Network vulnerability reconnaissance method and device based on knowledge graph

Abstract

The invention provides a network vulnerability reconnaissance method and device based on a knowledge graph, and relates to the technical field of knowledge graphs, and the method comprises the steps: collecting a multi-source network vulnerability data set, and constructing a network vulnerability knowledge graph; scanning a target network to obtain network operation information, and mapping the network operation information to the network vulnerability knowledge graph for traversal matching to obtain a matched network vulnerability graph; performing vulnerability rule extraction and inference analysis training by using a graph neural network to generate a network vulnerability inference network model; and performing vulnerability reconnaissance reasoning on the matched network vulnerability graph, outputting target network vulnerability information, performing simulation verification, and determining a network vulnerability reconnaissance result. Through the vulnerability detection method and device, the technical problem that vulnerability detection efficiency is affected due to the fact that data islands and vulnerability information lack context association, vulnerability priority ranking is seriously misaligned and attack paths cannot be automatically recognized in the prior art is solved, and the vulnerability detection accuracy and efficiency are improved by constructing the knowledge graph and introducing the graph neural network.

Description

Technical Field

[0001] This application relates to the field of knowledge graph technology, specifically to a network vulnerability detection method and apparatus based on knowledge graphs. Background Technology

[0002] Currently, existing network vulnerability reconnaissance methods rely on a combination of automated scanning tools and manual analysis. They generate isolated vulnerability lists through periodic scanning and prioritize them based on a common vulnerability scoring module. However, critical elements such as vulnerability data, asset information, and network topology exist in isolated data silos, resulting in a severe lack of network environment and business context in vulnerability analysis. Furthermore, relying on personal experience for manual data correlation and risk assessment is not only inefficient but also makes it difficult to accurately identify complex attack paths across vulnerabilities. Consequently, truly critical risks are often drowned out by a massive number of medium- to high-risk vulnerability alerts. The inability to establish intrinsic connections between multiple sources of elements such as vulnerabilities, assets, and attack techniques leads to inaccurate vulnerability prioritization and difficulty in automatically identifying attack chains. This restricts the overall efficiency of vulnerability detection and response, leaving security protection in a reactive state and unable to cope with increasingly complex and covert network attack threats.

[0003] In summary, existing technologies suffer from technical problems such as inaccurate vulnerability prioritization and the inability to automatically identify attack paths due to data silos and a lack of contextual association between vulnerability information, which in turn affects vulnerability detection efficiency. Summary of the Invention

[0004] The purpose of this application is to provide a network vulnerability reconnaissance method and apparatus based on knowledge graphs, in order to solve the technical problems in the prior art where data silos and lack of contextual association of vulnerability information lead to serious inaccuracies in vulnerability priority ranking and the inability to automatically identify attack paths, thereby affecting the efficiency of vulnerability detection.

[0005] To achieve the above objectives, this application provides a network vulnerability reconnaissance method and apparatus based on knowledge graphs.

[0006] Firstly, this application provides a knowledge graph-based network vulnerability reconnaissance method, implemented through a knowledge graph-based network vulnerability reconnaissance device. The method includes: collecting a multi-source network vulnerability dataset; standardizing and extracting and fusing knowledge from the dataset to construct a network vulnerability knowledge graph; scanning a target network to obtain network operation information; mapping the network operation information to the network vulnerability knowledge graph for traversal and matching to obtain a matching network vulnerability graph; using a graph neural network to train the network vulnerability knowledge graph for vulnerability rule extraction and inference analysis to generate a network vulnerability inference network model; performing vulnerability reconnaissance inference on the matching network vulnerability graph based on the network vulnerability inference network model, outputting target network vulnerability information, and simulating and verifying the target network vulnerability information to determine the network vulnerability reconnaissance result.

[0007] Optionally, a data standardization processing procedure is constructed, which includes deduplication, missing value handling, outlier correction, format normalization, and data alignment. The multi-source network vulnerability dataset is standardized according to the data standardization processing procedure to obtain a usable network vulnerability dataset. A knowledge graph pattern is designed, which includes entity type definition, relation type definition, and knowledge attribute definition. Based on the knowledge graph pattern, knowledge extraction and fusion are performed on the usable network vulnerability dataset to construct a network vulnerability knowledge graph.

[0008] Optionally, entity recognition is performed on the available network vulnerability dataset based on the knowledge graph pattern to obtain a set of network vulnerability knowledge entities; relationships and attributes are extracted from the set of network vulnerability knowledge entities to obtain a set of network vulnerability entity relationships and a set of network vulnerability knowledge attributes; graph knowledge fusion is performed on the set of network vulnerability entity relationships and the set of network vulnerability knowledge attributes to obtain an initial vulnerability knowledge graph; conflict identification and verification correction are performed on the initial vulnerability knowledge graph to construct the network vulnerability knowledge graph.

[0009] Optionally, a real-time monitoring mechanism is introduced to obtain network vulnerability update data, and the network vulnerability update data is preprocessed to obtain network vulnerability update knowledge; based on the network vulnerability update knowledge, the network vulnerability knowledge graph is incrementally detected, corrected, and dynamically expanded and updated.

[0010] Optionally, key features are extracted from the network operation information to obtain a key feature set for network operation, which includes network topology, host information, running services, applications, and traffic characteristics; based on the key feature set for network operation, fuzzy matching is performed within the network vulnerability knowledge graph to obtain a matching network vulnerability knowledge set; a subset of the graph is extracted from the network vulnerability knowledge graph according to the matching network vulnerability knowledge set to obtain the matching network vulnerability graph.

