizational / individual entities through "attack" relationships; Hackers / hacking groups can connect malware entities through "use" relationships; Hacker groups can connect geographically located entities through "attribution" relationships; The vulnerability allows for the connection of malware entities through "exploitation" relationships; The constraint matrix serves as a knowledge rule base for relation verification, ensuring that the extracted relation triples conform to the semantic specifications of the cybersecurity field.

[0036] 3.3 Relationship Extraction Based on Anchored Entities Construct a relationship extraction hint project based on entity anchoring, the input of which includes: Original text block content; Anchored entity list (including Entity_ID, type, name, and attributes); Entity relationship type constraints; Using the first major language model described above for relation extraction, the model is required to: Relationships are established only between entities that have already been anchored; Instead of re-identifying entity boundaries, the start and end entities are specified by referencing the Entity_ID. The output relation triple format is: (header entity ID, relation type, tail entity ID); Accompanying evidence of the relationship (textual fragments in the original text that support the relationship); The output of the first language model and the anchored entity list are submitted together to the second language model for collaborative verification. The verification includes: Is the entity ID referenced correctly? Does the relation type conform to the constraint matrix rules? Whether the evidence of the relationship is sufficient to support the judgment of the relationship; If the second language model detects an error, it outputs the corrected relation triples and feeds the correction information back to the first language model for final confirmation.

[0037] 3.4 Relational Triple Constraint Verification and Conflict Resolution Perform type consistency verification on all extracted relation triples: Query constraint matrix [Head entity type, relationship type, tail entity type]; If the value is 0, it is determined as an illegal relationship, and the conflict resolution process is triggered; The conflict resolution strategies include: Type correction: Map the illegal relationship type to the closest legal relationship type according to semantic similarity (e.g., correct "attack" to "influence"); Direction correction: Check the relationship directionality, and automatically correct the head and tail entity orders for directed relationships (such as "belong to", "initiate"); Relationship demotion: If it cannot be corrected, demote the relationship to a general relationship (such as "related"), and mark it for manual review; 3.5 Lightweight relationship extraction model training based on large model output Based on the relationship triples after collaborative verification and constraint verification by the large model in Steps 3.3 and 3.4, construct a network security entity relationship training dataset; 3.5.1 Automatic annotation training dataset construction Steps 3.1 to 3.4 use a large language model for relationship extraction, which has high accuracy, but high inference cost and slow speed, making it difficult to meet the real-time and large-scale processing requirements of the production environment; To reduce the inference computing power requirements and latency, use the extraction results of the large model on large-scale long text data as automatically annotated training data for training a lightweight relationship extraction model; The automatically annotated dataset has the following characteristics: large data scale, capable of automatically processing a large number of long texts without manual annotation; quality controllable, through entity anchoring, constraint matrix verification, and conflict resolution; consistent entity boundaries, uniformly using the entity extraction model for anchoring to avoid annotation differences; 3.5.2 Data quality control and manual verification Sample a preset proportion (such as 5%, 10%) from the relationship triples output by the large model for manual verification. The verification content includes the correctness of the relationship type, the sufficiency of the relationship evidence, and the rationality of the entity pair; The data after manual verification is used as a high-quality validation set for model performance evaluation and difficult example training; 3.5.3 Construction of the training data format with enhanced entity types Convert the relationship triples extracted by the large model into a training format, specifically including: Wrap the entities in the original text with special tags, and the tag format is <entity type>entity name< / entity type>, where the entity types include vulnerabilities, malware, hacker organizations, non-hacker organizations, software, hardware, geographical locations, network identifiers, etc.; Entity tagging example: The original text "The APT28 group used the Zebrocy malware to attack NATO member states" is converted to "<Hacker Group>APT28< / Hacker Group> used <Malware>Zebrocy< / Malware> to attack <Organization>NATO< / Organization>"; The training data format is defined as: the input is entity-tagged text, and the output is a list of relational triples [(head entity ID, head entity type, relation type, tail entity ID, tail entity type),...]; The described entity type tagging enables the model to explicitly learn the semantic constraint relationship between entity types and relation types during training; 3.5.4 Efficient Fine-tuning of Lightweight Model Parameters Use another base model to perform efficient parameter fine-tuning on the automatically annotated dataset to form a dedicated model for network security entity relationship extraction: Adopt the Low-Rank Adaptation (LoRA) fine-tuning method, and the fine-tuning parameters are set as: learning rate , batch size 2, LoRA rank 32, LoRA scaling factor 64, number of training epochs 3; After training, the inference speed of the lightweight model is increased by 10 - 20 times compared to the large model, the computing power cost is reduced by 80%, and the accuracy remains at 92% - 95%, meeting the real-time and cost requirements of the production environment; 3.5.5 Enhancement of Multi-task Joint Training In a preferred embodiment, a multi-task joint training strategy is adopted to further improve the model performance: The main task is relationship extraction, the input is entity-tagged text, the output is relational triples, and the automatically annotated relationship data is used as training samples; The described auxiliary task uses the high-quality entity dataset constructed in step 1 as additional training data to enhance the model's perception ability of entity types; During training, randomly mix the relation automatically annotated data and entity data, where the entity data is only used as the supervision signal for the auxiliary task, and improve the model's understanding ability of the semantic association between entity types and relation types through the multi-task learning mechanism; 3.6 Long Text Relationship Extraction and Disambiguation Based on the Fine-tuned Model Use the fine-tuned entity relationship extraction model to perform relationship extraction on all chunks of the long text; Perform global disambiguation on the extracted relationships: Entity disambiguation: Align with the entity disambiguation results in step 1.4 to ensure that the entity IDs in the relational triples are consistent with the global entity library; Relation deduplication: Identify duplicate relationships (same head and tail entity pairs + same relation type) extracted from different chunks, and only retain the record with the highest confidence; Relationship consistency verification: Apply the constraint matrix again to perform a global consistency check; The final set of entity relation triples after deduplication, disambiguation, and verification is output as input for knowledge graph construction.

