Asset vulnerability positioning method and device based on bilinear semantic analysis

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to an asset vulnerability positioning method and device based on bilinear semantic analysis. The semantic matching model is used for replacing traditional rule matching, the speed and accuracy of asset retrieval in the knowledge graph are improved, rapid asset positioning is achieved, and therefore the problems that abnormal asset positioning is difficult and low in efficiency are solved. And through bilinear interactive representation, a complex semantic relationship is captured, and false alarms are reduced. The method has the ability to understand complex semantic contexts, and adapts to diversified expressions of asset names, aliases and contexts. The method is suitable for mapping knowledge domains of different scales, and can be popularized in multiple scenes such as network security and operation and maintenance management.

Description

Technical Field

[0001] This invention belongs to the field of nuclear power technology, specifically relating to an asset vulnerability location method and apparatus based on bilinear semantic analysis. Background Technology

[0002] In complex network environments, as information systems continue to expand in scale, the types and quantities of assets grow exponentially. Traditional asset management and location methods rely on manual configuration and rule matching, which have the following shortcomings:

[0003] 1. Low positioning efficiency: When retrieving assets in a knowledge graph, it is necessary to rely on relational databases or keyword matching, which makes it difficult to handle complex semantic relationships.

[0004] 2. Poor positioning accuracy: Keyword-based searches cannot distinguish between synonyms and contextual relevance, which can easily lead to mismatches.

[0005] 3. Lack of intelligent semantic understanding capabilities: Existing methods cannot fully utilize the semantic features of entities and relationships in knowledge graphs.

[0006] Therefore, there is an urgent need for a knowledge graph-based rapid location technology that can utilize semantic embedding and bilinear matching mechanisms to improve the efficiency of asset anomaly location and response. Summary of the Invention

[0007] To overcome the problems existing in related technologies, an asset vulnerability location method and device based on bilinear semantic analysis is provided.

[0008] According to one aspect of the embodiments of this disclosure, an asset vulnerability localization method based on bilinear semantic analysis is provided, the method comprising:

[0009] Step 1: Constructing a cybersecurity knowledge graph, which structures asset information, vulnerability information, and attack behaviors in the network environment into a knowledge graph, as shown in the following formula:

[0010] KG={(h,r,t)|h∈E,r∈R,t∈E};

[0011] Where E is the set of entities in the network environment, R is the set of relations in the network environment, and the triple (h,r,t) indicates that the head entity h is associated with the tail entity t through the relation r;

[0012] Step 2: Entity-relation embedding learning. The TransE knowledge graph embedding model, as shown in the following formula, maps high-dimensional discrete entities and relations to a low-dimensional continuous vector space:

[0013] h′+r′≈t′

[0014] Where h′ is the d-dimensional vector of the head entity, r′ is the d-dimensional vector of the relation, and t′ is the d-dimensional vector of the tail entity;

[0015] Step 3: Query-oriented projection fusion, which converts the entities and relationships corresponding to the query conditions for abnormal asset location into vectors to obtain the query-end projection, and converts the candidate assets into vectors as the candidate-end projection;

[0016] Query terminal projection: h proj =f proj (h,r)=tanh(W h ·h+W r ·r+b proj )

[0017] Candidate projection: t proj =g proj (t,r)=tanh(W t ·t+W r ·r+b proj )

[0018] Among them, W h W r , The projected weight matrix is ​​a learnable matrix. It is the bias vector;

[0019] Step 4: Bilinear semantic interaction modeling. Deep semantic interaction is performed between the query projection and the candidate projection, using pointwise convolution as shown in the following formula to determine the interaction vector I:

[0020] I = h proj ⊙t proj ;

[0021] Where ⊙ represents element-wise multiplication, and then I is input into the convolutional network Conv1D using the following formula to obtain the fused feature F:

[0022] F=Conv1D(I=σ(W) conv *I+b conv );

[0023] in, The weights are the kernel weights, and * indicates a one-dimensional convolution operation.

[0024] Step 5: Anomaly score calculation, compressing the high-dimensional interaction features into a scalar anomaly score score(h,r,t):

[0025]

[0026] in, Let b be the weight matrix. outThis is a bias term; the anomaly score is used to measure the degree of abnormal association between the candidate entity and the query. The higher the score, the more likely the candidate asset is to be an abnormal target.

[0027] In one possible implementation, the method further includes: Step Six: Candidate Asset Ranking and Anomaly Location, scoring and ranking all candidate entities to locate the most likely anomalous target:

[0028] Sorting result: S = sort({score(h,r,t)} i )|t i ∈ Candidate entity set});

[0029] Anomaly location:

[0030] In one possible implementation, in step two, the optimized entity and relation embedding vectors are obtained by minimizing the distance loss function between the real triples and the negative samples.

