Vulnerability meta-knowledge aggregation method and device based on knowledge graph and electronic equipment

Abstract

The invention relates to the field of network security, and particularly provides a vulnerability meta-knowledge aggregation method and device based on a knowledge graph and electronic equipment. The method comprises the following steps: respectively extracting vulnerability entities and attribute information thereof in a plurality of vulnerability description texts; performing similarity calculation of semantic vectors and similarity calculation of rule verification on any two vulnerability description texts, and weighting a similarity result to obtain a comprehensive similarity; fusing the vulnerability entity attributes in the plurality of vulnerability description texts with the comprehensive similarity greater than or equal to a preset threshold to obtain a sub-vulnerability entity set, and determining a relationship type between any two vulnerability entities in the sub-vulnerability entity set based on a relationship reasoning network; constructing a relation triple based on any two vulnerability entities in the vulnerability entity set and the relation type between any two vulnerability entities, and storing the relation triple in a knowledge graph library; according to the technical scheme provided by the invention, the accuracy of vulnerability meta-knowledge aggregation is improved.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, and in particular to a method, apparatus, and electronic device for aggregation of vulnerability meta-knowledge based on knowledge graphs. Background Technology

[0002] With the rapid development of network technology, the number of vulnerabilities in various software and hardware systems has surged, and vulnerability descriptions are widely distributed across multiple sources such as security bulletins, vulnerability databases, and technical blogs. Existing vulnerability knowledge is fragmented and unstructured, and vulnerability descriptions from different channels exhibit inconsistencies, duplicate attributes, and ambiguous relationships, making it difficult for security personnel to quickly integrate core vulnerability information and affecting the efficiency of vulnerability assessment and the accuracy of defense decisions.

[0003] Knowledge graphs, as a structured data representation method, can organize knowledge through triples of entities, attributes, and relationships, providing effective support for multi-source knowledge aggregation. However, existing methods for extracting node information from knowledge graphs largely rely on traditional small-scale machine learning models, which cannot meet the needs for accurate aggregation of vulnerability metadata. Summary of the Invention

[0004] The present invention provides a method, apparatus, electronic device, storage medium, and computer program product for vulnerability metadata aggregation based on knowledge graphs, which can improve the accuracy of vulnerability metadata aggregation to a certain extent.

[0005] In a first aspect, the present invention provides a vulnerability meta-knowledge aggregation method based on knowledge graphs, the method comprising:

[0006] Extract the vulnerability entities and their corresponding vulnerability entity attributes from multiple different vulnerability description texts.

[0007] Calculate the semantic vector similarity and the rule-based similarity for any two vulnerability description texts, and then weight the semantic vector similarity results and the rule-based similarity results to obtain a comprehensive similarity.

[0008] The vulnerability entity attributes in multiple vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold are fused to obtain a sub-vulnerability entity set, and the relationship type between any two vulnerability entities in the sub-vulnerability entity set is determined based on a relational reasoning network; multiple sub-vulnerability entity sets constitute a vulnerability entity set;

[0009] Based on any two vulnerability entities in the vulnerability entity set and the relationship type between the two vulnerability entities, construct a relation triplet and store it in a knowledge graph library; wherein, the knowledge graph library represents the result of aggregating vulnerability meta-knowledge from different vulnerability description texts.

[0010] In one embodiment of the present invention, the vulnerability entities and their corresponding vulnerability entity attributes are extracted from multiple different vulnerability description texts, including:

[0011] Multiple original security text sequences are converted into vulnerability description texts using a preset mapping function; each original security text sequence corresponds to one vulnerability description text; the preset mapping function conversion includes at least one of the following: tag removal, structure tag preservation, and field name preservation;

[0012] The vulnerability description text is annotated with entities to obtain vulnerability-annotated text; wherein, the vulnerability-annotated text includes multiple vulnerability entities;

[0013] Based on the vulnerability annotation text and the preset vulnerability extraction strategy, vulnerability entity attributes on multiple different vulnerability description dimensions are extracted from the vulnerability description text; wherein, the vulnerability description dimension includes at least one of the following: vulnerability version range, vendor, component name.