[0038] 4. Construction of a cybersecurity knowledge base 4.1 Knowledge Graph Model Design in the Cybersecurity Domain Based on the aforementioned entity and relationship extraction results, a knowledge graph model for the cybersecurity domain is designed. Entity types include vulnerabilities, malware, hackers, hacker organizations, non-hacker individuals, non-hacker organizations, software, hardware, geographical location, and network identifiers. Relationship types include vulnerability attacks, Trojan attacks, data breaches, exploitation relationships, impact relationships, attribution relationships, and location relationships. An attribute set is defined for each entity type; for example, vulnerability entities include attributes such as ID, severity, and release time; hacker organizations include attributes such as name and activity time.

[0039] 4.2 Entity Relationship Data Preprocessing and Format Conversion The entity and relation data extracted from the named entity and relation extraction model and after disambiguation are converted into a standard format suitable for graph databases. The processing flow includes: (1) assigning unique identifiers to entities to ensure that nodes in the graph are not duplicated; (2) normalizing relation data, including determining the starting node, target node, and relation type; (3) uniformly converting attribute data types; and (4) cleaning data to handle special characters and missing values. This process generates structured node and relation datasets, preparing for batch import into graph databases.

[0040] 4.3 Methods for Importing Knowledge Graph Data A three-tiered import strategy is designed: (1) a basic data batch import mechanism for initial large-scale data processing; (2) an incremental data import mechanism for periodic data updates; and (3) a real-time data import interface for emergency threat intelligence integration. Transaction control is used during the import process to ensure data consistency and to achieve entity synchronization and relationship mapping during the import process, avoiding duplicate node creation. A dedicated batch processing algorithm is designed to improve import efficiency, taking into account the characteristics of network security data.

