Vulnerability utilization path speculation and analysis method, system and device based on knowledge graph and medium

Abstract

The invention discloses a vulnerability utilization path speculation and analysis method, system and device based on a knowledge graph, and a medium. The method comprises the following steps: encoding a security entity in a network into a heterogeneous graph structure, and constructing a heterogeneous security entity knowledge graph; constructing an inference rule set of an attack path based on the knowledge graph, wherein each rule is composed of a precondition set, an operation semantic tag and a state change set; performing action sequence search based on inference rules in the knowledge graph to generate all paths meeting attack feasibility, and performing multi-dimensional risk quantitative evaluation on each path to obtain a high-risk attack path set; and executing incremental updating and path re-verification of the graph structure, identifying an affected path, re-verifying the precondition and the risk score of the affected path, and constructing a safety analysis closed loop of continuous evaluation and self-adaptive optimization. According to the method, mining, visualization and dynamic updating can be carried out on the high-risk path, and the method has good real-time performance, expandability and intelligent capability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security operation and maintenance, and particularly relates to a vulnerability exploitation path speculation and analysis method, system, device and medium based on a knowledge graph. BACKGROUND

[0002] The existing similar attack path analysis systems mainly construct their function architectures around three aspects of static rule matching, graph structure modeling and path generation based on graph search. The general system structure usually includes the following core modules: an asset information collection and modeling module, which is responsible for automatically scanning and sorting the topology structure of an internal network of an enterprise, host system information, open services, deployed software components, etc. The collected information is used to construct an initial network asset graph, providing a basis for subsequent vulnerability correlation and path reasoning. A vulnerability and threat information access module, which accesses third-party vulnerability intelligence platforms (such as CVE, CNVD, NVD, etc.) or local scanning systems (such as Nessus, OpenVAS), to obtain vulnerability information existing in the current host or service. The vulnerability information is bound with the software entities in the asset graph, marking potential attack entrances. A static path generation module, which uses a predefined attack graph template or an attack behavior database (such as ATT&CK, CAPEC) to map known attack chains, and uses a graph traversal algorithm (such as DFS, BFS, shortest path search) to generate feasible attack paths on the asset topology graph. The generation process of the path often depends on the satisfaction of the three conditions of “vulnerability exploitability + network reachability + privilege escalation possibility”. A risk scoring and sorting module, which assigns a risk weight to each generated attack path, generally calculates a comprehensive risk index based on static indicators such as vulnerability CVSS score, asset importance, path length, and outputs the sorted high-risk paths for manual review. A visualization and alarm module, which displays the attack paths and affected asset positions through a graphical interface, to assist security personnel in understanding the attack possibility and propagation path. Some systems support setting attack chain length thresholds or key asset touch points to realize linkage alarm.

[0003] Although there are currently several attack path analysis tools based on graph structure in industrial application, their path reasoning mechanisms mostly rely on static graph traversal methods, lacking in-depth modeling of semantic relationships between vulnerabilities and attack logic dependencies. The system often constructs paths based on network connectivity and vulnerability existence, without introducing dynamic factors such as permission inheritance, preconditions, target instruction sets, etc. that affect attack feasibility, resulting in a large number of paths that are structurally valid but cannot be executed in real-world scenarios, generating a high proportion of false positives or pseudo-paths, affecting the credibility of the results. In addition, the path generation logic of existing similar products is generally built on artificially set attack chain templates or rule libraries, and the system needs to rely on security experts to define vulnerability types, attack methods and exploit processes in advance, lacking the ability to automatically learn attack behavior evolution patterns from actual data. This rule-driven approach not only makes it difficult to adapt to the rapid changes of new exploit methods, but also makes the system structurally closed and poorly generalized when faced with unknown attack styles or complex cross-domain dependency scenarios. Because asset, software, account, vulnerability, etc. information is scattered in different systems, lacking a unified representation and fusion mechanism, existing tools are often limited to network topology and service port level when building attack graphs, ignoring account permission relationships, inter-host dependency chains, user behavior paths, etc. security elements. The fragmentation of the graph atlas seriously restricts the complete restoration and logical coherence of the attack path, making path analysis remain at the surface reasoning stage of link connectivity. At the same time, traditional path analysis systems usually lack dynamic updating mechanism and path credibility modeling capability. The system cannot automatically adjust the path structure and result ranking according to the real-time changes of vulnerability intelligence, asset topology adjustment or configuration policy changes, nor can it assign a quantitative risk level or confidence level to each path based on the structure and behavior characteristics in the graph atlas, not only reducing the value of path analysis results, but also failing to support enterprises to achieve agile response and continuous assessment in a dynamic environment.

