Asset visual security management method and system based on knowledge graph

Abstract

The invention relates to the technical field of knowledge maps, and particularly discloses an asset visualization safety management method and system based on a knowledge map. According to the scheme, multi-source asset data and a multi-dimensional relationship thereof are integrated by constructing an asset knowledge graph, a propagation process of a risk on an asset dependency link is simulated based on a graph theory, a potential attack path and a global influence are quantitatively analyzed, and finally asset topology, a risk state and a key attack path are dynamically displayed through a visual interface. The accuracy and the global effectiveness of a safety protection strategy are improved.

Description

Technical Field

[0001] This invention belongs to the field of knowledge graph technology, specifically relating to a knowledge graph-based method and system for asset visualization and security management. Background Technology

[0002] Asset security management is a core aspect of information technology, involving the identification, monitoring, protection, and risk control of various software and hardware resources within an organization. With the deepening of digital transformation, the scale and complexity of enterprise assets are increasing dramatically, and the dependencies between assets are becoming increasingly close, making traditional security management methods based on inventory lists or isolated scans inadequate for dealing with dynamic and interconnected security threats.

[0003] Asset visualization and risk assessment aim to clearly present the overall picture of assets and their interrelationships through technical means, and to quantify security risks. Its goal is to integrate scattered asset information, vulnerability data, business logic, and access relationships to support accurate security decisions.

[0004] Existing technologies typically employ asset databases combined with vulnerability scanning tools to identify security vulnerabilities in individual assets. However, when analyzing risks, existing methods often assess single assets or vulnerabilities in isolation, lacking a holistic review of the complex interdependencies between assets. Current systems cannot effectively quantify the cascading effects of a single risk point on the entire asset dependency chain, making it difficult to accurately assess which upstream or downstream business systems will be directly affected when a critical asset is compromised, and ultimately, how much core data will be at risk of being leaked.

[0005] This lack of assessment capabilities results in a lack of a holistic perspective in the formulation of security protection strategies, making it impossible to prioritize hardening of the most critical potential attack paths, thus exposing weaknesses in the face of complex cyberattacks. Summary of the Invention

[0006] The technical problem this invention aims to solve is to overcome the shortcomings of existing asset security management methods, which view individual assets or vulnerabilities in isolation during risk assessment, failing to quantify the chain reaction of risks in complex asset dependency chains, resulting in a lack of globality and precision in protection strategies. This invention provides an asset visualization security management method and system based on knowledge graphs, aiming to achieve holistic modeling of complex dependencies between assets and accurate quantitative analysis of risk propagation paths.

[0007] This invention provides an asset visualization security management system based on knowledge graphs. The system includes an asset data acquisition and fusion module, a knowledge graph construction and management module, a risk propagation quantitative analysis module, and a visualization decision support module.

[0008] The asset data acquisition and fusion module is used to continuously collect basic asset attribute data, network connection relationship data between assets, business application data carried by assets, and security vulnerability data related to assets from multiple heterogeneous data sources. It also cleans, normalizes, and integrates the collected multi-source data to form a unified asset data view.

[0009] The knowledge graph construction and management module is based on a unified asset data view and uses a graph structure data model to construct an asset knowledge graph. This asset knowledge graph uses asset entities as nodes and physical connections, logical dependencies, data flow relationships, and business affiliation relationships between assets as edges, thereby integrating scattered assets and their multidimensional relationships into a unified, machine-understandable semantic network.

[0010] The risk propagation quantitative analysis module is used to perform graph theory-based risk propagation simulation calculations on top of the asset knowledge graph. This module first assigns an initial risk value to each asset node in the knowledge graph. The initial risk value is calculated based on the severity of the security vulnerabilities discovered on the asset, the importance level of the asset in the business system, and the frequency of recent security incidents on the asset. Furthermore, this module analyzes the dependency strength and access permission level represented by the edges connecting each node in the asset knowledge graph to define the attenuation factor and activation threshold for risk propagation along the edges. Based on the defined propagation rules, this module simulates how risk propagates step by step through the dependency chain between assets when any asset node's risk status exceeds a preset threshold due to a security event, and calculates the final affected risk value of all downstream asset nodes that the risk propagation can reach, as well as assessing the quantitative probability of core data assets facing leakage risks.

[0011] The visualization decision support module is used to dynamically render and display the overall topology of the asset knowledge graph, the real-time risk status of each asset node, and the key attack paths calculated by risk propagation simulation in an interactive graphical interface. This module allows users to gain a global perspective on the overall asset situation, focus on high-risk cluster areas, and provide data support for formulating precise protection strategies.