[0041] 4.4 Index and Constraint Design Methods To support efficient querying and data integrity, a dedicated indexing strategy for the cybersecurity knowledge graph is designed: (1) Entity uniqueness constraint design, focusing on attributes that require unique identification, such as vulnerability numbers and IP addresses; (2) Key attribute index design, optimizing retrieval performance based on common query patterns; (3) Relationship attribute index design, supporting efficient filtering based on time series and relationship attributes; (4) Composite index design, targeting multi-condition joint query scenarios. The index design follows the principle of balancing query frequency and data update, dynamically adjusting the indexing strategy.

[0042] 4.5 Knowledge Graph Quality Assessment System Establish a quality assessment system for cybersecurity knowledge graphs, including: (1) a data integrity assessment method to detect missing entities and isolated nodes; (2) a relationship consistency verification mechanism to ensure the validity of relationships; (3) statistical analysis of knowledge graph scale and density; and (4) a critical path verification mechanism to ensure the traceability of security relationships such as attack chains and vulnerability exploitation chains. By setting quality thresholds and assessment processes, the usability and reliability of the knowledge graph are guaranteed.

[0043] 4.6 Design of Network Security Knowledge Application Interface The hierarchical knowledge graph application interface is designed as follows: (1) Basic query interface, supporting entity attribute and relationship retrieval; (2) Security analysis interface, supporting threat intelligence analysis, vulnerability impact assessment and other functions; (3) Knowledge reasoning interface, supporting attack path analysis and risk prediction; (4) Graph maintenance interface, supporting knowledge update and version management. The interface design adopts a unified parameter passing and result return specification, supports access control and query optimization, and provides a result caching mechanism to improve performance.

[0044] 4.7 Knowledge Graph Update and Maintenance Mechanism A continuous update mechanism for the cybersecurity knowledge graph is established, comprising: (1) an incremental data acquisition strategy to obtain new data from multiple intelligence sources; (2) an automated entity relationship extraction process to process new data using trained models; (3) entity alignment and knowledge fusion algorithms to ensure consistency between new and old data; (4) conflict detection and resolution strategies; and (5) a graph version management mechanism to support historical version backtracking and comparison. This mechanism ensures that the knowledge graph continuously reflects the latest cybersecurity situation, providing timely and effective knowledge support for security analysis.

[0045] In a specific embodiment of the present invention, the specific implementation of the technical solution will now be further described: 1. Named entity extraction in the cybersecurity domain based on multi-model collaborative verification 1.1 Network Security Named Entity Extraction Hints -Target- Given a list of text documents and entity types that may be associated with the current activity, identify all entities of the specified types and their relationships.

[0046] -step- 1. Identify specific entities within all text entries. Extract the following information for each entity (all name fields should be extremely concise to avoid long texts): Vulnerability - Name - Number (ID) - Affected Systems Malware - Name - Family - Target Hacker - Name Hacker Group - Organization Name (GroupName) Individual (non-hacker) - Name - Affiliation with an organization Organization (non-hacker organization) - Organization Name Software (excluding malware) - Name and Version (Name) Hardware - Name - Model / Serial Number - Manufacturer Location - Geographic Location IP (IP Address) - IP address Domain - Full Domain Format example: "entity":{"id":"starting from 0","type":"type name, such as Location","attribute":{"attribute1":"xx","attribute2":"xx"} 2. From the entities in step 1, identify all source and target entity pairs that are explicitly related to xx in the xxxx text.

[0047] Extracting from each pair of relations: - source_entity: Source entity ID (same as step 1) - target_entity: Target entity ID (same as step 1) - relationship_description: Relationship description Format example: "relationship":{"source_entity":"entity id","relationship_description":"xxx","target_entity":"entity id"} 3. Use JSON to combine entities and relationships into a single JSON object, with the following format: { "entities": [ { "id": 0, "type": "...", "attribute": { ...}}, ... ], "relationships": [ { "source_entity": 0, "target_entity": 1, "relationship_description":"..."}, ... ] } 4. Precautions In entity recognition, specific entities (e.g., names or specific models) are identified within all text (e.g., "a university," "a researcher," "a corporate browser," "an FTP server"), but general entities (e.g., "a university," "a researcher," "a corporate browser," "an FTP server") are not extracted.