[0011] Optionally, the network vulnerability knowledge graph is traversed to mine, filter, and merge vulnerability rules to obtain a set of network vulnerability pattern rules; the set of network vulnerability pattern rules is analyzed and identified to determine a set of network vulnerability pattern inference paths; and a graph neural network is used to train, evaluate, and optimize the set of network vulnerability pattern inference paths to generate a network vulnerability inference network model.

[0012] Optionally, static path extraction is performed on each pattern rule in the network vulnerability pattern rule set to obtain a vulnerability pattern rule subgraph path set; dynamic path simulation is performed on the vulnerability pattern rule subgraph path set to verify and record the rule subgraph path feasibility coefficient set; and reasoning path filtering and key node and edge identification are performed on the vulnerability pattern rule subgraph path set according to the rule subgraph path feasibility coefficient set to determine the network vulnerability pattern reasoning path set.

[0013] Optionally, a vulnerability inference task list is constructed, and the network vulnerability pattern inference path set is labeled according to the vulnerability inference task list to obtain a network vulnerability inference path task sample set; a graph neural network is used to perform inference training, fusion, evaluation and optimization on the network vulnerability inference path task sample set to generate the network vulnerability inference network model.

[0014] Optionally, based on the target network and the target network vulnerability information, a vulnerability simulation attack environment is built; based on the vulnerability simulation attack environment, attack tests and confidence assessments are performed on the target network vulnerability information to determine the network vulnerability reconnaissance results.

[0015] Secondly, this application also provides a knowledge graph-based network vulnerability reconnaissance device for executing the knowledge graph-based network vulnerability reconnaissance method as described in the first aspect. The knowledge graph-based network vulnerability reconnaissance device comprises: a knowledge extraction and fusion module for collecting multi-source network vulnerability datasets, standardizing and extracting and fusing knowledge from the multi-source network vulnerability datasets to construct a network vulnerability knowledge graph; a traversal and matching module for scanning a target network to obtain network operation information, mapping the network operation information to the network vulnerability knowledge graph for traversal and matching, and obtaining a matched network vulnerability graph; a reasoning and analysis training module for using a graph neural network to perform vulnerability rule extraction and reasoning analysis training on the network vulnerability knowledge graph to generate a network vulnerability reasoning network model; and a simulation and verification module for performing vulnerability reconnaissance reasoning on the matched network vulnerability graph based on the network vulnerability reasoning network model, outputting target network vulnerability information, simulating and verifying the target network vulnerability information, and determining the network vulnerability reconnaissance result.

[0016] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0017] By collecting multi-source network vulnerability datasets, standardizing and extracting knowledge from these datasets, and fusing them to construct a network vulnerability knowledge graph, a network vulnerability knowledge graph is constructed. Target networks are scanned to obtain network operation information, which is then mapped to the network vulnerability knowledge graph for traversal and matching, resulting in a matched network vulnerability graph. A graph neural network is used to train the network vulnerability knowledge graph for vulnerability rule extraction and inference analysis, generating a network vulnerability inference network model. Based on this inference network model, vulnerability detection and inference are performed on the matched network vulnerability graph, outputting target network vulnerability information. The target network vulnerability information is then simulated and verified to determine the network vulnerability detection results. In other words, by constructing a network vulnerability knowledge graph, traversing and matching based on the target network's operation information, using a graph neural network to train the network vulnerability knowledge graph for vulnerability rule extraction and inference analysis, and using the generated inference network model to perform vulnerability detection and inference on the matched network vulnerability graph, the accuracy of the network vulnerability detection results is determined through simulation and verification, thus improving the accuracy and efficiency of vulnerability detection.

[0018] The above description is merely an overview of the technical solution of this application. To better understand the technical means of this application and to facilitate its implementation according to the description, and to make the above and other objects, features, and advantages of this application more apparent, specific embodiments of this application are described below. It should be understood that the content described in this section is not intended to identify key or important features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent through the following description. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the knowledge graph-based network vulnerability detection method of this application.

[0021] Figure 2 This is a schematic diagram of the network vulnerability reconnaissance device based on knowledge graphs in this application.

[0022] Figure labeling: Knowledge extraction and fusion module 11, traversal and matching module 12, reasoning analysis and training module 13, simulation and verification module 14. Detailed Implementation

[0023] This application provides a knowledge graph-based network vulnerability detection method and apparatus, addressing the technical problems in existing technologies where data silos and a lack of contextual association between vulnerability information lead to inaccurate vulnerability prioritization and the inability to automatically identify attack paths, thus affecting vulnerability detection efficiency. By introducing a degraded image-text multimodal large model to extract degradation features and performing multi-level interactive reconstruction with an image restoration network, high-quality correction and restoration of multiple degraded images can be achieved without distinguishing between degradation types, thereby improving image restoration accuracy.

[0024] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. It should be understood that this application is not limited to the exemplary embodiments described herein. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application. It should also be noted that, for ease of description, only the parts related to this application are shown in the accompanying drawings, not all of them.