[0012] As one embodiment of the present invention, the asset data acquisition and fusion module specifically includes a network detection submodule, a configuration management database interface submodule, a vulnerability scanning engine interface submodule, and a data fusion processing submodule.

[0013] The network detection submodule automatically discovers surviving assets and devices in the network environment and identifies their basic network attributes by actively sending detection messages and analyzing responses.

[0014] The configuration management database interface submodule is used to extract detailed configuration information of assets, information of the business systems to which they belong, and information of the maintenance personnel from the organization's existing configuration management database.

[0015] The vulnerability scanning engine interface submodule is used to periodically call external vulnerability scanning tools to perform security scans on target assets and obtain vulnerability information associated with the assets from the scan results.

[0016] The data fusion processing submodule is responsible for parsing, deduplicating, standardizing, and associating the raw data from the above submodules. It ultimately generates data records that include unique asset identifiers, asset types, IP addresses, operating system versions, a list of installed software services, the business unit to which the asset belongs, a list of known vulnerabilities, and the identified network connections between assets, and outputs a unified asset data view.

[0017] Furthermore, in the knowledge graph construction and management module, the specific process of constructing the asset knowledge graph is as follows.

[0018] First, each asset record in the unified asset data view is mapped to a node in the knowledge graph, and the node is assigned the attributes of asset type and business importance level.

[0019] Secondly, analyze the connection relationships between assets recorded in the asset data view, establish physical connection edges between asset nodes that have direct network communication, and assign communication protocol type and port number attributes to these edges.

[0020] Furthermore, by analyzing the call relationships between software services running on the assets, logical dependency edges are established between asset nodes with service-level calls, and these edges are assigned the dependent service name and call frequency attributes.

[0021] In addition, by analyzing the data flow design documents of the business system or monitoring actual network traffic, data flow edges are established between asset nodes with data supply and consumption relationships, and these edges are assigned data sensitivity level and traffic size attributes.

[0022] Finally, asset nodes belonging to the same business application or processing the same core dataset are associated with the same business group node to form a business affiliation relationship.

[0023] Furthermore, the specific steps for the risk propagation quantitative analysis module to perform risk propagation simulation calculations are as follows.

[0024] Step 1: Initialize the risk value of all nodes in the asset knowledge graph. For asset nodes with known high-risk vulnerabilities, the initial risk value is set to a value between 0.8 and 0.95. For asset nodes with medium-risk vulnerabilities, the initial risk value is set to a value between 0.5 and 0.7. For asset nodes with no known vulnerabilities or only low-risk vulnerabilities but critical business importance, the initial risk value is set to a value between 0.3 and 0.4. For other asset nodes, the initial risk value is set to 0.1.

[0025] Step 2: Define risk propagation rules. For each directed edge in the knowledge graph, set propagation weights based on its edge type and attributes. The propagation weights of physical connection edges are adjusted based on whether the connection uses an encryption protocol and whether it crosses a network boundary. The propagation weights of logical dependency edges are adjusted based on the criticality of the service call. The propagation weights of data flow edges are adjusted based on the sensitivity level of the transmitted data.

[0026] Step 3: Start the simulation calculation; select one or more asset nodes with an initial risk value exceeding 0.7 as risk sources, and traverse all reachable downstream nodes according to the breadth-first or depth-first algorithm; during the traversal, the risk value of the current node is multiplied by the propagation weight of the edges traversed to reach the downstream node to obtain the risk increment passed to the downstream node; after receiving the risk increment from all upstream nodes, the downstream node adds it to its own initial risk value. If the total value after addition exceeds the preset risk activation threshold of the node, the node is marked as compromised and continues to propagate the risk to its downstream nodes.

[0027] Step 4: Calculate the global impact. Once the simulation process has stabilized, count all nodes that have been activated under risk conditions, calculate the number of affected business systems, estimate the number and value of core data assets that may be affected, and finally output a quantitative global risk impact report.

[0028] In a preferred embodiment of the present invention, the interactive graphical interface provided by the visualization decision support module supports multiple view modes. The global topology view is used to display the macro layout of the entire asset knowledge graph, and uses color depth and node size to intuitively map the risk level and business importance of assets. The attack path view is used to highlight the shortest or highest probability attack path from the initial risk source to the key core asset, calculated by the risk propagation quantitative analysis module, and to mark the risk value changes at each stage of the path.