[0004] The core challenge of solving the above problems is how to build a semantic complete, dynamically scalable and intelligent reasoning capable security knowledge graph system. This requires the system to have cross-domain data modeling capability, causal path generation mechanism and credible risk scoring method, which can model the possible behavior paths of attackers as a reasoning process rather than a traversal result, and update it in real time as the system state changes. In addition, it is also necessary to integrate graph neural networks, causal logic modeling and graph semantic representation technology, so as to break through the bottleneck of traditional attack path analysis in accuracy, generalization and dynamics, and realize deep modeling and intelligent understanding of the network security situation. SUMMARY

[0005] In view of the above existing problems, the present application is proposed. Therefore, the present application provides a vulnerability exploit path speculation and analysis method, system, device and medium based on a knowledge graph to solve the problems mentioned in the background art.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, embodiments of the present invention provide a method for inferring and analyzing vulnerability exploitation paths based on knowledge graphs, including: encoding security entities in the network into heterogeneous graph structures and constructing a heterogeneous security entity knowledge graph; Based on the knowledge graph, a set of inference rules for attack paths is constructed. Each rule consists of a set of preconditions, an operation semantic label, and a set of state changes. In the knowledge graph, an action sequence search based on the inference rules is performed to generate all paths that meet the attack feasibility requirements, and a multi-dimensional risk quantification assessment is performed on each path to obtain a set of high-risk attack paths. Perform incremental updates and path re-verification of the graph structure, identify affected paths and re-verify their preconditions and risk scores, and build a closed loop of security analysis for continuous evaluation and adaptive optimization.

[0007] As a preferred embodiment of the knowledge graph-based vulnerability exploitation path prediction and analysis method described in this invention, the step of encoding security entities in the network into a heterogeneous graph structure and constructing a heterogeneous security entity knowledge graph includes: Obtain N security-related entities in the network system and denote them as a set of nodes, where each entity node corresponds to an entity type; For each type of entity node, the original set of entity attributes is extracted, and the original attributes are embedded by a multilayer perceptron encoder corresponding to the entity type to generate the attribute feature vector of the entity node. Define semantic relationship types and construct a set of directed edges based on the relationships between the security-related entities, where each directed edge points from the source node to the target node and is labeled with a relationship type to indicate the specific semantic association between the source node and the target node; The node set, edge set, entity type set, relation type set, and embedded function are integrated into a directed heterogeneous graph structure to construct a heterogeneous secure entity knowledge graph.

[0008] As a preferred embodiment of the knowledge graph-based vulnerability exploitation path inference and analysis method described in this invention, the set of inference rules for constructing attack paths based on the knowledge graph includes: Define an ordered attack action space, where each attack action corresponds to the operation performed by the network attacker in the attack path, and establish a formal rule triple for each attack action; The formalized rule triples of all attack actions are integrated into a set of inference rules. Inference operations are performed on the given knowledge graph structure. By matching the preconditions, the node combinations that meet the triggering conditions of the attack actions are identified, and the corresponding attack operations are applied. The current graph state is updated according to the post-effect.

[0009] As a preferred embodiment of the knowledge graph-based vulnerability exploitation path inference and analysis method described in this invention, it further includes: for path reasoning from the initial node to the target node, a sequence of attack actions is applied sequentially, and the attack rules used in each step of the path are derived from a predefined set of rules. If the preconditions of step i are met in the current graph state, then the attack operation is executed. After the attack is performed, the post-attack effect is added to the original graph, forming a new graph state.

[0010] As a preferred embodiment of the knowledge graph-based vulnerability exploitation path inference and analysis method described in this invention, wherein: an action sequence search based on the inference rules is performed in the knowledge graph to generate all paths that satisfy attack feasibility, including: Define the attacker's initial control node set and the attack target node set; Starting from the initial set of control nodes, a path search is performed on the knowledge graph based on the set of inference rules. Attack action sequences that meet the preconditions are applied in sequence to generate all attack paths from any initial node to any target node. Each hop in the path corresponds to a valid attack operation, and for any i-th step in the path, there exists a reasoning rule such that the premise of the rule holds true in the current graph.

[0011] As a preferred embodiment of the knowledge graph-based vulnerability exploitation path prediction and analysis method described in this invention, the following steps are performed: A multi-dimensional risk quantification assessment is conducted on each path to obtain a set of high-risk attack paths, including: For each generated attack path, a comprehensive risk scoring function is calculated, expressed as: in, The security impact represented by the end node of the path. Let be the joint probability that all attack actions in the path are valid. This refers to the number of steps or operational complexity required for an attack path. As a weighting factor; All attack paths are sorted according to the comprehensive risk score based on the scoring function, and the top K paths are selected to form a set of high-risk attack paths as the final output.