[0048] - Complex hardware and software integrated systems, such as the xx subway system, are treated as software systems.

[0049] - Name extraction needs to be streamlined, removing location and function information, and only extracting the name.

[0050] - Note the distinction between software systems with geographical locations and the concept of geographical location.

[0051] 1.2 Cybersecurity Entity Disambiguation Vulnerability entity disambiguation: This technical solution first performs precise matching and grouping based on standard CVE IDs, merging attributes for vulnerability entities with the same CVE ID. For vulnerabilities without CVE IDs, a two-stage strategy is adopted: first, preliminary grouping is performed based on the vulnerability name, and then semantic vector representation is used to calculate the similarity between names. When the similarity between two vulnerability names exceeds a threshold of 0.75, they are identified as the same vulnerability and their attributes are merged, while all original name variants are preserved.

[0052] Malware entity disambiguation: After grouping by name, the system applies a semantic similarity model to calculate the similarity between malware names. When the similarity between two names exceeds a threshold of 0.7, they are identified as the same malware. This method effectively handles spelling differences and aliases that may exist in different malware reports.

[0053] IP address and domain name entity disambiguation: IP addresses are normalized, including removing parentheses, resolving to a standard format, and identifying identical entities through exact matching. Domain name disambiguation employs a special normalization process: converting to lowercase, removing HTTP protocol identifiers and the www prefix, and replacing obfuscating symbols (e.g., replacing [.] with .), ensuring that the same domain name in different representations can be correctly merged.

[0054] Disambiguation between organizations and hacker groups: This technical solution employs an adaptive disambiguation strategy based on the characteristics of the organization name: A higher similarity threshold (0.85) is applied to short names and organization names in specific formats (such as all uppercase). To address hacker groups, an auxiliary verification mechanism is introduced: geographical attribute information is checked, and if the geographical information of an organization exists but is inconsistent, it will not be merged even if the names are similar. By capturing the semantic features of organization names through vector representation, we can effectively handle the same organization in different languages ​​and expressions.

[0055] Distinguishing between individuals and hacker entities: The system preserves the original case sensitivity of names and uses a high similarity threshold of 0.85 to avoid erroneously merging different person entities. It also implements an attribute merging mechanism to ensure that all information related to the same person is completely preserved.

[0056] Robust design: To address potential semantic model failures, the system implements a multi-layered fallback mechanism, ensuring effective disambiguation using precise matching even when similarity calculation is impossible. Each entity type's disambiguation process is equipped with anomaly detection and fallback handling, enhancing the overall reliability of the system.

[0057] 2. Long text segmentation technology The input for this section is the paragraph-entity matrix from Part 1, which is used to divide the long text into blocks.

[0058] This intelligent long-text segmentation algorithm for cybersecurity, based on multi-dimensional scoring, addresses the challenges of complex entity relationships, strong temporality of threat events, and dense technical terminology in cybersecurity documents. It constructs a multi-dimensional scoring system encompassing entity coverage, entity coherence, semantic similarity, threat continuity, and length constraints to resolve information fragmentation issues caused by traditional fixed-length segmentation methods. The algorithm employs an improved greedy strategy: in the preprocessing stage, it constructs an entity paragraph matrix and calculates various similarity matrices; in the segmentation generation stage, it progressively constructs segments by comprehensively evaluating the scores of added candidate paragraphs; in the overlap optimization stage, it applies an intelligent overlap mechanism based on paragraph importance to prevent the loss of critical information; and in the post-processing stage, it adjusts the segments to meet length constraints. Threat continuity modeling is a core innovation, tracking the occurrence positions of threat entities in different paragraphs and calculating positional continuity scores to ensure the integrity of the description of each stage of a threat event and prevent the attack chain from being artificially severed.