[0029] The asset details view is used to display all the attributes of an asset, a list of associated vulnerabilities, and a list of all related upstream and downstream assets in detail in the form of a sidebar or pop-up window when a user clicks on any asset node in the graph.

[0030] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention constructs an asset knowledge graph that integrates multi-source data, combining previously isolated asset information and its complex physical, logical, data, and business relationships into a unified graph structure model, thus laying a data foundation for risk analysis from a global perspective.

[0031] 2. By introducing a graph theory-based quantitative analysis model for risk propagation, the transmission process of risk along the asset dependency chain can be simulated. This allows for the accurate calculation of the scope and impact of the chain reaction that may be triggered by the loss of a single asset, thus achieving a quantitative assessment of potential attack paths.

[0032] 3. This system enables security managers to grasp the asset security situation from a macro perspective, identify critical nodes and vulnerable paths that, if breached, would lead to the greatest business losses, and thus prioritize the allocation of security resources to strengthen the most critical attack paths. This improves the accuracy and overall effectiveness of security protection strategies and effectively addresses interconnected security threats in complex network environments. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the overall technical solution architecture of the knowledge graph-based asset visualization security management method proposed in this invention; Figure 2 This is a schematic diagram of the core principle framework of the asset knowledge graph construction and management module in this invention; Figure 3 This is a logical flow diagram of the risk propagation quantitative analysis module in this invention; Figure 4 This is a schematic diagram of the multi-level interaction relationship and data flow of the asset data acquisition and fusion module in this invention; Figure 5 This is a schematic diagram of the interactive graphical interface principle framework of the visualization decision support module in this invention; Detailed Implementation

[0034] The specific implementation of the knowledge graph-based asset visualization and security management system is described below. Please refer to the appendix. Figure 1 The system's overall architecture consists of four core modules: asset data acquisition and fusion, knowledge graph construction and management, risk propagation quantitative analysis, and visualization decision support. These modules are interconnected through strictly defined data interfaces and processing flows, jointly realizing a full-chain function from raw data acquisition to final risk decision support.

[0035] The asset data acquisition and fusion module is the data entry point and foundation of this system. Please refer to the appendix. Figure 4 This module is specifically implemented by four highly specialized sub-modules working together.

[0036] The network detection submodule actively sends Internet Control Message Protocol (ICP-Request) packets and Transmission Control Protocol (TCP-Synchronization) packets to the target network address space and determines whether the asset or equipment is alive based on the response.

[0037] For surviving devices, this submodule further sends specific protocol probe messages. By analyzing the returned flag information and data packet characteristics, it automatically identifies the device's basic network attributes, including media access control address, Internet protocol address, open transmission control protocol port and user datagram protocol port sequence, as well as the preliminarily determined operating system type and version.

[0038] The network detection submodule is set to perform a full network scan every 6 hours. It compares the asset and device information found in each scan with the results of the previous scan to generate a list of newly added assets and a list of offline assets.

[0039] The configuration management database interface submodule retrieves detailed asset configuration information in batches every 24 hours by calling the application programming interface provided by the organization's existing configuration management database.

[0040] This submodule performs strict field mapping and format conversion during the data extraction process, mapping the original field names in the configuration management database to the standard names of asset attributes defined internally by the system.

[0041] The extracted information includes the asset's unique code in the configuration management database, the asset's hardware model and serial number, the asset's physical location and rack number, the name and code of the business system to which the asset belongs, the name and contact information of the person responsible for asset maintenance, and the names and version numbers of the main software components deployed on the asset.

[0042] The vulnerability scanning engine interface submodule periodically calls external commercial or open-source vulnerability scanning tools according to a preset scanning strategy.

[0043] The scanning policy defines the target range, scanning depth level, scanning activation time window, and authentication credentials.

[0044] After the scanning task is completed, this submodule extracts vulnerability information associated with each target asset by parsing the result file in Extensible Markup Language or JavaScript Object Notation format output by the vulnerability scanning tool.

[0045] The extracted vulnerability information specifically includes the vulnerability's ID in the general vulnerability disclosure database, the vulnerability name and description text, the vulnerability's general vulnerability scoring system score and severity classification, the vulnerability's remediation suggestions and patch number, and the accurate timestamp when the vulnerability was discovered during scanning.

[0046] The data fusion processing submodule is the core data processing engine of the asset data acquisition and fusion module.

[0047] This submodule receives raw data streams from the aforementioned three submodules and executes a multi-stage data processing pipeline.