[0012] As a preferred embodiment of the knowledge graph-based vulnerability exploitation path prediction and analysis method described in this invention, the method includes: performing incremental updates and path re-verification of the knowledge graph structure, identifying affected paths and re-verifying their preconditions and risk scores, and constructing a security analysis closed loop of continuous evaluation and adaptive optimization, including: Within the target time window, network security change events are received, with each incremental event representing a directed change operation on the knowledge graph; based on the current knowledge graph state, incremental update operations are performed to generate the updated graph state; For each path in the generated set of attack paths, determine the dependency subgraph of each path in the original graph; if at least one incremental event affects the dependency subgraph, mark the path as a path that needs to be recalculated and include it in the set of affected paths; For each path in the set of affected paths, the path validity verification, joint probability recalculation, risk score re-evaluation, and comprehensive score recalculation are performed sequentially. Through automatic monitoring and scheduling mechanisms, the system executes graph updates and path reassessment processes to achieve a closed loop for security analysis.

[0013] Secondly, the present invention provides a vulnerability exploitation path prediction and analysis system based on knowledge graphs, comprising: The heterogeneous security entity knowledge graph construction module is used to encode security entities in the network into a heterogeneous graph structure and construct a heterogeneous security entity knowledge graph. The reasoning rule injection module is used to construct a set of reasoning rules for attack paths based on the knowledge graph. Each rule consists of a set of preconditions, operation semantic tags, and a set of state changes. The credibility scoring calculation module is used to perform action sequence search based on the reasoning rules in the knowledge graph, generate all paths that meet the attack feasibility, and perform multi-dimensional risk quantification assessment on each path to obtain a set of high-risk attack paths. The path update module is used to perform incremental updates to the graph structure and path re-verification, identify affected paths and re-verify their preconditions and risk scores, and build a closed loop of safety analysis for continuous evaluation and adaptive optimization.

[0014] Thirdly, the present invention provides an electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the knowledge graph-based vulnerability exploitation path inference and analysis method are implemented.

[0015] Fourthly, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the knowledge graph-based vulnerability exploitation path prediction and analysis method.

[0016] Compared with existing technologies, the beneficial effects of this invention are as follows: By introducing a structured security knowledge graph and a graph logic reasoning engine, this invention constructs an attack path prediction system with semantic understanding, condition evaluation, and dynamic evolution capabilities. Compared with traditional attack graph tools that rely on static rules and graph traversal algorithms, this invention achieves comprehensive improvements in expressive power, reasoning accuracy, response timeliness, and automation and intelligence.

[0017] First, at the attack path modeling level, this invention uniformly encodes various heterogeneous security entities in the network environment into a graph structure with multiple types of nodes and multiple relational edges, possessing complete semantic expression capabilities for attack behavior. Traditional systems often remain at the host-vulnerability or host-service cascading model, unable to express deep logic such as permission inheritance, policy constraints, and account associations in complex scenarios, resulting in semantically impoverished and limited-coverage inference results. Second, regarding the path reasoning mechanism, this invention explicitly introduces a formal definition of attack actions. Each attack step is driven by a triplet of preconditions—action semantics—result state, making the reasoning process verifiable and traceable. In contrast, existing methods often only use path connectivity as the basis for reachability judgment, lacking evaluation of the validity of vulnerability conditions and the exploitation context, thus easily generating pseudo-paths or logically flawed paths. This invention uses a rule system to explicitly judge the legality of each hop in the path, significantly improving the credibility of the inferred path. Third, in terms of path risk quantification and priority assessment, this invention constructs a scoring function based on impact value, joint success probability, and attack cost, realizing comprehensive ranking and confidence labeling of paths. Existing systems mostly output path results without risk level labeling, requiring manual judgment. The path results output by this invention possess strong interpretability and ranking capabilities, helping security operations personnel accurately focus on high-risk paths and optimize handling strategies. Furthermore, regarding dynamic response capabilities, this invention designs an event-driven incremental graph update mechanism and path re-push process, supporting automatic correction of the graph structure and path set upon receiving vulnerability intelligence, asset changes, or policy modifications, forming a continuously evolving security analysis capability. Traditional systems generally employ manual re-run mechanisms, which cannot adapt to the challenges of rapid asset changes and constantly expanding attack surfaces in real-world network environments. Finally, the graph structure and rule engine of this invention possess excellent scalability and portability, adaptable to various deployment environments, supporting user-defined attack rules, risk parameters, and target priority policies, exhibiting good versatility and engineering usability.

[0018] In summary, this invention represents a breakthrough over existing products in multiple dimensions, including attack path modeling granularity, logical reasoning rigor, risk scoring capability, dynamic update mechanism, and system intelligence level. It significantly improves the system's accuracy in identifying real attack paths, its real-time response, and its value in guiding security strategies, demonstrating strong prospects for engineering implementation and widespread adoption. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a schematic diagram of the process flow of a vulnerability exploitation path inference and analysis method based on knowledge graphs, as described in one embodiment of the present invention. Detailed Implementation

[0020] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0021] Example 1, referring to Figure 1 This is one embodiment of the present invention, which provides a method for inferring and analyzing vulnerability exploitation paths based on knowledge graphs, including: S100: Encode security entities in the network into a heterogeneous graph structure and construct a heterogeneous security entity knowledge graph; S200: A set of inference rules for constructing attack paths based on knowledge graphs. Each rule consists of a set of preconditions, operation semantic tags, and a set of state changes. S300: Performs action sequence search based on reasoning rules in the knowledge graph to generate all paths that meet the feasibility of attack, and performs multi-dimensional risk quantification assessment on each path to obtain a set of high-risk attack paths; S400: Performs incremental updates and path re-verification of the graph structure, identifies affected paths and re-verifies their preconditions and risk scores, and builds a closed loop of safety analysis for continuous evaluation and adaptive optimization.

