Railway network security operation knowledge base construction method and system based on knowledge graph

Abstract

The invention relates to the technical field of network security, and provides a method and system for constructing a railway network security operation knowledge base based on a knowledge graph, and the method comprises the steps: constructing a knowledge graph ontology model of railway network security operation knowledge, collecting railway network security operation data adaptive to the knowledge graph ontology model, and storing the data in a database; an entity set, entity attributes and entity relations contained in the adaptive knowledge graph ontology model are extracted from the collected railway network safety operation data, structured expression content of the knowledge graph is formed, knowledge fusion is carried out on the structured expression content of the knowledge graph, fusion data of the knowledge graph are obtained, and the fusion data of the knowledge graph are obtained; and generating a network security operation knowledge graph knowledge base according to the fusion data of the knowledge graph. According to the invention, the knowledge accumulation and application capability in the railway network safety operation process can be improved.

Description

Technical Field

[0001] This invention relates to the field of railway safety operation technology, and in particular to a method and system for constructing a railway network security operation knowledge base based on knowledge graphs. Background Technology

[0002] With the continuous development of railway network security operations, operational knowledge is accumulating on a large scale. The amount and timeliness of this knowledge have exceeded the capacity of individuals to fully grasp it. Therefore, using knowledge bases as auxiliary tools to store various types of network security operation knowledge, reflect the interrelationships between knowledge, and analyze and handle threats, as well as perceive and mitigate risks during network security operations, has become a new trend. Knowledge graph technology, as a structured and systematic knowledge organization and application technology, possesses user-friendly visualization and efficient retrieval capabilities, and can provide technical support for the construction and application of railway network security operation knowledge bases. Building a knowledge graph-based railway network security operation knowledge base can significantly improve the work efficiency of network security operation personnel.

[0003] For traditional single-method knowledge graph ontology model construction technology, in the context of large-scale network security operation data, the scale of nodes and edges in the knowledge graph can usually reach hundreds of billions, and single-method knowledge graph storage technology is insufficient in terms of data maintenance and query efficiency. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides a method and system for constructing a railway network security operation knowledge base based on knowledge graphs.

[0005] This invention provides a method for constructing a railway network security operation knowledge base based on knowledge graphs, comprising: Construct a knowledge graph ontology model of railway network security operation knowledge; Collect railway network security operation data adapted to the knowledge graph ontology model; Extract the entity set, entity attributes, and entity relationships contained in the collected railway network security operation data to adapt to the knowledge graph ontology model, and form the structured expression content of the knowledge graph; Knowledge fusion is performed on the structured representation of knowledge graphs to obtain fused knowledge graph data; A cybersecurity operations knowledge graph knowledge base is generated based on the fusion data from the knowledge graph.

[0006] According to the present invention, a method for constructing a railway network security operation knowledge base based on a knowledge graph is provided, wherein the construction of a knowledge graph ontology model for railway network security operation knowledge includes: Based on the business processes and work content in railway network security operations, identify entity objects, construct entity sets, entity attributes, and entity relationships to form a subjective ontology model; Based on historical railway network security scenario data, entity sets, entity attributes, and entity relationships are extracted to form an objective ontology model; The subjective ontology model and the objective ontology model are reviewed and compared to form a knowledge graph ontology model.

[0007] According to the present invention, a method for constructing a railway network security operation knowledge base based on a knowledge graph is provided. The railway network security operation data includes structured data. Accordingly, entity sets, entity attributes, and entity relationships adapted to the knowledge graph ontology model are extracted from the collected railway network security operation data to form the structured representation content of the knowledge graph, including: A data mapping system is constructed to parse structured data tables and extract metadata information of the structured data. The metadata information includes table name, field name, and field type. The table name corresponds to the entity type, the field name corresponds to the entity's attribute, and each row of data represents an entity instance. Read each row of records in the table and extract a specific entity object; map the columns and values ​​in the data table to entity attributes and attribute values; By utilizing primary and foreign key relationships between tables or multi-table join query logic, we can identify the relationships between different entity types and determine the direction and type of the relationship. The extracted entities, attributes, and relationships are organized into triples: subject-verb-object, to form structured content.