[0025] Example 1, please refer to the appendix. Figure 1 This application provides a knowledge graph-based network vulnerability detection method, wherein the knowledge graph-based network vulnerability detection method is applied to a knowledge graph-based network vulnerability detection device, and the knowledge graph-based network vulnerability detection method specifically includes the following steps:

[0026] Collect multi-source network vulnerability datasets, standardize and extract knowledge from the datasets, and construct a network vulnerability knowledge graph.

[0027] Furthermore, this application also includes the following steps: constructing a data standardization processing procedure, which includes deduplication, missing value handling, outlier correction, format normalization, and data alignment; standardizing the multi-source network vulnerability dataset according to the data standardization processing procedure to obtain a usable network vulnerability dataset; designing a knowledge graph pattern, which includes entity type definition, relation type definition, and knowledge attribute definition; and extracting and fusing knowledge from the usable network vulnerability dataset based on the knowledge graph pattern to construct a network vulnerability knowledge graph.

[0028] Furthermore, this application also includes the following steps: performing entity recognition on the available network vulnerability dataset based on the knowledge graph pattern to obtain a set of network vulnerability knowledge entities; extracting relationships and attributes from the set of network vulnerability knowledge entities to obtain a set of network vulnerability entity relationships and a set of network vulnerability knowledge attributes; performing graph knowledge fusion on the set of network vulnerability entity relationships and the set of network vulnerability knowledge attributes to obtain an initial vulnerability knowledge graph; and performing conflict identification and verification correction on the initial vulnerability knowledge graph to construct the network vulnerability knowledge graph.

[0029] Specifically, identify the target sources for data collection, such as public vulnerability databases and security forums, and use data collection tools to collect multi-source network vulnerability datasets, which are collections of raw network security data with different formats and structures obtained from multiple independent sources, including vulnerability scanning tools, asset configuration databases, external threat sources, and network device management platforms.

[0030] A data standardization process is constructed, including deduplication, missing value handling, outlier correction, format normalization, and data alignment. The aim is to cleanse the chaotic, multi-source network vulnerability dataset into a unified, clean, and usable format. Deduplication identifies and merges duplicate records describing the same fact from different data sources; missing value handling fills in or removes empty fields to ensure data integrity; outlier correction identifies and corrects obviously illogical data, such as outlandish version numbers or invalid IP addresses; format normalization converts all data to a unified format, such as converting all date and time to the standard year-month-day-hour-minute-second format, or standardizing all software names to a vendor-product-version number structure; and data alignment unifies different descriptions referring to the same entity from different sources.

[0031] The data standardization process is initiated, similar to an automated data cleaning pipeline. It sequentially performs operations such as deduplication, filling missing values, correcting abnormal data, standardizing data format, and aligning key fields on multi-source network vulnerability datasets, ultimately outputting a high-quality, usable network vulnerability dataset.

[0032] Based on expertise in cybersecurity, a knowledge graph schema was pre-designed, defining the types of entities that can exist in the graph, the types of relationships that can exist between entities, and the attributes that entities and relationships can possess. Entity type definitions specify the categories of nodes in the graph, such as vulnerabilities, assets, software, and attack techniques; relationship type definitions specify the categories of directed edges connecting different entity nodes, such as existing in, running in, and exploiting; knowledge attribute definitions specify the descriptive fields that each entity or relationship possesses, such as severity scores and disclosure times for vulnerability entities.

[0033] Based on the knowledge graph model, knowledge is extracted and fused from available network vulnerability datasets, entity nodes are identified and created, the relationship edges between nodes are established according to the data content, and corresponding attributes are attached to them. Finally, the data is persistently stored in a graph database to complete the construction of a network vulnerability knowledge graph.

[0034] Specifically, based on a predefined knowledge graph pattern, objects belonging to specific entity types are automatically identified and extracted from the available network vulnerability dataset, resulting in a network vulnerability knowledge entity set. This set includes all identified entities, such as all unique vulnerabilities, assets, and software. The relationship extraction module analyzes the context of entity co-occurrence in data records or directly parses predefined relationship fields to establish association chains between entities, forming a network vulnerability entity relationship set. Simultaneously, the attribute extraction module extracts key descriptive information from the data and attaches it to the corresponding entities and relationships, forming a network vulnerability knowledge attribute set. Relationship extraction refers to identifying and defining the semantic connections between entities. For example, from the record that vulnerability Y exists on a host with IP address X, the relationship that asset X exists in vulnerability Y is extracted, constituting a network vulnerability entity relationship set. Attribute extraction refers to obtaining descriptive features of the entity itself or the relationship itself. For example, attributes such as a CVSS score of 9.8 and a disclosure date of October are extracted for the entity vulnerability Y; attributes such as the discovery date of January 15th are extracted for the relationship existence, constituting a network vulnerability knowledge attribute set.

[0035] Entering the knowledge graph fusion stage, based on predefined fusion rules such as IP address matching and hostname fuzzy matching, entities from different sources are merged and linked. This involves fusing the network vulnerability knowledge entity set based on the network vulnerability entity relationship set and the network vulnerability knowledge attribute set, constructing an initial vulnerability knowledge graph of considerable scale. Through logical reasoning and consistency checks, conflicts and anomalies in the initial vulnerability knowledge graph are identified, and correction procedures are invoked. Strategies such as trust source priority are used for automatic or semi-automatic correction, ultimately outputting a high-quality network vulnerability knowledge graph. Conflict identification refers to discovering contradictory information in the initial vulnerability knowledge graph. Verification and correction, based on predefined trust rules or external authoritative data sources, arbitrate and correct identified conflicts to ensure the accuracy and consistency of knowledge in the vulnerability knowledge graph.