[0022] It should be noted that traditional attack path analysis methods often rely on manual modeling, security expert experience, or static rule configuration, lacking automated reasoning capabilities and dynamic update mechanisms. This makes them ill-suited for the security situation awareness and decision-making needs of large-scale, heterogeneous network environments. Especially when facing complex attack scenarios such as zero-day vulnerabilities, cross-host link jumps, and privilege escalation paths, the reasoning depth and accuracy of existing tools are severely limited, failing to meet the protection requirements of enterprise-level systems. This invention constructs security entities in the network into a heterogeneous knowledge graph. Utilizing the entity relationships and path information within the graph structure, it infers and scores possible intrusion routes by attackers, enabling the discovery, visualization, and dynamic updating of high-risk paths within the system. It supports automatic graph updates and path re-derivation upon receiving new vulnerability intelligence or system change information, exhibiting excellent real-time performance, scalability, and intelligence. Compared to existing similar products, this invention demonstrates fundamental differences in overall system architecture, graph modeling methods, path reasoning mechanisms, and semantic expression capabilities. Traditional systems typically employ path generation algorithms based on static topology, using "vulnerability existence + network connectivity" as the core premise for path calculation. In contrast, this invention introduces a knowledge graph as the core data structure, emphasizing the modeling, reasoning evolution, and conditional constraints of semantic entity associations, to simulate the formation process of intrusion paths in a way that more closely resembles attack behavior.

[0023] In terms of underlying data modeling, this invention is no longer limited to the connection relationships between network nodes and services. Instead, it incorporates multiple types of entities, such as hosts, software, users, accounts, permission levels, configuration items, patch status, attack techniques, and exploit tools, into a single heterogeneous graph, organized through attribute triples, hierarchical semantic relationships, and event causal chains. This structure is significantly superior to existing flattened topology graphs, capable of expressing more complex security context information and possessing stronger entity semantic carrying capacity and path logic constraint expression capabilities.

[0024] Regarding path reasoning logic, existing products mostly employ graph traversal algorithms combined with static rules for path generation, which struggles to handle cross-domain constraints and sequential dependencies in attack chains. This invention introduces a reasoning engine based on rule-based reasoning and path reachability condition evaluation. It automatically determines whether an attack path meets execution preconditions, such as vulnerability triggering conditions, account permissions, and access path connectivity, thereby filtering out false paths and retaining only highly feasible genuine attack paths. Simultaneously, this invention introduces a risk propagation mechanism for graph path segments in path credibility evaluation. The system constructs a path scoring function based on multiple factors, including the risk weight of each node, path length, node type (e.g., whether it is a critical asset), and attack cost, to implement a path credibility scoring and ranking mechanism, ensuring the priority of the output results is reliable. In contrast, traditional systems output path lists lack reliable evidence, requiring users to manually verify them, increasing the cost of understanding.

[0025] More importantly, this invention supports an automatic reasoning and refresh mechanism based on graph changes. When new vulnerabilities are added to the network, configurations are changed, or hosts are migrated, the system can automatically adjust the graph structure based on incremental information and trigger the recalculation of affected paths, forming a closed-loop feedback path management mode. In contrast, traditional systems often require manual triggering of analysis tasks and lack the ability to link graph evolution and reasoning, resulting in insufficient dynamic adaptability. This invention, by constructing a semantically fused, structurally complete, and reasoning-driven security knowledge graph system, achieves a leap from "structural connectivity" to "semantic understanding" in attack path analysis. It surpasses existing methods in terms of expressiveness, accuracy, intelligence, and real-time performance, constituting a novel paradigm for attack path modeling and reasoning, possessing significant technical advantages and engineering application potential.

[0026] In this embodiment of the invention, step S100, which encodes security entities in the network into a heterogeneous graph structure and constructs a heterogeneous security entity knowledge graph, includes: Obtain N security-related entities in the network system and denote them as a set of nodes, where each entity node corresponds to an entity type; For each type of entity node, the original set of entity attributes is extracted, and the original attributes are embedded by a multilayer perceptron encoder corresponding to the entity type to generate the attribute feature vector of the entity node. Define semantic relationship types and construct a set of directed edges based on the relationships between security-related entities. Each directed edge points from the source node to the target node and is labeled with a relationship type to indicate the specific semantic association between the source node and the target node. By integrating the set of nodes, edges, entity types, relation types, and embedded functions into a directed heterogeneous graph structure, a heterogeneous secure entity knowledge graph is constructed.