[0008] According to the present invention, a method for constructing a railway network security operation knowledge base based on a knowledge graph is provided. The railway network security operation data includes unstructured data. Accordingly, the method extracts entity sets, entity attributes, and entity relationships from the collected railway network security operation data to form a structured representation of the knowledge graph, including: Deep learning methods are used to analyze and process unstructured railway network security operation data, extracting entity sets, entity attributes, and entity relationships. The extracted entities, attributes, and relationships are then organized into structured expressions according to triples: subject-verb-object.

[0009] According to the present invention, a method for constructing a railway network security operation knowledge base based on a knowledge graph includes, in which the structured representation of the knowledge graph is fused to obtain fused data of the knowledge graph, the following steps are taken: The structured representations of the processed knowledge graph are merged and aligned, and identical entities, attributes, and relationships are merged. Identify and process differentiated data: For the structured representation of structured data, tables describing the same object in multiple data tables are identified and normalized, and uniformly mapped to the same entity type. For structured representations formed from unstructured data, knowledge entity fusion and alignment are performed based on entity set similarity.

[0010] According to the present invention, a method for constructing a railway network security operation knowledge base based on a knowledge graph is provided, wherein generating a network security operation knowledge graph knowledge base based on fused data from the knowledge graph includes: A distributed storage and retrieval scheme is adopted to operate on the fused data of the knowledge graph; the fused data of the knowledge graph is sharded according to the hash sharding strategy, and each data shard is stored on an independent storage node; a global entity index and a relation index are constructed, and index shards are formed according to the index information. The index shards are distributed and deployed on storage nodes and synchronized periodically; through the collaborative distribution of index shards and data shards, a network security operation knowledge graph knowledge base is formed.

[0011] According to a method for constructing a railway network security operation knowledge base based on a knowledge graph provided by the present invention, the method further includes: The system performs knowledge retrieval, knowledge statistics, and knowledge graph maintenance based on the knowledge graph knowledge base for network security operations. The knowledge retrieval is used to quickly query the required knowledge information during the command and control of railway network security operations. The knowledge statistics are used to perform personalized, multi-dimensional statistics on the number of knowledge items in the knowledge graph. The knowledge graph maintenance is used to support the addition, editing, and deletion of entity information and corresponding knowledge information in the knowledge graph.

[0012] This invention also provides a knowledge graph-based system for constructing a railway network security operation knowledge base, comprising: The construction module is used to build a knowledge graph ontology model of railway network security operation knowledge; The data acquisition module is used to collect railway network security operation data that is adapted to the knowledge graph ontology model. The extraction module is used to extract the entity set, entity attributes and entity relationships contained in the knowledge graph ontology model from the collected railway network security operation data, forming the structured expression content of the knowledge graph; The fusion module is used to fuse the structured representation of the knowledge graph to obtain fused data of the knowledge graph. The generation module is used to generate a cybersecurity operations knowledge graph knowledge base based on the fused data from the knowledge graph.

[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the above-described methods for constructing a railway network security operation knowledge base based on a knowledge graph.

[0014] The present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements any of the above-described methods for constructing a railway network security operation knowledge base based on a knowledge graph.

[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the above-described methods for constructing a railway network security operation knowledge base based on a knowledge graph.

[0016] This invention provides a method and system for constructing a railway network security operation knowledge base based on knowledge graphs. It constructs a knowledge graph ontology model of railway network security operation knowledge, collects railway network security operation data adapted to the knowledge graph ontology model, extracts entity sets, entity attributes, and entity relationships from the collected railway network security operation data to form a structured representation of the knowledge graph, performs knowledge fusion on the structured representation of the knowledge graph to obtain fused knowledge graph data, and generates a network security operation knowledge graph knowledge base based on the fused knowledge graph data. This enhances the knowledge accumulation and application capabilities in the railway network security operation process. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the method for constructing a railway network security operation knowledge base based on knowledge graphs provided by this invention.

[0019] Figure 2 This is a schematic diagram of the structure of the railway network security operation knowledge base construction device based on knowledge graph provided by the present invention.

[0020] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0022] Figure 1 This diagram illustrates a flowchart of a knowledge graph-based railway network security operation knowledge base construction method provided by the present invention. (See attached diagram.) Figure 1 The method includes the following steps: Step 11: Construct a knowledge graph ontology model of railway network security operation knowledge.

[0023] Step 12: Collect railway network security operation data adapted to the knowledge graph ontology model.

[0024] Step 13: Extract the entity set, entity attributes, and entity relationships contained in the collected railway network security operation data to adapt to the knowledge graph ontology model, forming the structured expression content of the knowledge graph.