[0036] The construction of a network vulnerability knowledge graph provides a rich contextual information base for vulnerability analysis and detection, helping to improve the accuracy and efficiency of vulnerability detection. Through the network vulnerability knowledge graph, the relationships between vulnerabilities can be quickly understood, potential attack paths can be identified, and thus effective risk assessment and protection strategy formulation can be carried out.

[0037] Furthermore, this application also includes the following steps: introducing a real-time monitoring mechanism to obtain network vulnerability update data, performing knowledge preprocessing on the network vulnerability update data to obtain network vulnerability update knowledge; and performing incremental detection correction and dynamic expansion and updating on the network vulnerability knowledge graph based on the network vulnerability update knowledge.

[0038] Specifically, a real-time monitoring mechanism is introduced—a continuously running data acquisition mechanism that continuously monitors and acquires the latest cybersecurity information from internal and external data sources through application programming interfaces (APIs), web crawlers, data stream processing platforms, or message subscriptions, rather than relying on periodic manual imports. Once new data arrives—that is, network vulnerability update data—a data standardization processing procedure is immediately triggered to preprocess the network vulnerability update data, resulting in updated network vulnerability knowledge. Incremental detection and correction are then performed on the network vulnerability knowledge graph, rapidly comparing the updated data with the knowledge graph to accurately identify the parts that need to be changed. Dynamic expansion and updates are then performed, like patching, incorporating confirmed new content into the graph and overwriting old conflicting data with updated data. The entire process is completed within seconds or minutes, thus achieving real-time and accurate network vulnerability update knowledge.

[0039] For example, the real-time monitoring mechanism captures a new record, CVE1, affecting library A, with an initial CVSS score of 9.8, and associates it with attack method T1. This record is parsed and standardized to generate a network vulnerability update knowledge entry: vulnerability entity CVE1, with attributes including a CVSS score of 9.8 and a description: remote code execution vulnerability affecting library A; the relationship is that CVE1 can be exploited in T1. Comparing this new knowledge with the existing knowledge graph reveals that both CVE1 and the fact that CVE1 can be exploited in T1 are entirely new content and there are no conflicts. The CVE1 vulnerability entity node and its relationship with attack method T1 are automatically added to the knowledge graph.

[0040] It endows the network vulnerability knowledge graph with dynamic evolution capabilities and continuous vitality, solves the core problem of static graphs aging and becoming distorted over time, and ensures that the vulnerability information, asset status and threats in the graph can keep pace with the rapidly changing real-world cybersecurity landscape.

[0041] Scan the target network to obtain network operation information, map the network operation information to the network vulnerability knowledge graph for traversal and matching, and obtain the matching network vulnerability graph.

[0042] Furthermore, this application also includes the following steps: extracting key features from the network operation information to obtain a set of key network operation features, the set of key network operation features including network topology, host information, running services, applications, and traffic features; performing traversal fuzzy matching within the network vulnerability knowledge graph based on the set of key network operation features to obtain a set of matching network vulnerability knowledge; and extracting a subset of the graph from the network vulnerability knowledge graph according to the set of matching network vulnerability knowledge to obtain the matching network vulnerability graph.

[0043] Specifically, scanning tasks are carried out by probes deployed on the target network to collect raw network operation information. The target network is the specific network environment that needs to be reconnoitered. It can be the entire office network of a company, a business zone on the cloud, or an isolated R&D test network. The network operation information is raw data reflecting its current real-time operating status, which is obtained through active scanning, such as using port scanning tools, passive traffic analysis, or directly from the target network's management platform. It is usually coarse and unprocessed.

[0044] Key features are extracted from network operation information to obtain a set of key network operation features, including network topology, host information, running services, applications, and traffic characteristics. These key network operation features are a standardized set of extracted features, serving as the fingerprint of the target network. Network topology includes subnetting, gateways, and logical connections between devices; host information includes active IP addresses, MAC addresses, and operating system type and version; running services include open port numbers, service types, service software, and versions; applications include specific business applications deployed on the hosts and their versions; and traffic characteristics include the five-tuple of network sessions (source IP, destination IP, source port, destination port, protocol), communication frequency, and communication behavior with known malicious addresses.

[0045] Fuzzy matching is performed within a network vulnerability knowledge graph based on a set of key network operational features. Using these features as search criteria, the algorithm traverses all nodes in the vast network vulnerability knowledge graph to find entities similar to or related to these features. Fuzzy matching means that 100% precision is not required; minor differences in version numbers or the use of wildcards are tolerated. The resulting network vulnerability knowledge set is a collection of all knowledge fragments related to the target network found through fuzzy matching. It includes all matched vulnerabilities, assets, software, and other entities in the network vulnerability knowledge graph, as well as the relationships between them.

[0046] Based on the matching network vulnerability knowledge set, a subgraph query is performed to crop a subset of the network vulnerability knowledge graph, namely all nodes and the edges connecting the nodes, ultimately generating a matching network vulnerability graph. Through precise projection from general network security knowledge to a specific target network risk view, a highly contextualized and denoised vulnerability relationship graph is automatically generated.

[0047] A network vulnerability inference network model is generated by using a graph neural network to extract vulnerability rules and perform inference analysis on the network vulnerability knowledge graph.