[0014] In one embodiment of the present invention, semantic vector similarity and rule-based similarity are calculated for any two vulnerability description texts, and the semantic vector similarity results and rule-based similarity results are weighted to obtain a comprehensive similarity, including:

[0015] Map any two vulnerability description texts to the same semantic space to obtain the first semantic vector and the second semantic vector;

[0016] The semantic similarity is obtained by calculating the similarity between the first semantic vector and the second semantic vector.

[0017] The similarity of any two vulnerability description texts is calculated based on rule validation to obtain the rule validation similarity; wherein, the rule validation similarity includes rule validation of multiple different dimensions;

[0018] The semantic similarity and the rule verification similarity are weighted and summed according to a preset weight coefficient to obtain a comprehensive similarity; wherein the sum of the weights of the semantic similarity and the rule verification similarity is 1.

[0019] In one embodiment of the present invention, the rule verification of different dimensions includes number format verification, version range logic verification, vendor / component consistency verification, patch information verification, and PoC / EXP matching verification; similarity calculation based on rule verification is performed on any two vulnerability description texts to obtain rule verification similarity, including:

[0020] If the numbering formats of any two vulnerability description texts match, the first matching degree corresponding to the numbering format verification is set to 1; or, if the numbering formats of any two vulnerability description texts do not match, the first matching degree corresponding to the numbering format verification is set to 0.

[0021] If any two vulnerability description texts correspond to the same version range, the second matching degree corresponding to the version range logical verification is set to 1; or, if any two vulnerability description texts correspond to different version ranges, the second matching degree corresponding to the version range logical verification is set to 0.

[0022] If the vendors / components corresponding to any two vulnerability description texts are the same, the third matching degree corresponding to the vendor / component consistency check is set to 1; or, if the vendors / components corresponding to any two vulnerability description texts are different, the third matching degree corresponding to the vendor / component consistency check is set to 0.

[0023] If any two vulnerability description texts reference the same patch link or patch number, the fourth matching degree corresponding to the patch information verification is set to 1; or, if any two vulnerability description texts do not reference the same patch link and do not reference the same patch number, the fourth matching degree corresponding to the patch information verification is set to 0.

[0024] If the same echo exists in the exploit code of any two vulnerability description texts, set the fifth matching degree corresponding to the PoC / EXP matching verification to 1; or, if different echoes exist in the exploit code of any two vulnerability description texts, set the fifth matching degree corresponding to the PoC / EXP matching verification to 0.

[0025] The first matching degree, the second matching degree, the third matching degree, the fourth matching degree, and the fifth matching degree are summed according to preset weight coefficients to obtain the rule verification similarity; wherein, the sum of the preset weight coefficients corresponding to the first matching degree, the second matching degree, the third matching degree, the fourth matching degree, and the fifth matching degree is 1.

[0026] In one embodiment of the present invention, vulnerability entity attributes from multiple vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold are fused to obtain a sub-vulnerability entity set. The relationship type between any two vulnerability entity attributes in the sub-vulnerability entity set is then determined based on a relational reasoning network, including:

[0027] The vulnerability entity attributes from multiple vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold are input into a preset large model to obtain a set of sub-vulnerability entities; wherein, the preset large model is used to merge two similar vulnerability entity attributes into one vulnerability entity attribute;

[0028] Based on the relational reasoning network, the relationship type between any two vulnerability entities in the sub-vulnerability entity set is determined in the same vulnerability description text or two similar vulnerability description texts.