[0059] 2.1 Problem Description

[0060] Given a long text document on cybersecurity, containing paragraph Each paragraph contains a set of entities The research goal is to make this The paragraph is divided into Each block This ensures that the character length of each block satisfies The length constraints ensure that related entities and events are kept in the same block to achieve information integrity, paragraphs within the block have high semantic similarity to ensure semantic coherence, and the temporal description of threat events is kept continuous to ensure threat continuity.

[0061] 2.2 Input / Output Specifications The algorithm input includes a list of paragraphs. Entity paragraph matrix (in Paragraph Contains entities ), global entity list and length constraints, such as The algorithm outputs a block-based result. ,in This is a list of paragraph indexes.

[0062] 2.3 Objective Function The comprehensive evaluation function for chunk quality balances multiple dimensions such as entity coverage, entity coherence, semantic similarity, threat continuity, and length constraints, and is defined as follows: ;

[0063] in, Entity coverage, reflecting the richness of entities within a chunk, is defined as the ratio of the set of entities contained in the chunk to the total set of entities in the document. ; in For block The collection of entities contained therein It is the collection of all entities in the document.

[0064] To assess entity coherence, the degree of entity association between paragraphs within a block is evaluated by calculating the average entity similarity of all paragraph pairs within the block. ; Entity similarity, combining Jaccard similarity and entity type weight, is defined as: ; Weighting function The importance of entity types is assigned based on their type: vulnerability type has a weight of 1.0, malware type has a weight of 0.9, attack organization type has a weight of 0.8, and other types have a weight of 0.3.

[0065] For semantic similarity, the degree of semantic association between paragraphs is calculated using TF-IDF vectors, as shown in the following formula: ; This metric ensures that paragraphs within a block remain highly relevant at the semantic level, avoiding the mixing of irrelevant content.

[0066] To assess threat continuity, the temporal integrity of threat events within a chunk is evaluated using the following formula: ; in For block The set of threat entities included. As a threatening entity The sequence of paragraphs appearing in the document. For paragraph and The positional intervals between events. This indicator ensures the integrity of the threat event and prevents the attack chain from being artificially broken.

[0067] The length penalty function ensures that the blocks satisfy the length constraint, and is expressed as a piecewise function: ; This function applies a penalty to blocks that do not meet the length constraint, with a penalty coefficient of 0.5 for blocks that are too short and a penalty coefficient of 0.3 for blocks that are too long.

[0068] All weights satisfy .

[0069] Experiments show that this algorithm is accurate in segmentation, achieving a 98% accuracy rate in separating paragraph titles and content from long texts, demonstrating its effectiveness in semantic segmentation. Furthermore, it has a fast runtime, processing a single text document in 12 milliseconds.

[0070] In summary, this technical solution addresses the following key technical issues: insufficient accuracy in extracting professional terminology and entities in the field of network security; the balance between semantic segmentation and computational efficiency in long text processing; and the issues of accurate identification of complex entity relationships and disambiguation of entities in long texts.

[0071] In multi-model collaborative named entity extraction, this technical solution significantly improves extraction accuracy. The collaborative verification mechanism using Qianwen and Deepseek-r1 models significantly enhances named entity recognition accuracy and F1 score. The collaborative verification process drastically reduces the false alarm rate and significantly decreases subsequent manual verification workload. After LoRA fine-tuning, the lightweight model exhibits significantly improved inference speed compared to the full large model, with a substantial reduction in resource consumption, while maintaining a high F1 score. Comparative data shows that compared to traditional rule-based methods and single large model methods, this technical solution's multi-model collaborative method has significant advantages in both F1 score and inference speed; the lightweight model in this solution maintains a high F1 score while achieving a significantly faster inference speed than other methods.