[0048] Furthermore, this application also includes the following steps: traversing the network vulnerability knowledge graph to mine, filter, and merge vulnerability rules to obtain a set of network vulnerability pattern rules; performing inference path analysis and identification on the set of network vulnerability pattern rules to determine a set of network vulnerability pattern inference paths; and using a graph neural network to train, evaluate, and optimize the set of network vulnerability pattern inference paths to generate a network vulnerability inference network model.

[0049] Furthermore, this application also includes the following steps: sequentially extracting static paths from each pattern rule in the network vulnerability pattern rule set to obtain a vulnerability pattern rule subgraph path set; performing dynamic path simulation on the vulnerability pattern rule subgraph path set to verify and record the rule subgraph path feasibility coefficient set; and performing inference path filtering and key node and edge identification on the vulnerability pattern rule subgraph path set according to the rule subgraph path feasibility coefficient set to determine the network vulnerability pattern inference path set.

[0050] Furthermore, this application also includes the following steps: constructing a vulnerability inference task list, labeling the network vulnerability pattern inference path set according to the vulnerability inference task list to obtain a network vulnerability inference path task sample set; and using a graph neural network to perform inference training, fusion, evaluation, and optimization on the network vulnerability inference path task sample set to generate the network vulnerability inference network model.

[0051] Specifically, vulnerability rule mining is performed by traversing the network vulnerability knowledge graph, which automatically identifies frequently occurring entities and relationship patterns that contain specific attack logic. The mined vulnerability rules are then filtered to remove duplicates or invalid rules, and similar rules are merged to obtain a set of network vulnerability pattern rules. Inference path analysis and identification are then performed on this set of rules, identifying possible inference paths for each rule.

[0052] For each rule in the vulnerability pattern rule set, it is transformed from a static association rule into a dynamic, serialized attack step chain. Static path extraction is performed on each pattern rule in the network vulnerability pattern rule set, transforming it from a static association rule into a dynamic, serialized attack step chain, resulting in a vulnerability pattern rule subgraph path set. In the dynamic path simulation phase, penetration testing toolchains or attack simulation engines are used to automatically verify the feasibility of each path and calculate a quantified feasibility coefficient for each, forming a rule subgraph path feasibility coefficient set. In other words, in a simulation environment, such as a sandbox, it automatically verifies whether a static path is truly feasible in reality, checks the smoothness of the connections between steps, such as whether an attacker can actually use the first vulnerability as a springboard to access and exploit the second vulnerability. For each simulated path, a quantified feasibility score, such as a score of 0-1, is given, and the rule subgraph path feasibility coefficient set is recorded. For example, in the experimental sandbox, a vulnerable server and internal network database are deployed. The process involves using CVE2 to gain server privileges → performing a port scan of the internal network from that server → discovering the database service → attempting to connect with a weak password → successfully connecting and exporting data. The simulation is successful, and this path is assigned a feasibility coefficient of 0.95, a high score, because it is stable and the weak password is easily broken. This coefficient is added to the rule subgraph path feasibility coefficient set.

[0053] Based on the feasibility coefficients of the rule subgraph path feasibility coefficient set, the inference path set of the vulnerability pattern rule subgraph path set is filtered, retaining paths with feasibility coefficients greater than a preset threshold, such as only retaining paths with feasibility coefficients higher than 0.7. Graph algorithms are used to identify the most critical nodes and edges in the paths, ultimately outputting a set of network vulnerability pattern inference paths. Based on the feasibility coefficients, unsuitable paths are filtered out, and the key attack steps (i.e., key nodes, such as an easily exploitable high-privilege vulnerability) and key dependencies (i.e., key edges, such as a network connection that allows lateral movement) are identified in the retained high-feasibility paths.

[0054] By linking scattered knowledge points into a logical and causal attack chain, and verifying the feasibility of the attack chain knowledge through dynamic simulation, the final set of network vulnerability pattern reasoning paths is no longer based on empirical guesses, but on high-quality offensive security knowledge based on data mining and experimental verification.

[0055] Construct a vulnerability reasoning task list to clarify the skills required for building a network vulnerability reasoning model. The vulnerability reasoning task list is a list containing vulnerability reasoning tasks, each representing a vulnerability reasoning problem or objective. The set of network vulnerability pattern reasoning paths is then task-labeled according to the vulnerability reasoning task list, that is, each path, node, or edge in the set of network vulnerability pattern reasoning paths is labeled accordingly. The set of network vulnerability reasoning path task samples is a dataset obtained after task labeling, where each sample includes input data and expected output, i.e., the task and its corresponding label.

[0056] A graph neural network is constructed to train and fuse data on a set of network vulnerability inference path task samples. Predictions are calculated via forward propagation, and the difference between the predicted values ​​and the true labels is calculated using a loss function. Parameters are continuously optimized using a backpropagation algorithm, gradually learning to solve various tasks in the list. During training, independent validation sets are used for evaluation and optimization to ensure the quality of the network vulnerability inference model. This model encapsulates attack patterns and inference logic learned from a network vulnerability knowledge graph, enabling intelligent analysis of an unseen target network vulnerability graph.

[0057] Based on the network vulnerability inference network model, vulnerability reconnaissance and inference are performed on the matched network vulnerability map, target network vulnerability information is output, the target network vulnerability information is simulated and verified, and the network vulnerability reconnaissance results are determined.