[0029] In one embodiment of the present invention, the method further includes:

[0030] Generate an explanatory description based on any two of the vulnerability entities, vulnerability entity attributes, and their relationship types, and send the explanatory description and any two of the vulnerability entity attributes to the nodes in the knowledge graph database for verification by security experts;

[0031] Receive structured feedback from security experts on the verification results of the explanatory statement, and transform the structured feedback into training samples to adjust the corresponding entity annotation model, attribute extraction model, and relation reasoning network.

[0032] In one embodiment of the present invention, the method further includes:

[0033] The vulnerability entity is input into a preset rule reasoning model to obtain the propagation chain, supply chain, and exploitation chain representing the vulnerability entity; wherein the preset rule reasoning model pre-stores the knowledge graph library;

[0034] The vulnerability entity is input into a preset graph neural network model to determine the nodes in the knowledge graph that are related to the vulnerability entity.

[0035] Based on the propagation chain, the supply chain, the exploitation chain, and the nodes that are related to the vulnerable entity, a target knowledge graph is constructed for the vulnerable entity.

[0036] In one embodiment of the present invention, the method further includes:

[0037] Generate extraction confidence scores for each node of the target knowledge graph, and graph relationship consistency scores for each node in the target knowledge graph;

[0038] The target knowledge graph is sent to security experts for verification, and the security experts' verification scores for the target knowledge graph are received.

[0039] The confidence score is obtained by assigning different weights to the extraction confidence score, the graph relationship consistency score, and the expert verification score, and then summing them together.

[0040] If the credibility score is greater than or equal to a preset score, the target knowledge graph is marked as trustworthy; or, if the credibility score is less than a preset score, the target knowledge graph for the vulnerable entity is reconstructed.

[0041] Secondly, the present invention provides a vulnerability meta-knowledge aggregation device based on a knowledge graph, the vulnerability meta-knowledge aggregation device based on a knowledge graph comprising:

[0042] The entity extraction module is used to extract vulnerability entities and their corresponding vulnerability entity attributes from multiple different vulnerability description texts.

[0043] The similarity calculation module is used to calculate the semantic vector similarity of any two vulnerability description texts, as well as the similarity of rule verification, and to weight the semantic vector similarity results and the rule verification similarity results to obtain a comprehensive similarity.

[0044] The relational reasoning module is used to fuse the vulnerability entity attributes in multiple vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold to obtain a sub-vulnerability entity set, and to determine the relationship type between any two vulnerability entities in the sub-vulnerability entity set based on the relational reasoning network; multiple sub-vulnerability entity sets constitute a vulnerability entity set;

[0045] The entity aggregation module is used to construct relation triples based on any two vulnerability entities in the vulnerability entity set and the relationship type between the two vulnerability entities, and store them in the knowledge graph library; wherein, the knowledge graph library represents the result of aggregating vulnerability meta-knowledge from different vulnerability description texts.

[0046] Thirdly, the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the vulnerability meta-knowledge aggregation method based on knowledge graph as described above.

[0047] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the vulnerability meta-knowledge aggregation method based on knowledge graph as described above.

[0048] Fifthly, the present invention provides a computer program product, including a computer program, which, when executed by a processor, causes the computer to perform the vulnerability meta-knowledge aggregation method based on knowledge graph as described above.

[0049] This invention achieves preliminary structuring of vulnerability information by structuring multi-source vulnerability description text, identifying and extracting core entities and corresponding feature attributes from unstructured text. Then, it performs dual similarity calculation and weighting on any two vulnerability texts. On one hand, it quantifies the semantic relevance of the texts using semantic vectors; on the other hand, it verifies the consistency of key features through rule validation. The results of both are then fused according to weights to obtain a comprehensive similarity score, avoiding the bias of single similarity calculations. For vulnerability texts that meet the similarity threshold, duplicate or similar entity attributes are merged to form sub-entity sets. Potential relationships between entities are mined through a relational reasoning network to clarify the relationship types. Finally, entities and relationships are combined into standardized triples and stored in a knowledge graph database, achieving graph-based aggregation and unified storage of dispersed vulnerability meta-knowledge, thereby improving the accuracy of vulnerability meta-knowledge aggregation to a certain extent. Attached Figure Description

[0050] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other embodiments based on these drawings without creative effort.