[0048] The first stage is data parsing and extraction. In this stage, the network detection results, configuration management database records, and vulnerability scan reports are structured and parsed according to predefined templates to extract the standardized data fields required by the system.

[0049] The second stage involves data deduplication and conflict resolution. This stage, based on unique asset identifiers (typically a combination of an Internet Protocol address and a Media Access Control address), merges records of the same asset from different data sources. When inconsistencies exist for the same attribute of the same asset across different data sources, the system determines the final adopted value based on preset data source priority rules, such as prioritizing the configuration management database over network probe results.

[0050] The third stage is data standardization, which maps the parsed non-standard enumeration values, such as Windows and Linux operating system types, to a unified internal encoding. The fourth stage is data association, which establishes links between asset records based on network connectivity and business affiliation relationships between assets.

[0051] Finally, the data fusion processing submodule outputs a unified asset data view, which is stored in the form of database tables. Each record contains a complete set of asset attributes and relationship identifiers.

[0052] The knowledge graph construction and management module is responsible for transforming a unified view of asset data into a machine-understandable semantic network. Please refer to the appendix. Figure 2 The implementation of this module involves a series of rigorous map construction steps.

[0053] First, the node mapping operation is performed. The knowledge graph construction and management module reads each asset record in the unified asset data view and creates a corresponding node entity for each record in the knowledge graph.

[0054] Each node entity is assigned a globally unique node identifier and loaded with a series of attribute key-value pairs.

[0055] These attributes include at least the asset type, which can be a server, network switch, firewall, database instance, etc.; and the business importance level, which is divided into three levels—critical, important, and general—based on the coreness of the business supported by the asset, and quantified as numerical values ​​of 3, 2, and 1.

[0056] Secondly, establish physical connection edges.

[0057] The system analyzes the network connection relationship table recorded in the unified asset data view. For each pair of source assets and target assets that have direct network communication recorded in the table, a directed physical connection edge is established between the corresponding two nodes in the knowledge graph.

[0058] The edge is assigned the edge type attribute as physical connection and records the protocol type used for communication, such as Transmission Control Protocol or User Datagram Protocol, as well as the destination port number.

[0059] Next, establish logical dependency edges. By analyzing the call chain monitoring data between software services deployed on the assets or the topology data of the application performance management system, identify asset pairs with service-level calls.

[0060] For example, a web server asset calls the application programming interface of an application server asset, which in turn calls the query interface of a database server.

[0061] For each pair of assets with a calling relationship, a directed logical dependency edge is established in the knowledge graph from the calling side to the calling side.

[0062] The edge is assigned the edge type attribute as logical dependency and records the name of the dependent service, such as payment service, as well as the average call frequency calculated based on historical monitoring data, in times per minute.

[0063] In addition, data flow edges are established.

[0064] By analyzing the data flow design documents of the business system or the network traffic analysis reports provided by deep packet inspection equipment, assets with clear data supply and consumption relationships can be identified.

[0065] For example, the data acquisition server transmits log files to the data analysis server, and the customer relationship management system reads customer records from the core database. For each pair of assets with a data flow relationship, a directed data flow edge is established in the knowledge graph from the data supplier to the data consumer.

[0066] The edge is assigned the edge type attribute as the data flow direction and records the sensitivity level of the transmitted data, such as public, internal, confidential, top secret, and the average network traffic size over the past 7 days, in megabytes per day. Finally, business attribution relationships are constructed.

[0067] Based on the business system affiliation field in the unified asset data view, the system associates multiple asset nodes that process the same core business function or belong to the same application architecture layer with a virtual business group node. The business group node itself is also a graph node, which has a node type attribute of "business group" and attributes of business name and business value score.

[0068] The knowledge graph construction and management module ultimately maintains a dynamic graph database, such as Neo4j or JanusGraph, to store and index the entire asset knowledge graph.

[0069] This module provides an application programming interface for other modules to query and update map data.

[0070] The risk propagation quantitative analysis module is the core computing engine of the system, responsible for performing graph-based risk propagation simulations on the asset knowledge graph. Please refer to the appendix. Figure 3 The implementation of this module follows a rigorous four-step calculation process.

[0071] Step one is to initialize the risk value.

[0072] The risk propagation quantitative analysis module traverses each asset node in the knowledge graph and calculates its initial risk value based on the security attributes associated with that node.

[0073] The calculation rules are as follows: For an asset node with at least one high-risk vulnerability that scores 9.0 or higher in a general vulnerability scoring system, its initial risk value is set to 0.9.