[0025] Step 14: Perform knowledge fusion on the structured representation of the knowledge graph to obtain the fused data of the knowledge graph.

[0026] Step 15: Generate a cybersecurity operations knowledge graph knowledge base based on the fused data from the knowledge graph.

[0027] Regarding steps 11 to 15, it should be noted that this invention aims to enhance the knowledge accumulation and application capabilities during railway network security operations. This method integrates experiential information and machine intelligence methods to construct a knowledge graph ontology model, automatically collects network security operation data for knowledge extraction and fusion, and employs a distributed architecture to build a knowledge graph database.

[0028] In this invention, the first step is to construct a knowledge graph ontology model of railway network security operation knowledge. This knowledge graph ontology model is a conceptual model of the railway network security operation knowledge graph, used to determine the scope of network security operation business and data categories. In this invention, based on the business processes and work content in railway network security operation, entity objects are identified, and entity sets, entity attributes, and entity relationships are constructed to form a subjective ontology model. That is, based on experiential information, the business processes and work content in railway network security operation are analyzed to determine entity objects, and then based on these entity objects, entity sets, entity attributes, and entity relationships are constructed to form a subjective ontology model.

[0029] Next, based on historical railway network security scenario data, entity sets, entity attributes, and entity relationships are extracted to form an objective ontology model. That is, machine intelligence methods are used to analyze and process historical railway network security scenario data, extracting entities and relationships to form an objective ontology model. In this invention, the BiLSTM-CRF method is used to extract entities, the BERT method is used to extract relationships, or the BIESO method is used to jointly extract entities and relationships.

[0030] Finally, the subjective and objective ontology models are reviewed and compared to form a knowledge graph ontology model. This involves integrating an ontology model generated based on experiential information and an algorithm-generated ontology model. The model is then jointly optimized and adjusted using optimization rules from knowledge graph experts and cybersecurity operations experts to confirm the final knowledge graph ontology model, thereby improving its accuracy.

[0031] Furthermore, network security operation data is collected in real-time or periodically from multiple heterogeneous data sources for railway network security operations, and preprocessed. Specifically: 1) Organizational data, based on the hierarchical structure of the China State Railway Group's organizational structure, including the China State Railway Group level, railway bureau group company level, station and section level, and organizational data of various departments.

[0032] 2) Personnel information data, including data on personnel related to railway network security operations.

[0033] 3) Network type data, including the Internet, external service network, internal service network, and safety production network corresponding to each level of the organization.

[0034] 4) Information asset data, including information data of assets such as physical machines, virtual machines, network devices, application systems, IP addresses, middleware, and databases.

[0035] 5) Manage documents and data, including network security operation-related policy documents and requirements.

[0036] 6) Threat intelligence data, including internal and external threat intelligence data, mainly data on malicious IPs, domains, organizations, and tactics.

[0037] 7) Security equipment data, network security equipment information data.

[0038] 8) Security incident data.

[0039] 9) Handling manual data, and corresponding handling methods for safety incidents and risks.

[0040] The data collection methods support RESTful API calls, data crawlers, files, etc., and an automated data collection system needs to be built to collect incremental data.

[0041] Furthermore, the main focus is on explaining the process of extracting entity sets, entity attributes, and entity relationships from the collected railway network security operation data to form a structured representation of the knowledge graph ontology model, as detailed below: The knowledge extraction method of this invention is the process of identifying and extracting valuable knowledge from multi-source heterogeneous data, ultimately achieving a systematic classification and structured representation of entities, attributes, and their relationships. Railway network security operation data includes both structured and unstructured data; therefore, knowledge extraction correspondingly includes knowledge extraction from both structured and unstructured data.

[0042] For structured data: Structured data mainly refers to relational database tables, Excel spreadsheets, etc. A data mapping system is built to parse the structured data tables and extract metadata information, including table name, field names, and field types; the table name corresponds to the entity type, the field names correspond to the entity's attributes, and each row of data represents an entity instance. Read each row of records in the table and extract a specific entity object; map the columns and values ​​in the data table to entity attributes and attribute values; By utilizing primary and foreign key relationships between tables or multi-table join query logic, we can identify the relationships between different entity types and determine the direction and type of the relationship. The extracted entities, attributes, and relationships are organized into triples: subject-verb-object, to form structured content.