[0072] The dynamic sliding window long text segmentation technique significantly enhances semantic integrity. The entity-driven semantically aware segmentation mechanism greatly improves the semantic integrity of text blocks and significantly reduces the loss of key information at segmentation boundaries. The local greedy strategy significantly reduces processing complexity, drastically shortening the processing time for large numbers of documents and significantly improving efficiency. The multi-objective fusion scoring function reduces the Gini coefficient of entity distribution, balancing information density and entity redundancy. Comparative data shows that compared with fixed-length segmentation and syntactic analysis-based segmentation, the dynamic sliding window method in this technique achieves a better balance between semantic integrity preservation, entity distribution uniformity, and processing efficiency.

[0073] In terms of the effectiveness of network security entity relationship extraction technology, the multi-model collaborative method significantly improves the F1 score for relationship identification, especially for implicit relationships. The Qianwen model, combined with LoRA fine-tuning, requires fewer activation parameters, significantly reducing computational resource requirements compared to a fully fine-tuned model with equivalent performance. Entity disambiguation technology greatly reduces entity relationship redundancy and conflicts, improving the quality of knowledge graph construction. Comparative data shows that compared to rule-based methods and single large-model methods, this technical solution has comprehensive advantages in terms of F1 score and processing efficiency.

[0074] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0075] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution device.

[0076] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0077] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0078] In the description of this specification, references to terms such as "an embodiment," "some embodiments," "example," "specific example," or "embodiment," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0079] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

[0080] The knowledge graph construction method, system, device, processor, and computer-readable storage medium of this invention in the field of cybersecurity achieve a significant improvement in end-to-end processing efficiency, with a very high degree of automation throughout the entire process from raw text to structured knowledge. This method can handle a large number of entity nodes and relational edges, supporting the processing of large batches of newly added security intelligence documents. Processing performance is linearly related to resource investment, supporting horizontal scaling and thus avoiding performance bottlenecks.

[0081] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A method for constructing a knowledge graph in the field of network security, characterized in that, The method comprises the following steps: (1) Based on multi-model collaborative verification, the named entity extraction in the network security field is carried out, and a lightweight entity extraction model is constructed: a network security named entity original data set is constructed, the network security named entity original data set is subjected to named entity extraction based on a network security entity extraction model, network security field named entities are obtained, the network security field named entities are subjected to collaborative verification and correction, high-quality entity extraction results are generated, and the network security entity extraction model is subjected to parameter fine-tuning and named entity disambiguation processing; (2) Long text segmentation based on dynamic sliding window: the high-quality entity extraction results extracted based on the network security entity extraction model are used to segment the obtained network security field long text, and a multi-dimensional scoring function is designed to intelligently block the segmentation results to ensure semantic integrity; (3) Constraint relationship extraction based on entity anchoring and lightweight entity relationship model construction: an entity first anchoring mechanism is adopted, the network security entity extraction model is used to extract standard entities as anchor points for entity relationship extraction, entity relationship extraction and verification are carried out based on an entity relationship type constraint matrix, a high-quality entity relationship data set is constructed, and a lightweight entity relationship extraction model is constructed; (4) Knowledge graph construction: based on the extracted and disambiguated named entities and relationships, a knowledge graph mode is designed, and a network security knowledge graph is constructed. 2.The network security domain knowledge graph construction method of claim 1, characterized in that, The step (1) comprises: (1.1) Constructing a network security named entity original data set: collecting network security related long texts, merging after document segmentation and segment-by-segment segmentation, and removing duplicate data with high similarity to obtain a network security named entity original data set; (1.2) The network security entity extraction model uses a first large language model combined with a prompt engineering based on background-target-notice-sample to extract named entities from the network security named entity original data set, and a second large language model is used to collaboratively verify and correct the extracted named entities to generate high-quality entity extraction results; (1.3) The named entity extraction base model is used to fine-tune the parameters of the verified and corrected named entities to form an entity extraction model; (1.4) Based on the entity extraction model, the extracted long text named entities are disambiguated to unify the same entities in different paragraphs. 3.The network security domain knowledge graph construction method of claim 1, characterized in that, The step (1.2) specifically comprises: The first large language model is used for initial named entity extraction, and the output results are submitted to the second large language model together with the prompt words for confirmation and correction. If there is an error, the output content is corrected, and the corrected information is input into the first large language model again for final confirmation; otherwise, the correct output is directly outputted. 4.The network security domain knowledge graph construction method of claim 2, characterized in that, The step (1.3) specifically comprises: The LoRA model is used for parameter fine-tuning of the current obtained high-quality named entity dataset, wherein the named entity extraction base model adopts Qianwen 3-1.7B, and the parameter settings include a learning rate of 5e-4, a batch size of 2, a LoRA rank of 32, a LoRA scaling factor of 64, and 2 training rounds. 5.The network security domain knowledge graph construction method of claim 2, characterized in that, The step (2) comprises: (2.1) Given a network security long text document, the long text is divided based on the obtained named entity extraction results by using a dynamic sliding window method, wherein the document contains paragraphs , and k entities generated after the step (1) of entity extraction ​ (2.2) setting the semantic input and output specification in the following manner: Setting up an input paragraph list and paragraph-entity matrix where denotes a paragraph contains entities , is a real number, the global entity list , k global entities, and the length constraint ; The network security long text document output is divided into blocks according to the above specification , a total of m blocks, wherein , is a paragraph index list, a total of l items; (2.3) designing a multi-dimensional scoring function for intelligent block processing according to entity coverage, entity coherence, semantic similarity, threat continuity and length constraint, and the expression is: ； wherein, is an entity coverage, is an entity coherence, is a semantic similarity, is a threat continuity, is a length penalty function; is a multi-dimensional scoring function; The various weights satisfy .