[0031] According to another aspect of the embodiments of this disclosure, an asset vulnerability location device based on bilinear semantic analysis is provided, the device comprising:

[0032] The cybersecurity knowledge graph construction module is used to structure asset information, vulnerability information, and attack behaviors in the network environment into a knowledge graph, as shown in the following formula:

[0033] KG={(h,r,t)|h∈E,r∈R,t∈E};

[0034] Where E is the set of entities in the network environment, R is the set of relations in the network environment, and the triple (h,r,t) indicates that the head entity h is associated with the tail entity t through the relation r;

[0035] The entity-relation embedding learning module is used to map high-dimensional discrete entities and relations to a low-dimensional continuous vector space using the TransE knowledge graph embedding model as shown in the following equation:

[0036] h′+r′≈t′

[0037] Where h′ is the d-dimensional vector of the head entity, r′ is the d-dimensional vector of the relation, and t′ is the d-dimensional vector of the tail entity;

[0038] The query-oriented projection fusion module is used to convert the entities and relationships corresponding to the query conditions for abnormal asset location into vectors to obtain the query-end projection, and to convert candidate assets into vectors as candidate-end projections.

[0039] Query terminal projection: h proj =f proj (h,r)=tanh(W h ·h+Wr ·r+b proj )

[0040] Candidate projection: t proj =g proj (t,r)=tanh(W t ·t+W r ·r+b proj )

[0041] Among them, W h W r , The projected weight matrix is ​​a learnable matrix. It is the bias vector;

[0042] The bilinear semantic interaction modeling module is used to perform deep semantic interaction between the query projection and the candidate projection. It uses pointwise convolution as shown in the following formula to determine the interaction vector I:

[0043] I = h proj ⊙t proj ;

[0044] Where ⊙ represents element-wise multiplication, and then I is input into the convolutional network Conv1D using the following formula to obtain the fused feature F:

[0045] F=Conv1D(I=σ(W) conv *I+b conv );

[0046] in, The weights are the kernel weights, and * indicates a one-dimensional convolution operation.

[0047] The anomaly score calculation module is used to compress high-dimensional interaction features into a scalar anomaly score (h,r,t):

[0048]

[0049] in, Let b be the weight matrix. out This is a bias term; the anomaly score is used to measure the degree of abnormal association between the candidate entity and the query. The higher the score, the more likely the candidate asset is to be an abnormal target.

[0050] According to another aspect of the embodiments of this disclosure, an asset vulnerability location device based on bilinear semantic analysis is provided, the device comprising:

[0051] processor;

[0052] Memory used to store processor-executable instructions;

[0053] The processor is configured to execute the above-described method.

[0054] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, which, when executed by a processor, implement the above-described method.

[0055] The beneficial effects of this disclosure are as follows:

[0056] High efficiency: By using semantic matching models to replace traditional rule matching, the speed and accuracy of asset retrieval in knowledge graphs are improved, enabling rapid asset location and thus solving the problems of difficulty and inefficiency in locating abnormal assets.

[0057] Accuracy: By using bilinear interactive representation, complex semantic relationships are captured, reducing false alarms.

[0058] Intelligent: It has the ability to understand complex semantic contexts and adapt to the diverse expressions of asset names, aliases, and contexts.

[0059] Scalability: Applicable to knowledge graphs of different sizes, and can be promoted in multiple scenarios such as network security and operation and maintenance management. Attached Figure Description

[0060] Figure 1 This is a flowchart illustrating an asset vulnerability localization method based on bilinear semantic analysis according to an exemplary embodiment.

[0061] Figure 2 This is a flowchart illustrating a bilinear semantic matching algorithm according to an exemplary embodiment.

[0062] Figure 3 This is a block diagram illustrating an asset vulnerability location device based on bilinear semantic analysis according to an exemplary embodiment. Detailed Implementation

[0063] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0064] Figure 1 This is a flowchart illustrating an asset vulnerability localization method based on bilinear semantic analysis according to an exemplary embodiment. The method can be executed by a terminal device, which can be a computer, such as a server, desktop computer, or laptop computer. This disclosure does not limit the type of terminal device. Figure 1 As shown, the method includes:

[0065] Step 1: Constructing a cybersecurity knowledge graph, which structures asset information, vulnerability information, and attack behaviors in the network environment into a knowledge graph, as shown in the following formula:

[0066] KG={(h,r,t)|h∈E,r∈R,t∈E};

[0067] E is a set of entities in the network environment (including servers, hosts, network devices, vulnerabilities, attackers, etc.), R is a set of relations in the network environment (including connections, vulnerabilities, attacks, dependencies, etc.), and the triple (h,r,t) indicates that the head entity h is associated with the tail entity t through the relation r.