[0043] For unstructured data: Deep learning methods are used to analyze and process unstructured railway network security operation data, extract entity sets, entity attributes, and entity relationships, and organize the extracted entities, attributes, and relationships into structured expressions according to triples: subject-verb-object.

[0044] Furthermore, the main focus is on the knowledge fusion of the structured representation of the knowledge graph, and the process of processing the fused data of the knowledge graph is explained as follows: The structured representations of the processed knowledge graph are merged and aligned, and identical entities, attributes, and relationships are merged. Identify and process differentiated data: For the structured representation of structured data, tables describing the same object in multiple data tables are identified and normalized, and uniformly mapped to the same entity type. For structured representations formed from unstructured data, knowledge entity fusion and alignment are performed based on entity set similarity.

[0045] The similarity between two sets can be measured using Dice distance and Jaccard distance. Dice distance treats strings as a set and calculates the similarity between two words by evaluating the similarity of the strings.

[0046] in The number of identical characters in the text. and yes and The length.

[0047] Furthermore, the main focus is on explaining the process of generating a cybersecurity operations knowledge graph knowledge base based on the fused data from the knowledge graph, as detailed below: A distributed storage and retrieval scheme is adopted to operate on the fused data of the knowledge graph; the fused data of the knowledge graph is sharded according to the hash sharding strategy, and each data shard is stored on an independent storage node; a global entity index and a relation index are constructed, and index shards are formed according to the index information. The index shards are distributed and deployed on storage nodes and synchronized periodically; through the collaborative distribution of index shards and data shards, a network security operation knowledge graph knowledge base is formed.

[0048] Index sharding and data sharding are distributed collaboratively to reduce cross-node queries; query requests are parsed to generate distributed execution plans, employing a cost-based query optimizer to automatically select the optimal data access path and sharding routing strategy; distributed execution of multi-hop queries and merging of intermediate results are supported, with cross-node computation coordinated through asynchronous message queues; distributed transactions or eventual consistency models are used to ensure data update consistency, supporting online horizontal scaling, with new nodes automatically joining the cluster and participating in data rebalancing. This architecture enables efficient storage, fast querying, and stable scaling of knowledge graphs in a distributed environment, suitable for large-scale knowledge storage, dynamic knowledge expansion, and efficient knowledge retrieval applications in railway network security operations.

[0049] In this invention, knowledge retrieval, knowledge statistics, and knowledge graph maintenance are performed based on the knowledge graph knowledge base for network security operations. Knowledge retrieval is used to quickly query the required knowledge information during the command and control of railway network security operations. Knowledge statistics are used to perform personalized, multi-dimensional statistics on the number of knowledge items in the knowledge graph. Knowledge graph maintenance is used to support the addition, editing, and deletion of entity information and corresponding knowledge information in the knowledge graph.

[0050] Building upon the core functionality of the railway network security operation knowledge base in the formation of the knowledge graph, this module provides maintenance and application of the knowledge base, including: (a) The DELETE() method deletes elements from the knowledge graph; (b) The ADD() method adds knowledge graph elements; (c) Use the EDIT() method to compile knowledge graph elements; (d) The SEARCH() method is used to retrieve knowledge. (e) The SHOW() method displays the knowledge base.

[0051] The present invention provides a method for constructing a railway network security operation knowledge base based on knowledge graphs. This method involves building a knowledge graph ontology model of railway network security operation knowledge, collecting railway network security operation data adapted to the knowledge graph ontology model, extracting entity sets, entity attributes, and entity relationships from the collected railway network security operation data to form a structured representation of the knowledge graph, performing knowledge fusion on the structured representation of the knowledge graph to obtain fused knowledge graph data, and generating a network security operation knowledge graph knowledge base based on the fused knowledge graph data. This method can improve the knowledge accumulation and application capabilities in the railway network security operation process.

[0052] The following describes the knowledge graph-based railway network security operation knowledge base construction system provided by this invention. The knowledge graph-based railway network security operation knowledge base construction system described below can be referred to in correspondence with the knowledge graph-based railway network security operation knowledge base construction method described above.