[0051] Figure 1 This is a flowchart illustrating a vulnerability metadata aggregation method based on a knowledge graph, provided in an embodiment of the present invention.

[0052] Figure 2 This is a schematic diagram of the structure of a vulnerability meta-knowledge aggregation device based on a knowledge graph, provided in an embodiment of the present invention.

[0053] Figure 3 This is a schematic diagram of an electronic device provided according to an embodiment of the present invention. Detailed Implementation

[0054] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0055] With the rapid expansion of global information systems and the continuous evolution of cyberattack techniques, the number of vulnerabilities is growing exponentially. The speed of vulnerability data updates, its complexity, and the diversity of its sources far exceed the processing capabilities of traditional manual methods. Currently, various authoritative vulnerability databases (such as CNVD, CNNVD, and NVD), security vendor announcements, open-source community security bulletins, technical forum discussions, GitHub vulnerability reproduction projects, and various exploit code samples (PoC / EXP) contain a large amount of semi-structured, weakly structured, and even completely unstructured vulnerability knowledge. This vulnerability knowledge often coexists in multiple forms, including natural language, code snippets, structured tags, and patch instructions, making information extraction, semantic understanding, and knowledge fusion extremely difficult.

[0056] Traditional vulnerability knowledge construction methods primarily rely on manual annotation, rule engines, or small-scale machine learning models. While manual methods are accurate, they are extremely inefficient and struggle to adapt to the ever-increasing scale of vulnerabilities. Rule-based methods are highly sensitive to language expression and struggle to cover complex semantics. Extraction methods based on traditional models often rely heavily on feature engineering, which performs poorly when extracting complex semantic relationships across documents and sentence structures. Furthermore, many vulnerability descriptions contain domain terminology, contextual dependencies, and cross-document references, making it difficult to guarantee knowledge quality through automation alone. Manual verification and correction are often necessary, further increasing the workload. Therefore, traditional vulnerability knowledge extraction methods face significant challenges in handling these complex scenarios, and their limitations are as follows:

[0057] (1) High heterogeneity of multiple sources makes unified modeling difficult: Traditional vulnerability handling processes usually rely on human experience or rule-based extraction methods to understand vulnerability data from different sources. However, vulnerability information sources are highly diverse: natural language descriptions (such as security bulletins, CVE summaries); HTML / Markdown structured documents (such as vendor blogs, open source announcements); JSON format announcements (NVD / CNVD interface data); source code or exploit code (PoC / EXP); community discussion content (Issue, forum replies, Q&A interactions). The different data source formats and semantic structures vary greatly, making it difficult for traditional extraction methods based on pattern matching, regular rules, or shallow machine learning to process them under a unified framework. For example, the vulnerability triggering conditions in code snippets are completely different from the cause statements in natural language descriptions. Traditional methods often need to design features and rules independently for each data type, making it difficult to adapt to large-scale scenarios.

[0058] (2) Complex entity categories and ambiguous boundaries: Key entities in vulnerability texts include: vulnerability type, root cause components, exploitation conditions, triggering methods, affected assets, version range, vendor name, patches and remediation plans, etc. These entities exhibit the following characteristics in the security context: Loosely structured and diverse in expression: the same vulnerability may manifest in different ways, such as natural language, code, and configuration items; Complex referential relationships: Ambiguous referents such as "the problem," "the aforementioned component," and "this vulnerability" make extraction difficult; There is a clear cross-sentence dependency: the description of the vulnerability's cause and the attack method may be distributed across multiple sentences or even multiple paragraphs; Inconsistent naming: The same software may have different version names or aliases in different sources. Traditional NER models rely on fixed vocabularies or shallow context modeling, making it difficult to accurately identify the complex entities mentioned above, and even more difficult to handle cross-sentence relationships, code semantics and natural language mixtures.