[0074] For asset nodes that have medium-risk vulnerabilities with a general vulnerability scoring system score between 7.0 and 8.9, but no high-risk vulnerabilities, their initial risk value is set to 0.6.

[0075] For asset nodes that do not have any known medium- or high-risk vulnerabilities, but whose business importance level is critical (i.e., a value of 3), the initial risk value is set to 0.35.

[0076] For other asset nodes that do not have medium or high-risk vulnerabilities and are not critical in terms of business importance, their initial risk value is uniformly set to 0.1.

[0077] Step two is to define the rules for risk propagation.

[0078] This module defines a baseline propagation weight for each edge type in the knowledge graph and allows for dynamic adjustment based on the specific attributes of the edge.

[0079] The baseline propagation weight of the physical connection edge is 0.7.

[0080] If the connection uses an encrypted channel such as a transport layer security protocol or an internet protocol security protocol, its propagation weight is multiplied by an attenuation factor of 0.5.

[0081] If the connection crosses a firewall-isolated network boundary, such as accessing an internal network from a demilitarized zone, its propagation weight is multiplied by a decay factor of 0.3. The baseline propagation weight for logically dependent edges is 0.8.

[0082] If the service call corresponding to the dependency is marked as a critical business link, such as a call to the core payment service, its propagation weight is multiplied by an amplification factor of 1.2.

[0083] The baseline propagation weight for data flow to an edge is 0.9. If the data transmitted by that edge is classified as confidential or top secret, its propagation weight is multiplied by an amplification factor of 1.5.

[0084] Step 3: Initiate the simulation calculation. The system first filters out all asset nodes with an initial risk value exceeding 0.7 from the knowledge graph and marks these nodes as the initial risk source node set.

[0085] Then, a breadth-first search algorithm is used to traverse all reachable downstream nodes in the knowledge graph, starting from each initial risk source node. During the traversal, for each node... to downstream nodes A directed edge Calculate the risk increment. The formula for calculating the risk increment is: ; in, The current node The risk value, It is the edge Final propagation weights after attribute adjustment. Downstream nodes. It is possible to receive risk increments from different upstream nodes through multiple paths.

[0086] node Total risk value The result was obtained through superposition calculation: ; in, This is the initial risk value of node v. It is all that can spread risk to The set of upstream nodes.

[0087] The system presets a risk activation threshold for each asset node, with a default value of 0.6.

[0088] If node Calculated total risk value If the risk activation threshold is exceeded, the node's state is marked as compromised.

[0089] once node It is marked as compromised, and its risk value is... It will be used to continue propagating the risk to its downstream nodes, simulating the chain reaction of the risk.

[0090] Step 4: Calculate the global impact.

[0091] The simulation stops when the process is stable, meaning no new nodes are activated or the preset maximum number of iterations (100) is reached.

[0092] The system counts the number of nodes that are marked as compromised.

[0093] Furthermore, the system locates the business groups affected by these compromised nodes by querying the business affiliation relationships in the knowledge graph, and calculates the number of affected business systems.

[0094] At the same time, the system identifies compromised nodes that store or process core data assets, such as database servers or file servers, and estimates the number of potentially leaked core data records and their estimated commercial value based on a classification and grading list of data assets.

[0095] Finally, the risk propagation quantitative analysis module generates a structured global risk impact report, which includes a list of compromised assets, a list of affected businesses, the probability of core data asset leakage, and several critical attack paths.

[0096] The visualization decision support module is responsible for presenting the analysis results from the aforementioned modules to the security administrator in an intuitive graphical format. Please refer to the appendix. Figure 5 This module is implemented as an interactive graphical interface based on web technology. This interface primarily provides three core view modes.

[0097] The global topology view is the default display mode. In this view, the entire asset knowledge graph is rendered using a force-directed graph layout algorithm. Asset nodes are presented on the canvas, and the size of the nodes is proportional to their business importance level, with key business nodes displayed larger.

[0098] The nodes are colored in a gradient from green to red, directly mapping their current risk value. Green represents low risk (0.1), and red represents high risk (1.0).

[0099] Edges between nodes are represented by lines with arrows, and the thickness of the lines is proportional to the propagation weight of the edges.

[0100] Users can zoom in and out using the mouse wheel and pan the screen by dragging to get a macro-level understanding of the entire asset network's topology and risk distribution. The attack path view is a focused mode.

[0101] Once the risk propagation quantitative analysis module has completed its calculations, users can choose to access this view.

[0102] This view automatically highlights one or more attack paths with the highest risk values, from the initial risk source node to a user-specified key core asset node, such as the core database.