[0027] It should be noted that step S100 of this embodiment aims to organize all security-related elements in the network system into a graph structure using a unified data model. This graph supports logical reasoning and semantic propagation in subsequent attack paths. Modeled as a directed heterogeneous graph, it contains multiple types of entity nodes and various semantic edge relationships, representing all objects and behavioral dependencies that may be involved in the attack process.

[0028] Specifically, security-related entities include hosts, software, vulnerabilities, accounts, permissions, services, policies, and attack tools.

[0029] Furthermore, suppose the network system includes A set of security-related entities, denoted as the node set: Each entity node Corresponding to one entity type Its value is defined as: In this context, Host represents a physical or virtual host, Software represents the software or service deployed on the host, Vuln represents vulnerability information in the software (such as CVE numbers), Account represents a system user or process account, Priv represents the privilege level (such as root, admin, user), Service represents an exposed port service, Policy represents an access control policy, and Exploit represents known exploit code or attack tools.

[0030] Furthermore, for each type of node Construct attribute feature vectors This represents the entity's static metadata, context configuration, and security tags. Specifically, it defines the embedding function. as follows: in, Represents the original set of attributes of an entity (such as software version, vulnerability score, account ownership, etc.). This indicates that different entity types use their own attribute encoders.

[0031] Furthermore, we define a set of relations, where each edge is represented as: That is, from the entity node point to A directed edge with semantic meaning represents a relationship between nodes. .

[0032] Specifically, typical relationship types include: a host's structure depends on certain software; the software has a vulnerability; an account can access a host or service; the account has been granted certain permissions; the vulnerability can be exploited by a certain exploit; and operations are restricted by a certain policy.

[0033] Furthermore, the constructed heterogeneous security entity knowledge graph is formally defined as: in, Let be the set of edges. For a collection of entity types, It is a set of relation types.

[0034] It should be noted that this graph structure has the ability to express the logical entity, contextual dependencies, and exploitable conditions of each hop in the attack path, and subsequent path reasoning will be completed on this graph.

[0035] It should be noted that, based on knowledge graph structures Constructing a set of inference rules for attack paths This set of rules is used to simulate how an attacker, starting from an initial node, gradually expands privileges and moves laterally through exploitable dependencies between entities, ultimately reaching a high-value target node. The rule system uses first-order predicate logic to explicitly express the preconditions and outcome states of the attack actions, ensuring that the reasoning results are structurally sound and semantically executable.

[0036] In this embodiment of the invention, step S200, which involves constructing a set of inference rules for the attack path based on a knowledge graph, includes: Define an ordered attack action space, where each attack action corresponds to the operation performed by the network attacker in the attack path, and establish a formal rule triple for each attack action; The formalized rule triples of all attack actions are integrated into a set of inference rules. Inference operations are performed on the given knowledge graph structure. By matching the preconditions, the node combinations that meet the triggering conditions of the attack actions are identified, and the corresponding attack operations are applied. The current graph state is updated according to the post-effect.

[0037] Furthermore, the attack actions are modeled, and the attack action space is defined as an ordered set, represented as: Each attack action corresponds to a possible operation the attacker might take along the path, such as exploiting vulnerabilities, privilege escalation, or remote connection. Each action is modeled as a formal rule triple: in, This represents the set of preconditions for an attack to occur. Semantic tags that represent the attack operation itself, such as Exploit, Connect, Escalate; It represents the set of state changes after an action is performed, i.e., the graph structure update.

[0038] For example, targeting vulnerability exploitation operations The rules are defined as follows: Indicates: If account Access host And the vulnerability on the host If the vulnerability is exploitable, the attacker can gain user privileges through exploitation.

[0039] The system represents the preconditions for all possible attack operations using predicate formulas, where each predicate semantically represents the existence and attribute state of an edge or node in the graph. For example: The graph contains edges. ; Host Vulnerability exists Furthermore, its CVE hazard value is greater than 7.0; Account Currently in a low-privilege state.

[0040] These predicates can all be mapped to logical expressions of graph structures or attribute conditions. The system determines whether the rule triggering conditions are met by matching the predicates.

[0041] Furthermore, all action rules are defined as a set of reasoning rules: The system reasoning process is based on the knowledge graph. The nodes that satisfy the preconditions are matched sequentially. Then apply the operation Update the graph structure and add The semantic results are then applied to the current graph state.

[0042] In this embodiment of the invention, step S200 further includes: for path reasoning from the initial node to the target node, an attack action sequence is applied sequentially, and the attack rules used in each step of the path are derived from a predefined set of rules. If the preconditions of step i are met in the current graph state, then the attack operation is executed. After the attack is performed, the post-attack effect is added to the original graph, forming a new graph state.