[0058] Furthermore, this application also includes the following steps: building a vulnerability simulation attack environment based on the target network and the target network vulnerability information; performing attack testing and confidence assessment on the target network vulnerability information based on the vulnerability simulation attack environment, and determining the network vulnerability reconnaissance results.

[0059] Specifically, the vulnerability inference network model performs vulnerability reconnaissance and inference on the matched network vulnerability graph. This involves inputting the matched network vulnerability graph into the pre-trained network vulnerability inference network model. The model, through its internal graph neural network structure, performs forward propagation calculations on the matched network vulnerability graph and outputs intelligent inference conclusions, i.e., target network vulnerability information. In other words, the network vulnerability inference network model traverses and analyzes the nodes and edges in the matched network vulnerability graph to identify potential vulnerability patterns. Target network vulnerability information refers to the vulnerability information existing in the target network, including predicted attack paths, vulnerability exploitation sequences, key weaknesses, and risk quantification scores.

[0060] Based on the target network's blueprint and vulnerability information, a vulnerability simulation attack environment containing the same key characteristics is rapidly constructed in a sandbox. This simulated network attack environment is used to verify and test vulnerabilities in the target network. Attack tests are then conducted on the target network's vulnerability information within this simulated attack environment. An automated penetration testing tool, following the target network vulnerability information output by the network vulnerability inference model, executes realistic attack operations step-by-step to empirically verify the feasibility of the attack paths, recording the success or failure of each step. Based on the attack test results, a confidence score is calculated for each predicted path. If a predicted path is successfully verified in the simulation environment, its confidence score is increased; if verification fails, it is decreased. The overall confidence score reflects the model's accuracy in this reconnaissance mission.

[0061] Through attack testing and confidence assessment, the final network vulnerability reconnaissance results are formed, clearly identifying which vulnerabilities and attack paths are real, exploitable, high-risk threats, accompanied by corresponding evidence and confidence levels. For example, the target network vulnerability information includes the predicted attack path: Internet → Exploit CVE3 → Server → Exploit Weak Password → Database Server. The key weaknesses are the initial entry point of CVE3 and the final breach via a weak database password. The path risk value is 95 / 100. Successful exploitation of CVE3 on the web server grants privileges; a successful attempt to connect to the database using a weak password on the server allows login and data export. Because the attack path is completely reproduced, the confidence level for this path is assessed as high, quantified as 98%.

[0062] By conducting field verification of inference results in a highly simulated environment, the reliability and credibility of reconnaissance results are enhanced, transforming the output from a potential risk into a verified threat. This provides precise guidance for adjusting vulnerability remediation and protection strategies, thereby enabling limited security resources to be invested in combating the most lethal threats, fundamentally improving the efficiency and maturity of security operations.

[0063] In summary, the knowledge graph-based network vulnerability reconnaissance method provided in this application has the following technical effects:

[0064] By collecting multi-source network vulnerability datasets, standardizing and extracting knowledge from these datasets, and fusing them to construct a network vulnerability knowledge graph, a network vulnerability knowledge graph is constructed. Target networks are scanned to obtain network operation information, which is then mapped to the network vulnerability knowledge graph for traversal and matching, resulting in a matched network vulnerability graph. A graph neural network is used to train the network vulnerability knowledge graph for vulnerability rule extraction and inference analysis, generating a network vulnerability inference network model. Based on this inference network model, vulnerability detection and inference are performed on the matched network vulnerability graph, outputting target network vulnerability information. The target network vulnerability information is then simulated and verified to determine the network vulnerability detection results. In other words, by constructing a network vulnerability knowledge graph, traversing and matching based on the target network's operation information, using a graph neural network to train the network vulnerability knowledge graph for vulnerability rule extraction and inference analysis, and using the generated inference network model to perform vulnerability detection and inference on the matched network vulnerability graph, the accuracy of the network vulnerability detection results is determined through simulation and verification, thus improving the accuracy and efficiency of vulnerability detection.

[0065] Example 2: Based on the same inventive concept as the knowledge graph-based network vulnerability reconnaissance method in Example 1, this application also provides a knowledge graph-based network vulnerability reconnaissance device. Please refer to the appendix. Figure 2 The knowledge graph-based network vulnerability detection device includes:

[0066] The knowledge extraction and fusion module 11 is used to collect multi-source network vulnerability datasets, perform standardization processing and knowledge extraction and fusion on the multi-source network vulnerability datasets, and construct a network vulnerability knowledge graph; the traversal and matching module 12 is used to scan the target network to obtain network operation information, map the network operation information to the network vulnerability knowledge graph for traversal and matching, and obtain a matched network vulnerability graph; the reasoning analysis and training module 13 is used to use a graph neural network to perform vulnerability rule extraction and reasoning analysis training on the network vulnerability knowledge graph, and generate a network vulnerability reasoning network model; the simulation and verification module 14 is used to perform vulnerability reconnaissance reasoning on the matched network vulnerability graph based on the network vulnerability reasoning network model, output target network vulnerability information, perform simulation verification on the target network vulnerability information, and determine the network vulnerability reconnaissance results.