[0103] Each node and edge on the path is labeled and its risk value or propagation weight on that path is displayed. The system also provides a path details panel, which lists all the node sequences traversed by the path and their risk changes in text form.

[0104] The asset details view is a drill-down mode. When a user clicks on any asset node in the global topology view or attack path view, a detailed asset information panel will slide out on the right side of the interface.

[0105] This panel organizes information in tabs. The Basic Information tab displays all the asset's static attributes, such as Internet Protocol address, operating system version, and the business it belongs to.

[0106] The security vulnerability tab lists all known vulnerabilities associated with the asset, including the common vulnerability disclosure number, description, severity level, and remediation status.

[0107] The Relationships tab displays a list of all upstream and downstream assets connected to the current asset, including relationship type and direction. All views in the Visual Decision Support module support real-time updates.

[0108] When the backend data collection and fusion module or the risk propagation quantitative analysis module has new calculation results, the frontend graphical interface will receive the update notification via WebSocket connection and dynamically refresh the corresponding visualization elements to ensure that the administrator always sees the latest security situation.

[0109] Through the precise collaboration of the four modules mentioned above, the system achieves overall modeling of complex asset dependencies and accurate quantification of risk propagation.

[0110] The asset data acquisition and fusion module ensures the comprehensiveness and consistency of the data. The knowledge graph construction and management module provides powerful relationship expression capabilities.

[0111] The risk transmission quantitative analysis module introduces a scientific calculation model.

[0112] The visual decision support module lowers the cognitive threshold for understanding and using the system.

[0113] The entire system is deployed on a server cluster with a highly available architecture. The database and graph database use a master-slave replication mode, and application services employ load balancing to ensure stable operation 24 / 7. System administrators configure the system, schedule scanning tasks, and adjust policies through a management backend with role-based access control.

[0114] This embodiment provides another implementation of the knowledge graph-based asset visualization security management system. Its core architecture and module division are consistent, but it has been deepened and expanded in terms of the real-time nature of data acquisition, the refined definition of graph relationships, and the specific algorithms of the risk propagation model, in order to cope with the ultra-large-scale and highly dynamic network environment.

[0115] In the asset data acquisition and fusion module, this embodiment enhances the processing capability of real-time data streams. In addition to periodic active scanning, the network detection submodule also integrates a real-time network traffic metadata analysis component.

[0116] This component continuously monitors traffic on critical network links through bypass-deployed traffic probes and uses deep packet inspection technology to identify emerging asset communication sessions in real time.

[0117] Any newly detected assets or connections will be sent to the data fusion processing submodule for rapid processing within seconds.

[0118] The configuration management database interface submodule, in addition to batch retrieval, adds the function of listening to the configuration management database change log.

[0119] When any addition, deletion, or modification operation occurs in the asset configuration information in the configuration management database, this submodule can receive event notifications almost in real time and trigger incremental data synchronization, greatly reducing the delay in asset information updates.

[0120] The vulnerability scanning engine interface submodule introduces the concept of continuous vulnerability monitoring and interfaces with next-generation vulnerability management platforms that have continuous scanning capabilities.

[0121] The platform performs non-intrusive continuous monitoring of assets. Once a newly exposed vulnerability is found to match an asset, the information is immediately sent to the system through an event push mechanism, achieving near real-time updates of vulnerability information.

[0122] In the knowledge graph construction and management module, this embodiment provides more refined attribute definitions and weight calculations for the relationship edges between assets. For physical connection edges, in addition to protocols and ports, a connection activity metric is added. This metric is calculated based on the number of data packets on the connection in the past hour and normalized to a value between 0 and 1.

[0123] For logically dependent edges, a dependency health metric is introduced, which is calculated by monitoring the success rate and response time of the call chain.

[0124] If the failure rate of a service call consistently exceeds 5%, the health metric of its corresponding logical dependency edge will decline, thus reflecting its instability in risk propagation. For data flow edges, a data freshness attribute has been added, which records the timestamp of the last successful data transmission and is used to determine the validity of the data flow relationship.

[0125] Furthermore, this embodiment introduces a new edge type: trust relationship edges. These edges are not based on observable network behavior, but are manually configured or generated through a policy learning engine based on security policies and the principles of zero-trust architecture.

[0126] For example, even if two assets are reachable from each other on the network, if security policies prohibit them from communicating, a negative trust relationship edge can be established between them in the knowledge graph, with a propagation weight of a very low 0.1 or even 0, to block the propagation of risk.