[0043] Specifically, path reasoning can be viewed as starting from the initial node. To begin, apply a sequence of actions. satisfy: in, This indicates the first [item] in the path. Step (from 1 to Perform each step of the operation; This indicates that the attack rules used in each step come from a predefined set of rules; Indicates if the first The prerequisites for a step (i.e., the conditions under which an attack action is performed) are contained within the current graph state. middle; This means that the attack operation can be executed, and the result will be the current graph. Expand to a new state The method involves adding the post-attack effects of the attack rule (such as gaining privileges or establishing connections) to the original graph.

[0044] This ultimately forms a path from the attack origin to the target node. Each step has a clear source of reasoning and a dependent explanation.

[0045] It should be noted that after completing the attack graph construction and inference rule injection, the system will perform path search and scoring in the graph to determine the set of attack paths to all reachable target nodes, and perform risk quantification assessment on each path. In this embodiment of the invention, step S300 addresses the problem of identifying the highest-risk target path that can be reached from a known entry point from the attacker's perspective, and providing its credibility score based on multiple dimensions.

[0046] In this embodiment of the invention, step S300, which involves performing an action sequence search based on reasoning rules in the knowledge graph to generate all paths that satisfy attack feasibility, includes: Define the attacker's initial control node set and the attack target node set; Starting with the initial set of control nodes, a path search is performed on the knowledge graph based on the set of reasoning rules. Attack action sequences that meet the preconditions are applied in sequence to generate all attack paths from any initial node to any target node. Each hop in the path corresponds to a valid attack operation, and for any i-th step in the path, there exists a reasoning rule such that the premise of the rule holds true in the current graph.

[0047] Specifically, let the attacker's initial control node set be: in, This is the attacker's initial set of control nodes. This refers to a specific initial control node, such as a compromised host / account / service.

[0048] Let the set of target nodes be: in, For the set of target nodes, This refers to a specific target node, such as a critical asset, core service, or sensitive data node.

[0049] Driven by the reasoning rule system, the system executes action sequences along the graph. Construct a path starting from the initial node. : in, This represents a hypothetical attack path from the entry point to the target. The starting node of the path. For the first in the path Arrival status / intermediate node, This represents the path length and the number of valid operations contained in the corresponding path. This is the end node of the path.

[0050] Each hop corresponds to a valid attack operation, which satisfies the path condition: in, This means that it holds true for any...; Indicates the existence of…; A set of rules for inference / attack actions. For a specific rule, For rules The set of preconditions, the conditions that must be met to trigger the attack, such as reachability, existence of vulnerabilities, and permission requirements. For the first The current graph state / set of known facts at each step, i.e., in the previous step. After the first step of reasoning is executed, the relationships, attributes, and states that are already established in the graph; The system enumerates all reachable paths and then proceeds to the scoring phase.

[0051] In this embodiment of the invention, step S300, which involves performing a multi-dimensional risk quantification assessment on each path to obtain a set of high-risk attack paths, includes: calculating a comprehensive risk scoring function for each generated attack path, expressed as: in, The security impact represented by the end node of the path. Let be the joint probability that all attack actions in the path are valid. This refers to the number of steps or operational complexity required for an attack path. As a weighting factor; All attack paths are sorted according to their comprehensive risk scores based on the scoring function, and the top K paths are selected to form a set of high-risk attack paths as the final output.

[0052] It should be noted that the weighting factor in this embodiment of the invention can be set by the system strategy.

[0053] Furthermore, embodiments of the present invention define a path scoring function. A comprehensive evaluation of path credibility and attack value is conducted. The key to path credibility lies in assessing the probability of the attack operation succeeding at each step of the path. Let the path be... Includes attack action sequence The probability of success at each step is The joint probability that the path holds is: Each It can be obtained by jointly modeling external data such as the trained model, historical exploitation success rate statistics, and vulnerability CVSS exploitation complexity.

[0054] Furthermore, after scoring all paths, the results are sorted... Sort by height from highest to lowest, and output the first... The most risky paths are used as the final set of predicted results: It should be noted that the above set has a credibility assessment basis and can be directly used to guide the configuration of protection strategies, the optimization of alarm strategies, or manual review and scheduling.

[0055] In this embodiment of the invention, step S400 involves incremental updating of the map structure and path re-verification, identifying affected paths and re-verifying their preconditions and risk scores, and constructing a closed loop of security analysis for continuous evaluation and adaptive optimization, including: Within the target time window, network security change events are received, with each incremental event representing a directed change operation on the knowledge graph; based on the current knowledge graph state, incremental update operations are performed to generate the updated graph state; For each path in the generated set of attack paths, determine the dependency subgraph of each path in the original graph; if there is at least one incremental event affecting the dependency subgraph, mark the path as a path that needs to be recalculated and include it in the set of affected paths. For each path in the affected path set, perform path validity verification, recalculate joint probability, re-evaluate risk score, and recalculate comprehensive score in sequence; Through automatic monitoring and scheduling mechanisms, the system executes graph updates and path reassessment processes to achieve a closed loop for security analysis.