[0067] Furthermore, the knowledge extraction and fusion module 11 in the knowledge graph-based network vulnerability reconnaissance device is also used for: constructing a data standardization processing procedure, which includes deduplication, missing value processing, outlier correction, format normalization, and data alignment; standardizing the multi-source network vulnerability dataset according to the data standardization processing procedure to obtain a usable network vulnerability dataset; designing a knowledge graph pattern, which includes entity type definition, relation type definition, and knowledge attribute definition; and extracting and fusing knowledge from the usable network vulnerability dataset based on the knowledge graph pattern to construct a network vulnerability knowledge graph.

[0068] Furthermore, the knowledge extraction and fusion module 11 in the knowledge graph-based network vulnerability reconnaissance device is also used for: performing entity recognition on the available network vulnerability dataset based on the knowledge graph pattern to obtain a set of network vulnerability knowledge entities; extracting relationships and attributes from the set of network vulnerability knowledge entities to obtain a set of network vulnerability entity relationships and a set of network vulnerability knowledge attributes; performing graph knowledge fusion on the set of network vulnerability entity relationships and the set of network vulnerability knowledge attributes to obtain an initial vulnerability knowledge graph; and performing conflict identification and verification correction on the initial vulnerability knowledge graph to construct the network vulnerability knowledge graph.

[0069] Furthermore, the knowledge extraction and fusion module 11 in the knowledge graph-based network vulnerability reconnaissance device is also used to: introduce a real-time monitoring mechanism to obtain network vulnerability update data, perform knowledge preprocessing on the network vulnerability update data to obtain network vulnerability update knowledge; and perform incremental detection correction and dynamic expansion and update on the network vulnerability knowledge graph based on the network vulnerability update knowledge.

[0070] Furthermore, the traversal matching module 12 in the knowledge graph-based network vulnerability reconnaissance device is also used for: extracting key features from the network operation information to obtain a set of key network operation features, which includes network topology, host information, running services, applications, and traffic features; performing traversal fuzzy matching within the network vulnerability knowledge graph based on the set of key network operation features to obtain a set of matching network vulnerability knowledge; and extracting a subset of the graph from the network vulnerability knowledge graph according to the set of matching network vulnerability knowledge to obtain the matching network vulnerability graph.

[0071] Furthermore, the reasoning analysis training module 13 in the knowledge graph-based network vulnerability reconnaissance device is also used to: traverse the network vulnerability knowledge graph to mine and filter and merge vulnerability rules to obtain a set of network vulnerability pattern rules; perform reasoning path analysis and identification on the set of network vulnerability pattern rules to determine a set of network vulnerability pattern reasoning paths; and use a graph neural network to train and evaluate the set of network vulnerability pattern reasoning paths to generate a network vulnerability reasoning network model.

[0072] Furthermore, the reasoning analysis training module 13 in the knowledge graph-based network vulnerability reconnaissance device is also used to: sequentially extract static paths from each pattern rule in the network vulnerability pattern rule set to obtain a vulnerability pattern rule subgraph path set; perform dynamic path simulation on the vulnerability pattern rule subgraph path set to verify and record the rule subgraph path feasibility coefficient set; and perform reasoning path filtering and key node and edge identification on the vulnerability pattern rule subgraph path set according to the rule subgraph path feasibility coefficient set to determine the network vulnerability pattern reasoning path set.

[0073] Furthermore, the reasoning analysis training module 13 in the knowledge graph-based network vulnerability reconnaissance device is also used to: construct a vulnerability reasoning task list, label the network vulnerability pattern reasoning path set according to the vulnerability reasoning task list, and obtain a network vulnerability reasoning path task sample set; use a graph neural network to perform reasoning training fusion and evaluation optimization on the network vulnerability reasoning path task sample set, and generate the network vulnerability reasoning network model.

[0074] Furthermore, the simulation verification module 14 in the knowledge graph-based network vulnerability reconnaissance device is also used to: build a vulnerability simulation attack environment based on the target network and the target network vulnerability information; perform attack testing and verification and confidence assessment on the target network vulnerability information based on the vulnerability simulation attack environment, and determine the network vulnerability reconnaissance result.

[0075] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The knowledge graph-based network vulnerability detection method and specific examples in the aforementioned embodiment one are also applicable to the knowledge graph-based network vulnerability detection device in this embodiment. Through the foregoing detailed description of the knowledge graph-based network vulnerability detection method, those skilled in the art can clearly understand the knowledge graph-based network vulnerability detection device in this embodiment. Therefore, for the sake of brevity, it will not be described in detail here.

[0076] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0077] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of this application and its equivalents, this application also intends to include such modifications and variations.

Claims

1. A network vulnerability detection method based on knowledge graphs, characterized in that, The method includes: Collect multi-source network vulnerability datasets, perform standardization processing and knowledge extraction and fusion on the multi-source network vulnerability datasets, and construct a network vulnerability knowledge graph; Scan the target network to obtain network operation information, map the network operation information to the network vulnerability knowledge graph for traversal and matching, and obtain the matching network vulnerability graph. A network vulnerability inference network model is generated by using a graph neural network to perform vulnerability rule extraction and inference analysis on the network vulnerability knowledge graph. Based on the network vulnerability inference network model, vulnerability reconnaissance and inference are performed on the matched network vulnerability map, target network vulnerability information is output, the target network vulnerability information is simulated and verified, and the network vulnerability reconnaissance results are determined.