[0127] In the risk transmission quantitative analysis module, this embodiment adopts a more complex risk transmission simulation algorithm based on the infection dynamics model to replace the relatively simplified linear superposition model.

[0128] In this model, each asset node is considered a potentially infected individual. The initial risk value of the node... This is considered as its initial infection probability.

[0129] The spread of risk along the edges is no longer simply a matter of multiplying weights, but rather simulates a probabilistic infection process.

[0130] For a node To the node The probability of transmission and infection at the edge. Propagation weight of edges and nodes The inherent vulnerability A joint decision.

[0131] node The inherent vulnerability The value is calculated based on factors such as the number of unpatched vulnerabilities and the strength of security configuration, and ranges from 0 to 1.

[0132] The probability of transmission and infection can be calculated as follows: ; The simulation is performed using a discrete-time stepping method. At each time step, for each node that has not yet been infected... The system calculates all its infected neighbor nodes. The probability of attempting to infect a node by connecting edges. The probability of being infected by at least one neighbor within this time step is: ; Then, the system generates a random number between 0 and 1. If this random number is less than... Then the node At this time step, it is marked as infected, and its risk value is set to 1.0.

[0133] This probability-based model can better simulate the uncertainty of security incidents, such as the randomness of whether an attacker succeeds or fails.

[0134] The simulation will continue for multiple time steps until no new infections occur or the maximum number of time steps is reached.

[0135] The final risk impact assessment not only includes the set of infected nodes, but can also output dynamic indicators such as the speed of risk propagation and the time required to reach a stable state, providing richer decision-making basis for security response.

[0136] This embodiment enhances the spatiotemporal analysis capabilities of the visualization decision support module. A risk propagation time-series animation view has been added. This view can replay the simulation results of the risk propagation quantitative analysis module at multiple time steps, demonstrating in animation how the risk spreads step by step from the initial source node to the entire network, enabling administrators to intuitively understand the dynamic propagation process of the risk.

[0137] In addition, the system also integrates a geographic information system map. If the asset data contains geographic coordinate information, the asset nodes can be rendered on the actual location on the map to achieve geospatial visualization of the security posture, which is especially useful for organizations with multiple data centers or branches.

[0138] In terms of interaction, the support modules in this embodiment provide more powerful policy simulation capabilities. Administrators can manually fix a vulnerability or disconnect a connection edge on the visual interface, and then rerun the risk propagation simulation to see in real time the improvement effect of these hypothetical measures on the overall risk situation, thereby achieving quantitative evaluation and optimization of protection strategies.

[0139] This embodiment further enhances the system's risk perception, prediction, and decision support capabilities in highly dynamic and complex environments by introducing real-time data streams, refined relationship attributes, probabilistic propagation models, and enhanced visualization analysis, thus effectively supplementing and deepening the core solution.

[0140] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0141] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A knowledge graph-based asset visualization and security management system, characterized in that, include: The asset data acquisition and fusion module is used to continuously collect basic asset attribute data, network connection relationship data between assets, business application data carried by assets, and security vulnerability data related to assets from multiple heterogeneous data sources. It also cleans, normalizes, and correlates and merges the collected multi-source data to form a unified asset data view. The knowledge graph construction and management module is used to construct asset knowledge graphs based on a unified asset data view and using a graph structure data model. The risk propagation quantitative analysis module is used to perform graph theory-based risk propagation simulation calculations on top of the asset knowledge graph; The visualization decision support module is used to dynamically render and display the overall topology of the asset knowledge graph, the real-time risk status of each asset node, and the key attack paths calculated by risk propagation simulation in an interactive graphical interface.

2. The asset visualization and security management system based on knowledge graphs according to claim 1, characterized in that, The asset knowledge graph uses asset entities as nodes and physical connections, logical dependencies, data flow relationships, and business affiliation relationships between assets as edges, thereby integrating scattered assets and their multidimensional relationships into a unified semantic network.

3. The asset visualization and security management system based on knowledge graphs according to claim 1, characterized in that, The risk propagation quantitative analysis module first assigns an initial risk value to each asset node in the knowledge graph. The initial risk value is calculated based on the severity of the security vulnerabilities discovered on the asset, the importance level of the asset in the business system, and the frequency of recent security incidents involving the asset. Furthermore, this module defines the attenuation factor and activation threshold for risk propagation along the edges by analyzing the dependency strength and access permission level represented by the edges connecting each node in the asset knowledge graph. Based on the defined propagation rules, this module simulates how the risk propagates step by step through the dependency chain between assets when any asset node's risk status exceeds a preset threshold due to a security event. It also calculates the final affected risk value of all downstream asset nodes that the risk propagation can reach, and assesses the quantitative probability of core data assets facing leakage risks.