[0068] As an example of this embodiment, the terminal device can collect asset information, vulnerability information, and related attack behaviors in the network environment, and standardize the collected information. Asset information includes information about servers, hosts, databases, middleware, and network devices; vulnerability information includes publicly available CVE numbers, vulnerability types, and severity levels; attack behaviors include attack sources, attack methods, and attack targets. Subsequently, the standardized asset information, vulnerability information, and related attack behaviors are structured into knowledge graph triples: (h, r, t). Here, h is the head entity, t is the tail entity, and r represents the relationship between entities. This ultimately forms a directed graph containing a set of entities E and a set of relationships R.

[0069] Step 2: Entity-relation embedding learning. The TransE knowledge graph embedding model, as shown in the following formula, maps high-dimensional discrete entities and relations to a low-dimensional continuous vector space:

[0070] h′+r′≈t′

[0071] h′ is the d-dimensional vector of the head entity, r′ is the d-dimensional vector of the relation, and t′ is the d-dimensional vector of the tail entity.

[0072] During training, the optimized entity and relation embedding vectors are obtained by minimizing the distance loss function between the real triples and the negative samples.

[0073] Step 3: Query-oriented projection fusion. When locating abnormal assets, the query conditions for abnormal asset location are input into the model. The entities and relationships corresponding to the query conditions are converted into vectors to obtain the query end projection. The vectors of candidate assets are used as candidate end projections, which can achieve unified vector space alignment between query requirements and candidate entities.

[0074] Query terminal projection: h proj =f proj (h,r)=tanh(W h ·h+W r ·r+b proj )

[0075] Candidate projection: t proj =gproj (t,r)=tanh(W t ·t+W r ·r+b proj )

[0076] Among them W h W r , The projected weight matrix is ​​a learnable matrix. This is the bias vector.

[0077] Step 4: Bilinear semantic interaction modeling, such as Figure 2 As shown, deep semantic interaction is performed on the query projection and the candidate projection. The interaction vector I is determined by pointwise convolution as shown in the following formula, thereby capturing the deep semantic interaction between the query conditions and the candidate entities:

[0078] I = h proj ⊙t proj ;

[0079] Where ⊙ represents element-wise multiplication, and then I is input into the convolutional network Conv1D using the following formula to obtain the fused feature F:

[0080] F=Conv1D(I=σ(W) conv *I+b conv );

[0081] The weights are the kernel weights, and * indicates a one-dimensional convolution operation.

[0082] Step 5: Anomaly score calculation, compressing the high-dimensional interaction features into a scalar anomaly score score(h,r,t):

[0083]

[0084] Let b be the weight matrix. out This is a bias term. The anomaly score measures the degree of abnormal association between the candidate entity and the query; a higher score indicates that the candidate asset is more likely to be an anomalous target.

[0085] Step Six: Candidate Asset Ranking and Anomaly Location. All candidate entities are scored and ranked to locate the most likely anomalous targets.

[0086] Sorting result: S = sort({score(h,r,t)} i )|t i ∈ Candidate entity set});

[0087] Anomaly location:

[0088] Through the above technical approach, this invention can automatically learn the semantic representation of network security assets, accurately and quickly match vulnerability assets, and provide intelligent vulnerability asset location capabilities for network security protection.

[0089] Figure 3 This is a block diagram illustrating an asset vulnerability location apparatus based on bilinear semantic analysis, according to an exemplary embodiment. For example, apparatus 1900 may be provided as a server. (Refer to...) Figure 3 The apparatus 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0090] Device 1900 may also include a power supply component 1926 configured to perform power management of device 1900, a wired or wireless network interface 1950 configured to connect device 1900 to a network, and an input / output (I / O) interface 1958. Device 1900 can operate on an operating system stored in memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or similar.

[0091] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of the device 1900 to perform the above-described method.