2. The network vulnerability detection method based on knowledge graphs as described in claim 1, characterized in that, Constructing a network vulnerability knowledge graph, including: Construct a data standardization processing procedure, which includes deduplication, missing value handling, outlier correction, format normalization, and data alignment; The multi-source network vulnerability dataset is standardized according to the data standardization processing procedure to obtain a usable network vulnerability dataset. Design a knowledge graph pattern, which includes entity type definition, relation type definition, and knowledge attribute definition; Based on the knowledge graph pattern, knowledge is extracted and fused from the available network vulnerability dataset to construct a network vulnerability knowledge graph.

3. The knowledge graph-based network vulnerability detection method as described in claim 2, characterized in that, Based on the aforementioned knowledge graph pattern, knowledge extraction and fusion are performed on the available network vulnerability dataset to construct a network vulnerability knowledge graph, including: Based on the knowledge graph pattern, entity recognition is performed on the available network vulnerability dataset to obtain a set of network vulnerability knowledge entities. The network vulnerability knowledge entity set is subjected to relation and attribute extraction to obtain the network vulnerability entity relation set and the network vulnerability knowledge attribute set. Based on the network vulnerability entity relationship set and the network vulnerability knowledge attribute set, graph knowledge fusion is performed on the network vulnerability knowledge entity set to obtain an initial vulnerability knowledge graph. The initial vulnerability knowledge graph is subjected to conflict identification and verification correction to construct the network vulnerability knowledge graph.

4. The network vulnerability detection method based on knowledge graphs as described in claim 1, characterized in that, The obtained network vulnerability map includes: Key features are extracted from the network operation information to obtain a key feature set for network operation, which includes network topology, host information, running services, applications, and traffic characteristics. Based on the key feature set of network operation, a fuzzy matching is performed within the network vulnerability knowledge graph to obtain a matching network vulnerability knowledge set. The matching network vulnerability graph is obtained by extracting a subset of the network vulnerability knowledge graph from the matching network vulnerability knowledge set.

5. The network vulnerability detection method based on knowledge graphs as described in claim 1, characterized in that, Generate a network model for network vulnerability inference, including: The network vulnerability knowledge graph is traversed to mine, filter and merge vulnerability rules to obtain a set of network vulnerability pattern rules. The inference path analysis and identification are performed on the set of network vulnerability pattern rules to determine the set of network vulnerability pattern inference paths; The network vulnerability inference network model is generated by training and evaluating the set of inference paths for the network vulnerability pattern using a graph neural network.

6. The knowledge graph-based network vulnerability detection method as described in claim 5, characterized in that, Determine the set of network vulnerability pattern inference paths, including: Static path extraction is performed on each pattern rule in the network vulnerability pattern rule set in sequence to obtain the vulnerability pattern rule subgraph path set; Dynamic path simulation is performed on the path set of the rule subgraph of the vulnerability pattern to verify and record the set of feasibility coefficients of the rule subgraph path; Based on the set of feasibility coefficients for the rule subgraph paths, the set of inference paths for the vulnerability pattern rule subgraphs is used to filter inference paths and identify key nodes and edges, thereby determining the set of inference paths for the network vulnerability pattern.

7. The knowledge graph-based network vulnerability detection method as described in claim 5, characterized in that, The network vulnerability inference network model is generated by training, evaluating, and optimizing the inference path set of the network vulnerability pattern using a graph neural network, including: Construct a vulnerability inference task list, and label the network vulnerability pattern inference path set according to the vulnerability inference task list to obtain a network vulnerability inference path task sample set. The network vulnerability inference network model is generated by using a graph neural network to train, fuse, evaluate, and optimize the task sample set of the network vulnerability inference path.

8. The network vulnerability detection method based on knowledge graphs as described in claim 1, characterized in that, Determine the results of network vulnerability reconnaissance, including: Based on the target network and its vulnerability information, a vulnerability simulation attack environment is built. Based on the simulated attack environment, attack tests and confidence assessments are conducted on the target network vulnerability information to determine the network vulnerability reconnaissance results.

9. The network vulnerability detection method based on knowledge graphs as described in claim 1, characterized in that, The method further includes: A real-time monitoring mechanism is introduced to obtain network vulnerability update data, and the network vulnerability update data is preprocessed to obtain network vulnerability update knowledge. Based on the network vulnerability update knowledge, the network vulnerability knowledge graph is incrementally detected, corrected, and dynamically expanded and updated.

10. A network vulnerability detection device based on knowledge graphs, characterized in that, The step of implementing the knowledge graph-based network vulnerability reconnaissance method according to any one of claims 1 to 9, wherein the knowledge graph-based network vulnerability reconnaissance device comprises: The knowledge extraction and fusion module is used to collect multi-source network vulnerability datasets, perform standardization processing and knowledge extraction and fusion on the multi-source network vulnerability datasets, and construct a network vulnerability knowledge graph. The traversal matching module is used to scan the target network to obtain network operation information, map the network operation information to the network vulnerability knowledge graph for traversal matching, and obtain the matching network vulnerability graph. The reasoning analysis training module is used to extract vulnerability rules and perform reasoning analysis training on the network vulnerability knowledge graph using a graph neural network to generate a network vulnerability reasoning network model. The simulation verification module is used to perform vulnerability reconnaissance and inference on the matching network vulnerability map based on the network vulnerability inference network model, output target network vulnerability information, perform simulation verification on the target network vulnerability information, and determine the network vulnerability reconnaissance results.

Images