[0056] Specifically, let the timestamp be... The system is in the time window The set of network security change events received internally is defined as: Each incremental event It is a directed change operation: in, , indicating the operation type; These are the graph edges or entity attributes that are inserted, deleted, or updated. The system receives... Then, based on the current map state Perform incremental update: Define path set Each path The dependency subgraph is If a change event has affected... If so, the path needs to be re-validated, as shown in the following formula: For all affected path sets The system will re-execute: Path validity verification (whether the preconditions still hold); Joint probability calculation (some utilization conditions may fail due to state changes); Risk scoring function Re-evaluate.

[0057] Furthermore, the system incorporates an automatic monitoring and scheduling mechanism, periodically or event-drivenly calling the path refresh module. The process is defined as follows: Monitoring phase: Monitoring message sources such as asset management platforms, vulnerability intelligence sources, and security policy systems; Detection phase: Extract events that meet the update rules and form... ; Map update phase: Execution ; Path re-pushing phase: Filtering Recalculate , sorting update.

[0058] The automatic monitoring and scheduling mechanism in this embodiment of the invention can ensure that the map maintains the accuracy of path prediction and the real-time nature of risk results under dynamic changes of multi-source heterogeneous inputs, forming a continuous evaluation closed loop.

[0059] It should be noted that by constructing a dynamic update mechanism for the knowledge graph, this invention ensures that when changes occur in the network system environment, such as the addition of vulnerabilities, host shutdown, or policy changes, this invention can automatically perform incremental updates of the knowledge graph, path re-inference, and score recalculation, thereby achieving real-time security situation awareness and response.

[0060] It should also be noted that this invention represents the hosts, services, software components, vulnerability information, and permission relationships involved in the network as a graph structure with multiple types of nodes and multiple relational edges. Based on this, it defines the conditional causal logical sequence of attack actions to form a path rule set. Then, through graph structure reasoning algorithms and confidence propagation mechanisms, it identifies and ranks all high-risk attack paths that meet the conditions, thereby overcoming the problems of pseudo-paths, lack of semantic expression, and static results that cannot be updated in traditional methods.

[0061] Example 2 illustrates a method for predicting and analyzing vulnerability exploitation paths based on knowledge graphs. It should be noted that the technical solution of this knowledge graph-based vulnerability exploitation path prediction and analysis system belongs to the same concept as the aforementioned knowledge graph-based vulnerability exploitation path prediction and analysis method. Details not described in detail in the knowledge graph-based vulnerability exploitation path prediction and analysis system in this example can be found in the description of the aforementioned knowledge graph-based vulnerability exploitation path prediction and analysis method.

[0062] This embodiment presents a knowledge graph-based vulnerability exploitation path prediction and analysis system, comprising: The heterogeneous security entity knowledge graph construction module is used to encode security entities in the network into a heterogeneous graph structure and construct a heterogeneous security entity knowledge graph. The reasoning rule injection module is used to construct a set of reasoning rules for attack paths based on knowledge graphs. Each rule consists of a set of preconditions, operation semantic tags, and a set of state changes. The credibility scoring module is used to perform action sequence search based on reasoning rules in the knowledge graph, generate all paths that meet the attack feasibility, and perform multi-dimensional risk quantification assessment on each path to obtain a set of high-risk attack paths. The path update module is used to perform incremental updates to the graph structure and path re-verification, identify affected paths and re-verify their preconditions and risk scores, and build a closed loop of safety analysis for continuous evaluation and adaptive optimization.

[0063] This embodiment also provides an electronic device applicable to knowledge graph-based vulnerability exploitation path inference and analysis methods, including: The system includes a memory and a processor. The memory stores computer-executable instructions, and the processor executes these instructions to implement the knowledge graph-based vulnerability exploitation path prediction and analysis method proposed in the above embodiments.

[0064] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the knowledge graph-based vulnerability exploitation path prediction and analysis method proposed in the above embodiments.

[0065] The storage medium proposed in this embodiment and the method for inferring and analyzing vulnerability exploitation paths based on knowledge graphs proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0066] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0067] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for inferring and analyzing vulnerability exploitation paths based on knowledge graphs, characterized in that, include: Encode security entities in the network into heterogeneous graph structures to construct a heterogeneous security entity knowledge graph. Based on the knowledge graph, a set of inference rules for attack paths is constructed. Each rule consists of a set of preconditions, an operation semantic label, and a set of state changes. In the knowledge graph, an action sequence search based on the inference rules is performed to generate all paths that meet the attack feasibility requirements, and a multi-dimensional risk quantification assessment is performed on each path to obtain a set of high-risk attack paths. Perform incremental updates and path re-verification of the graph structure, identify affected paths and re-verify their preconditions and risk scores, and build a closed loop of security analysis for continuous evaluation and adaptive optimization.