[0092] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0093] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0094] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0095] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as C or similar languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0096] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0097] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0098] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0099] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0100] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for locating asset vulnerabilities based on bilinear semantic analysis, characterized in that, The method includes: Step 1: Constructing a cybersecurity knowledge graph, which structures asset information, vulnerability information, and attack behaviors in the network environment into a knowledge graph, as shown in the following formula: KG={(h,r,t)|h∈E,r∈R,t∈E}; Where E is the set of entities in the network environment, R is the set of relations in the network environment, and the triple (h,r,t) indicates that the head entity h is associated with the tail entity t through the relation r; Step 2: Entity-relation embedding learning. The TransE knowledge graph embedding model, as shown in the following formula, maps high-dimensional discrete entities and relations to a low-dimensional continuous vector space: h′+r′≈t′ Where h′ is the d-dimensional vector of the head entity, r′ is the d-dimensional vector of the relation, and t′ is the d-dimensional vector of the tail entity; Step 3: Query-oriented projection fusion, which converts the entities and relationships corresponding to the query conditions for abnormal asset location into vectors to obtain the query-end projection, and converts the candidate assets into vectors as the candidate-end projection; Query terminal projection: h proj =f proj (h,r)=tanh(W h ·h+W r ·r+b proj ) Candidate projection: t proj =g proj (t,r)=tanh(W t ·t+W r ·r+b proj ) in, The projected weight matrix is ​​a learnable matrix. It is the bias vector; Step 4: Bilinear semantic interaction modeling. Deep semantic interaction is performed between the query projection and the candidate projection, using pointwise convolution as shown in the following formula to determine the interaction vector I: I=h proj ⊙t proj ; Where ⊙ represents element-wise multiplication, and then I is input into the convolutional network Conv1D using the following formula to obtain the fused feature F: F=Conv1D(I)=σ(W conv *I+b conv ); in, The weights are the kernel weights, and * indicates a one-dimensional convolution operation. Step 5: Anomaly score calculation, compressing the high-dimensional interaction features into a scalar anomaly score score(h,r,t): in, Let b be the weight matrix. out This is a bias term; the anomaly score is used to measure the degree of abnormal association between the candidate entity and the query. The higher the score, the more likely the candidate asset is to be an abnormal target.

2. The method according to claim 1, characterized in that, The method further includes: Step Six: Candidate Asset Ranking and Anomaly Location, scoring and ranking all candidate entities to locate the most likely anomalous targets: Sorting result: S = sort({score(h,r,t)} i )|t i ∈ Candidate entity set}); Anomaly location:

3. The method according to claim 1, characterized in that, In step two, the optimized entity and relation embedding vectors are obtained by minimizing the distance loss function between the real triples and the negative samples.

4. An asset vulnerability location device based on bilinear semantic analysis, characterized in that, The device includes: The cybersecurity knowledge graph construction module is used to structure asset information, vulnerability information, and attack behaviors in the network environment into a knowledge graph, as shown in the following formula: KG={(h,r,t)|h∈E,r∈R,t∈E}; Where E is the set of entities in the network environment, R is the set of relations in the network environment, and the triple (h,r,t) indicates that the head entity h is associated with the tail entity t through the relation r; The entity-relation embedding learning module is used to map high-dimensional discrete entities and relations to a low-dimensional continuous vector space using the TransE knowledge graph embedding model as shown in the following equation: h′+r′≈t′ Where h′ is the d-dimensional vector of the head entity, r′ is the d-dimensional vector of the relation, and t′ is the d-dimensional vector of the tail entity; The query-oriented projection fusion module is used to convert the entities and relationships corresponding to the query conditions for abnormal asset location into vectors to obtain the query-end projection, and to convert candidate assets into vectors as candidate-end projections. Query terminal projection: h proj =f proj (h,r)=tanh(W h ·h+W r ·r+b proj ) Candidate projection: t proj =g proj (t,r)=tanh(W t ·t+W r ·r+b proj ) in, The projected weight matrix is ​​a learnable matrix. It is the bias vector; The bilinear semantic interaction modeling module is used to perform deep semantic interaction between the query projection and the candidate projection. It uses pointwise convolution as shown in the following formula to determine the interaction vector I: I=h proj ⊙t proj ; Where ⊙ represents element-wise multiplication, and then I is input into the convolutional network Conv1D using the following formula to obtain the fused feature F: F=Conv1D(I)=σ(W conv *I+b conv ); in, The weights are the kernel weights, and * indicates a one-dimensional convolution operation. The anomaly score calculation module is used to compress high-dimensional interaction features into a scalar anomaly score (h,r,t): in, Let b be the weight matrix. out This is a bias term; the anomaly score is used to measure the degree of abnormal association between the candidate entity and the query. The higher the score, the more likely the candidate asset is to be an abnormal target.

5. An asset vulnerability location device based on bilinear semantic analysis, characterized in that, The device includes: processor; Memory used to store processor-executable instructions; The processor is configured to perform the method according to any one of claims 1 to 3.

6. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 3.

Images