6. The network security field knowledge graph construction method according to claim 5, characterized in that, The entity coverage is determined according to the ratio of the entity set contained in each block to all entity sets in the network security long text document, specifically: ； wherein, is a collection of entities contained in a document, is a collection of all entities in a network security long text document; The entity coherence is determined by calculating the average value of the entity similarity of all paragraphs in each block, specifically: ； ； wherein, is the th block, is the th paragraph, is the th paragraph, is the th group of entities, is the th group of entities, is a weight function, is an entity; The semantic similarity calculates the semantic correlation degree between each paragraph using the TF-IDF vector, specifically: ； wherein, is an activation function, is term frequency-inverse document frequency; The threat continuity is used to evaluate the time sequence integrity of threat events in the block, specifically: ； wherein, is a block a set of threat entities contained in the document, is a threat entity a sequence of passages occurring in the document, is a passage and a position interval between The length penalty function is used to ensure that each block meets the length constraint, and is represented by a piecewise function: ； Thus, the construction of the multi-dimensional scoring function is completed. 7.The network security domain knowledge graph construction method of claim 4, characterized in that, The step (3) comprises: (3.1) entity anchoring stage: for the text block after intelligent block processing, an entity extraction model for network security is used to extract entities and generate a standard entity list; a globally unique identifier Entity_ID is assigned to each extracted entity, and an entity ID mapping table is constructed to record the text location, type, attribute and block information of the entity; (3.2) Entity relationship type constraint matrix construction: based on network security domain knowledge and threat intelligence specification, construct an entity relationship type constraint matrix wherein, is the number of head entity types, is the number of relationship types, is the number of tail entity types; the matrix element indicates that the head entity of type can be connected to the tail entity of type through the relationship type ; indicates that the triple is semantically illegal; (3.3) relationship extraction based on anchored entities: a relationship extraction prompt engineering based on entity anchoring is constructed, and the input includes: original text block content, anchored entity list and entity relationship type constraint; The first large language model is used for relationship extraction; The output result of the first large language model is submitted to the second large language model together with the anchored entity list for collaborative verification; if the second large language model finds errors, it outputs corrected relationship triples, and feeds back the correction information to the first large language model for final confirmation; (3.4) type consistency verification of all extracted relationship triples: Through step (3.2), the entity relationship type constraint matrix is queried, and if the value is 0, it is determined as an illegal relationship, triggering a conflict resolution process, and the entity relationship type constraint matrix is processed for type correction, direction correction or relationship degradation; (3.5) based on the relationship triples after collaborative verification and constraint verification in steps (3.3) and (3.4), a network security entity relationship training dataset is constructed, and artificial verification, entity type enhancement, parameter fine-tuning and multi-task joint training are performed to complete the training of a lightweight entity relationship extraction model; (3.6) using the fine-tuned entity relation extraction model to extract the relations of all blocks of long text, and globally disambiguating the extracted relations; (3.7) outputting the final de-duplicated, disambiguated and verified entity relation triple set as the input of the knowledge graph construction. 