2. The vulnerability exploitation path prediction and analysis method based on knowledge graphs as described in claim 1, characterized in that, The step of encoding security entities in the network into a heterogeneous graph structure and constructing a heterogeneous security entity knowledge graph includes: Obtain N security-related entities in the network system and denote them as a set of nodes, where each entity node corresponds to an entity type; For each type of entity node, the original set of entity attributes is extracted, and the original attributes are embedded by a multilayer perceptron encoder corresponding to the entity type to generate the attribute feature vector of the entity node. Define semantic relationship types and construct a set of directed edges based on the relationships between the security-related entities, where each directed edge points from the source node to the target node and is labeled with a relationship type to indicate the specific semantic association between the source node and the target node; The node set, edge set, entity type set, relation type set, and embedded function are integrated into a directed heterogeneous graph structure to construct a heterogeneous secure entity knowledge graph.

3. The vulnerability exploitation path prediction and analysis method based on knowledge graphs as described in claim 2, characterized in that, The set of inference rules for constructing attack paths based on the knowledge graph includes: Define an ordered attack action space, where each attack action corresponds to the operation performed by the network attacker in the attack path, and establish a formal rule triple for each attack action; The formalized rule triples of all attack actions are integrated into a set of inference rules. Inference operations are performed on the given knowledge graph structure. By matching the preconditions, the node combinations that meet the triggering conditions of the attack actions are identified, and the corresponding attack operations are applied. The current graph state is updated according to the post-effect.

4. The knowledge graph-based vulnerability exploitation path prediction and analysis method as described in claim 3, characterized in that, Also includes: For path reasoning from the initial node to the target node, an attack action sequence is applied sequentially, and the attack rules used in each step of the path are derived from a predefined set of rules. If the preconditions of step i are met in the current graph state, then the attack operation is executed. After the attack is performed, the post-attack effect is added to the original graph, forming a new graph state.

5. The knowledge graph-based vulnerability exploitation path prediction and analysis method as described in claim 4, characterized in that, Performing an action sequence search based on the inference rules within the knowledge graph generates all paths that satisfy attack feasibility, including: Define the attacker's initial control node set and the attack target node set; Starting from the initial set of control nodes, a path search is performed on the knowledge graph based on the set of inference rules. Attack action sequences that meet the preconditions are applied in sequence to generate all attack paths from any initial node to any target node. Each hop in the path corresponds to a valid attack operation, and for any i-th step in the path, there exists a reasoning rule such that the premise of the rule holds true in the current graph.

6. The knowledge graph-based vulnerability exploitation path prediction and analysis method as described in claim 5, characterized in that, A multi-dimensional risk quantification assessment is performed on each path to obtain a set of high-risk attack paths, including: For each generated attack path, a comprehensive risk scoring function is calculated, expressed as: in, The security impact represented by the end node of the path. Let be the joint probability that all attack actions in the path are valid. This refers to the number of steps or operational complexity required for an attack path. As a weighting factor; All attack paths are sorted according to the comprehensive risk score based on the scoring function, and the top K paths are selected to form a set of high-risk attack paths as the final output.

7. The knowledge graph-based vulnerability exploitation path prediction and analysis method as described in claim 6, characterized in that, Perform incremental updates and path re-verification of the geographic graph structure, identify affected paths and re-verify their preconditions and risk scores, and construct a closed loop of security analysis for continuous evaluation and adaptive optimization, including: Within the target time window, network security change events are received, with each incremental event representing a directed change operation on the knowledge graph; based on the current knowledge graph state, incremental update operations are performed to generate the updated graph state; For each path in the generated set of attack paths, determine the dependency subgraph of each path in the original graph; if at least one incremental event affects the dependency subgraph, mark the path as a path that needs to be recalculated and include it in the set of affected paths; For each path in the set of affected paths, the path validity verification, joint probability recalculation, risk score re-evaluation, and comprehensive score recalculation are performed sequentially. Through automatic monitoring and scheduling mechanisms, the system executes graph updates and path reassessment processes to achieve a closed loop for security analysis.

8. A knowledge graph-based vulnerability exploitation path prediction and analysis system, applied to the method described in any one of claims 1-7, characterized in that, include: The heterogeneous security entity knowledge graph construction module is used to encode security entities in the network into a heterogeneous graph structure and construct a heterogeneous security entity knowledge graph. The reasoning rule injection module is used to construct a set of reasoning rules for attack paths based on the knowledge graph. Each rule consists of a set of preconditions, operation semantic tags, and a set of state changes. The credibility scoring calculation module is used to perform action sequence search based on the reasoning rules in the knowledge graph, generate all paths that meet the attack feasibility, and perform multi-dimensional risk quantification assessment on each path to obtain a set of high-risk attack paths. The path update module is used to perform incremental updates to the graph structure and path re-verification, identify affected paths and re-verify their preconditions and risk scores, and build a closed loop of safety analysis for continuous evaluation and adaptive optimization.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the knowledge graph-based vulnerability exploitation path prediction and analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the knowledge graph-based vulnerability exploitation path prediction and analysis method according to any one of claims 1 to 7.

Images