4. The asset visualization and security management system based on knowledge graphs according to claim 1, characterized in that, The asset data acquisition and fusion module includes a network detection submodule, a configuration management database interface submodule, a vulnerability scanning engine interface submodule, and a data fusion processing submodule; The network detection submodule automatically discovers surviving asset devices in the network environment and identifies their basic network attributes by actively sending detection messages and analyzing responses. The configuration management database interface submodule is used to extract detailed configuration information of assets, information of their respective business systems, and information of the person responsible for maintenance from the organization's existing configuration management database; The vulnerability scanning engine interface submodule is used to periodically call external vulnerability scanning tools to perform security scans on target assets and obtain vulnerability information associated with the assets from the scan results; The data fusion processing submodule is responsible for parsing, deduplicating, standardizing, and associating the raw data from the above submodules, generating data records that include unique asset identifiers, asset types, IP addresses, operating system versions, a list of installed software services, the business unit to which the asset belongs, a list of known vulnerabilities, and the identified network connection relationships between assets, and outputting a unified asset data view.

5. The asset visualization and security management system based on knowledge graphs according to claim 1, characterized in that, The process of constructing the asset knowledge graph by the knowledge graph construction and management module is as follows: Each asset record in the unified asset data view is mapped to a node in the knowledge graph, and the node is assigned the attributes of asset type and business importance level. Analyze the connection relationships between assets recorded in the asset data view, establish physical connection edges between asset nodes that have direct network communication, and assign communication protocol type and port number attributes to the edges; By analyzing the call relationships between software services running on assets, logical dependency edges are established between asset nodes with service-level calls, and the dependent service name and call frequency attributes are assigned to the edge. By analyzing the data flow design documents of the business system or monitoring actual network traffic, data flow edges are established between asset nodes with data supply and consumption relationships, and data sensitivity level and traffic size attributes are assigned to these edges. Asset nodes belonging to the same business application or processing the same core dataset are associated with the same business group node to form a business affiliation relationship.

6. The asset visualization and security management system based on knowledge graphs according to claim 1, characterized in that, The process of performing risk propagation simulation calculations by the risk propagation quantitative analysis module includes the following steps: Initialize the risk values ​​of all nodes in the asset knowledge graph; Define risk propagation rules; Start the simulation calculation; Calculate the global impact.

7. The asset visualization and security management system based on knowledge graphs according to claim 1, characterized in that, The interactive graphical interface provided by the visualization decision support module supports multiple view modes. The global topology view is used to display the macro layout of the entire asset knowledge graph, and uses color depth and node size to intuitively map the risk level and business importance of assets; The attack path view is used to highlight the shortest or highest probability attack path from the initial risk source to the key core assets, calculated by the risk propagation quantitative analysis module, and to mark the risk value changes at each stage of the path. The asset details view is used to display all the attributes of an asset, a list of associated vulnerabilities, and a list of all related upstream and downstream assets in detail in the form of a sidebar or pop-up window when a user clicks on any asset node in the graph.

8. The asset visualization and security management system based on knowledge graphs according to claim 1, characterized in that, The knowledge graph-based asset visualization security management system also includes a configuration management module for configuring and managing parameters in risk propagation simulation calculations. The configuration management module allows users to set the calculation rules for the initial risk value, the adjustment coefficient for the risk propagation weight, the numerical range of the risk activation threshold, and the maximum number of iterations for the simulation calculation.

9. The asset visualization and security management system based on knowledge graphs according to claim 1, characterized in that, The knowledge graph-based asset visualization and security management system runs on a distributed computing architecture, which includes a data acquisition layer, a graph computing layer, and a presentation layer. The data acquisition layer deploys an asset data acquisition and fusion module, which is responsible for the acquisition and fusion processing of multi-source data; The graph computing layer deploys a knowledge graph construction and management module and a risk propagation quantitative analysis module, which are responsible for the construction of the knowledge graph and the simulation calculation of risk propagation. The presentation layer deploys a visualization decision support module, which is responsible for rendering and displaying the interactive graphical interface.

10. A knowledge graph-based method for visualizing and managing asset security, characterized in that, Security management is achieved using the knowledge graph-based asset visualization security management system as described in any one of claims 1-9.

Images