8.The network security domain knowledge graph construction method of claim 7, characterized in that, The entity disambiguation in steps (1) and (3) adopts different strategies for different types of entities, including: for vulnerability entities, preferentially performing number matching, and when there is no number, performing name semantic similarity calculation; for malware, organization and hacker entities, performing name semantic similarity calculation; for IP addresses and domain names, performing accurate matching after standardization. 9.The network security domain knowledge graph construction method of claim 8, characterized in that, The step (4) is specifically: (4.1) based on the named entity and entity relation extraction results, designing a network security field knowledge graph mode, including entity types and relation types, and defining corresponding attribute sets for each type of entity; (4.2) converting the entity and entity relation data after disambiguation of the named entity and entity relation extraction model into a standard format suitable for a graph database, including: entity uniqueness identification allocation to ensure that the nodes in the graph are not repeated; relation data standardization processing, including determining the starting node, target node and relation type of the relation; attribute data type unified conversion; and data cleaning, processing special characters and missing values; (4.3) designing a three-level import strategy: a basic data batch import mechanism for initial large-scale data processing; an incremental data import mechanism for regular data updating; and a real-time data import interface for emergency threat intelligence integration; (4.4) designing a network security knowledge graph special index strategy: including entity uniqueness constraint design, key attribute index design, relation attribute index design and composite index design; (4.5) establishing a network security knowledge graph quality evaluation system, including: data integrity evaluation method, relation consistency verification mechanism, knowledge graph size and density statistical analysis, and key path verification mechanism; (4.6) designing a hierarchical knowledge graph application interface, including a basic query interface, a security analysis interface, a knowledge reasoning interface and a graph maintenance interface; (4.7) establishing a continuous updating mechanism for the network security knowledge graph, including an incremental data collection strategy, an automated entity relation extraction process, an entity alignment and knowledge fusion algorithm, a conflict detection and resolution strategy, and a graph version management mechanism, to form the final network security knowledge graph. 10.A network security domain knowledge graph construction system, configured to implement the method of any one of claims 1 to 9, characterized in that, It includes: a named entity extraction module for performing named entity extraction based on multi-model collaborative verification and lightweight model training; a long text processing module for performing long text segmentation based on a dynamic sliding window; an entity relation extraction module for performing entity relation extraction based on multi-model collaborative verification and lightweight model training; an entity disambiguation module for disambiguating the extracted entities and relations in the long text; a knowledge graph construction module for knowledge graph mode design, data preprocessing, data import, index construction and knowledge graph generation. 11.A network security domain knowledge graph construction apparatus, characterized in that, The device includes: a processor configured to execute computer executable instructions; A memory storing one or more computer-executable instructions that, when executed by the processor, implement the steps of the network security domain knowledge graph construction method of any one of claims 1-9. 12.A network security domain knowledge graph construction processor, characterized in that, The processor is configured to execute computer-executable instructions that, when executed by the processor, implement the steps of the network security domain knowledge graph construction method of any one of claims 1-9.

13. A computer-readable storage medium, characterized in that, A computer program stored thereon, the computer program being executable by a processor to implement the steps of the network security domain knowledge graph construction method of any one of claims 1-9.

Images