[0053] Figure 2 This diagram illustrates the structure of a knowledge graph-based railway network security operation knowledge base construction system provided by the present invention. (See attached diagram.) Figure 2 The device includes a construction module 21, an acquisition module 22, an extraction module 23, a fusion module 24, and a generation module 25, wherein: The construction module is used to build a knowledge graph ontology model of railway network security operation knowledge; The data acquisition module is used to collect railway network security operation data that is adapted to the knowledge graph ontology model. The extraction module is used to extract the entity set, entity attributes and entity relationships contained in the knowledge graph ontology model from the collected railway network security operation data, forming the structured expression content of the knowledge graph; The fusion module is used to fuse the structured representation of the knowledge graph to obtain fused data of the knowledge graph. The generation module is used to generate a cybersecurity operations knowledge graph knowledge base based on the fused data from the knowledge graph.

[0054] Since the apparatus of this embodiment is based on the same principle as the method of the above embodiment, more detailed explanations will not be repeated here.

[0055] It should be noted that, in the embodiments of the present invention, the relevant functional modules can be implemented by a hardware processor.

[0056] The railway network security operation knowledge base construction system provided by this invention constructs a knowledge graph ontology model of railway network security operation knowledge, collects railway network security operation data adapted to the knowledge graph ontology model, extracts entity sets, entity attributes, and entity relationships contained in the adapted knowledge graph ontology model from the collected railway network security operation data, forms the structured expression content of the knowledge graph, performs knowledge fusion on the structured expression content of the knowledge graph to obtain fused knowledge graph data, and generates a network security operation knowledge graph knowledge base based on the fused knowledge graph data, which can improve the knowledge accumulation and application capabilities in the process of railway network security operation.

[0057] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include: a processor 31, a communication interface 32, a memory 33, and a communication bus 34. The processor 31, communication interface 32, and memory 33 communicate with each other via the communication bus 34. The processor 31 can call logical instructions in the memory 33 to execute a knowledge graph-based railway network security operation knowledge base construction method. This method includes: Construct a knowledge graph ontology model of railway network security operation knowledge; collect railway network security operation data adapted to the knowledge graph ontology model; extract entity sets, entity attributes, and entity relationships contained in the adapted knowledge graph ontology model from the collected railway network security operation data to form the structured expression content of the knowledge graph; perform knowledge fusion on the structured expression content of the knowledge graph to obtain fused data of the knowledge graph; generate a network security operation knowledge graph knowledge base based on the fused data of the knowledge graph.

[0058] Furthermore, the logical instructions in the aforementioned memory 33 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0059] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute a method for constructing a railway network security operation knowledge base based on a knowledge graph, the method including: Construct a knowledge graph ontology model of railway network security operation knowledge; collect railway network security operation data adapted to the knowledge graph ontology model; extract entity sets, entity attributes, and entity relationships contained in the adapted knowledge graph ontology model from the collected railway network security operation data to form the structured expression content of the knowledge graph; perform knowledge fusion on the structured expression content of the knowledge graph to obtain fused data of the knowledge graph; generate a network security operation knowledge graph knowledge base based on the fused data of the knowledge graph.

[0060] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform a method for constructing a knowledge base for railway network security operation based on a knowledge graph, the method comprising: Construct a knowledge graph ontology model of railway network security operation knowledge; collect railway network security operation data adapted to the knowledge graph ontology model; extract entity sets, entity attributes, and entity relationships contained in the adapted knowledge graph ontology model from the collected railway network security operation data to form the structured expression content of the knowledge graph; perform knowledge fusion on the structured expression content of the knowledge graph to obtain fused data of the knowledge graph; generate a network security operation knowledge graph knowledge base based on the fused data of the knowledge graph.

[0061] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0062] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0063] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing a knowledge graph-based railway network security operation knowledge base, characterized in that, The application relates to a method for constructing a knowledge graph ontology model of railway network security operation knowledge. The method comprises the following steps: constructing a knowledge graph ontology model of railway network security operation knowledge; collecting railway network security operation data suitable for the knowledge graph ontology model; extracting an entity set, entity attributes and entity relationships contained in the knowledge graph ontology model from the collected railway network security operation data to form a structured expression content of the knowledge graph; performing knowledge fusion on the structured expression content of the knowledge graph to obtain fusion data of the knowledge graph; 2.The knowledge graph-based railway network security operation knowledge base construction method according to claim 1, characterized in that, generating a network security operation knowledge graph knowledge base according to the fusion data of the knowledge graph. The method for constructing a knowledge graph ontology model of railway network security operation knowledge comprises the following steps: determining entity objects according to business links and work contents in railway network security operation work, constructing an entity set, entity attributes and entity relationships to form a subjective ontology model; extracting an entity set, entity attributes and entity relationships from historical railway network security scene data to form an objective ontology model; 3.The knowledge graph-based railway network security operation knowledge base construction method of claim 2, characterized in that, auditing and comparing the subjective ontology model and the objective ontology model to form a knowledge graph ontology model. The railway network security operation data comprises structured data, and correspondingly, the extraction of an entity set, entity attributes and entity relationships contained in the knowledge graph ontology model from the collected railway network security operation data to form a structured expression content of the knowledge graph comprises the following steps: constructing a data mapping system, analyzing a structured data table, extracting metadata information of the structured data, wherein the metadata information comprises a table name, a field name and a field type; the table name corresponds to an entity type, the field name corresponds to an attribute of an entity, and each row of data represents an entity instance; reading each row of records in the table to extract a specific entity object; mapping columns and values in the data table into entity attributes and attribute values; identifying the relationships between different entity types by using inter-table primary-foreign key relationships or multi-table joint query logic, and determining the direction and type of the relationships; 4. The knowledge graph-based railway network safe operation knowledge base construction method according to claim 3, characterized in that, organizing the extracted entities, attributes and relationships according to a triple: subject-predicate-object to form the structured expression content. The railway network security operation data comprises unstructured data, and correspondingly, the extraction of an entity set, entity attributes and entity relationships contained in the knowledge graph ontology model from the collected railway network security operation data to form a structured expression content of the knowledge graph comprises the following steps: 5.The knowledge graph-based railway network security operation knowledge base construction method according to claim 4, characterized in that, adopting a deep learning method to analyze and process the unstructured data of the railway network security operation data, extract an entity set, entity attributes and entity relationships, and organize the extracted entities, attributes and relationships according to a triple: subject-predicate-object to form the structured expression content. The method for performing knowledge fusion on the structured expression content of the knowledge graph to obtain fusion data of the knowledge graph comprises the following steps: fusing and aligning the processed structured expression content of the knowledge graph, and merging the same entities, attributes and relationships; identifying and processing the differential data: for the structured expression content formed by the structured data, identifying and normalizing tables describing the same object in multiple data tables, and uniformly mapping the tables to the same entity type. The structured expression content formed according to the unstructured data is fused and aligned based on the similarity of the entity set. 6.The knowledge graph-based railway network security operation knowledge base construction method according to claim 5, characterized in that, The network security operation knowledge graph knowledge base is generated according to the fused data of the knowledge graph, and includes: The distributed storage and retrieval scheme is adopted to operate the fused data of the knowledge graph; the fused data of the knowledge graph is divided into data fragments according to the hash fragmentation strategy, and each data fragment is stored in an independent storage node; the global entity index and the relationship index are constructed, the index fragments are formed according to the index information, the index fragments are distributed and deployed on the storage nodes and are periodically synchronized; the network security operation knowledge graph knowledge base is formed through the cooperative distribution of the index fragments and the data fragments.

7. The knowledge graph-based railway network safe operation knowledge base construction method according to claim 1 or 6, characterized in that, The method further includes: Knowledge retrieval, knowledge statistics and knowledge graph maintenance are performed according to the network security operation knowledge graph knowledge base; the knowledge retrieval is used to quickly query the required knowledge information in the railway network security operation command process; the knowledge statistics are used to statistically know the number of knowledge in the multi-dimensional personalized knowledge spectrum; and the knowledge graph maintenance is used to support the addition, editing and deletion of entity information and corresponding knowledge information of the knowledge graph.

8. A knowledge graph-based railway network security operation knowledge base construction system, characterized in that, It includes: A construction module is configured to construct a knowledge graph ontology model of railway network security operation knowledge; A collection module is configured to collect railway network security operation data adapted to the knowledge graph ontology model; An extraction module is configured to extract an entity set, entity attributes and entity relationships contained in the knowledge graph ontology model from the collected railway network security operation data, to form structured expression content of the knowledge graph; A fusion module is configured to fuse the structured expression content of the knowledge graph to obtain fused data of the knowledge graph; A generation module is configured to generate a network security operation knowledge graph knowledge base according to the fused data of the knowledge graph.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the knowledge graph-based railway network security operation knowledge base construction method according to any one of claims 1-7 when executing the program. 10.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program implements the knowledge graph-based railway network security operation knowledge base construction method according to any one of claims 1-7 when executed by the processor.

Images