[0059] (3) Lack of knowledge fusion and semantic unification mechanisms: Vulnerability knowledge often involves multiple sources, and the descriptions are inconsistent. For example, the same vulnerability may use different numbers in different databases (such as CVE-XXXX, CNVD-XXXX, vendor internal numbers). There are differences in the granularity of description details (such as some platforms providing the scope of impact, while other sources provide exploitation conditions or PoC links). Product names, version numbers, and patch numbers lack unified standards in different documents. The lack of a unified data model and fusion mechanism will lead to knowledge fragmentation, making it difficult to build a complete vulnerability profile. Traditional methods usually rely on rules or manual merging, which are insufficient in reliability and scalability.

[0060] (4) Fully automated systems struggle to achieve reliable quality: Although automation technology can handle large-scale data, vulnerability data is highly specialized, semantically complex, and expressed in diverse ways. Relying entirely on machine extraction often leads to: Error entity identification; Semantic ambiguity leading to entity confusion; Incorrect entity relationship chain; Key fields such as version range and affected products failed to be parsed. In the security field, such errors can lead to misjudgments in vulnerability assessments, incorrect patching strategies, or even an expansion of security risks. Therefore, expert verification must be introduced to form a traceable and correctable knowledge extraction loop.

[0061] (5) Traditional knowledge bases struggle to support deep reasoning and security analysis: Many vulnerability databases on the market store information only in a structured field format, making it difficult to perform deep reasoning, such as: Vulnerability root cause tracing: deducing the code causes and triggering paths from the apparent vulnerability; Utilizing chain reasoning: combining multiple vulnerabilities to form an attack path; Impact assessment: Inferring the spread and impact of a single vulnerability within the software supply chain; Vulnerability propagation path analysis: Identify potential risk propagation nodes in the dependency chain. Traditional tabular knowledge bases cannot express complex entity relationship networks, and are even less able to support graph-structured reasoning.

[0062] In conclusion, as the scale of vulnerability data continues to expand, the semantic structure becomes increasingly complex, and the need for semantic fusion becomes more urgent, traditional automated methods and shallow models can no longer meet the requirements of modern cybersecurity systems for the accuracy, comprehensiveness, and reasonability of vulnerability knowledge.

[0063] Based on this, this invention performs structuring processing on multi-source vulnerability description text, identifying and extracting core entities and corresponding feature attributes from unstructured text to achieve preliminary structuring of vulnerability information. Then, it performs dual similarity calculation and weighting on any two vulnerability texts. On the one hand, it quantifies the semantic relevance of the texts through semantic vectors; on the other hand, it verifies the consistency of key features through rule validation. The results of both are then fused according to weights to obtain a comprehensive similarity, avoiding the bias of single similarity calculation. For vulnerability texts that meet the similarity threshold, duplicate or similar entity attributes are merged to form a sub-entity set; potential associations between entities are mined through a relational reasoning network to clarify the relation types. Finally, entities and relations are combined into standardized triples and stored in a knowledge graph database, achieving graph-based aggregation and unified storage of dispersed vulnerability meta-knowledge, thereby improving the accuracy of vulnerability meta-knowledge aggregation to a certain extent.

[0064] Please see Figure 1 The embodiments of this invention provide a method for aggregating vulnerability meta-knowledge based on knowledge graphs. This method may include the following steps.

[0065] Step S110: Extract the vulnerability entities and their corresponding vulnerability entity attributes from multiple different vulnerability description texts.

[0066] In this embodiment, vulnerability meta-knowledge refers to the basic information of a vulnerability, including structured knowledge units such as vulnerability entities (e.g., vulnerability number, affected components), entity attributes (e.g., version range, vendor), and relationships between entities (e.g., "impact" and "dependency").

[0067] In this embodiment, the knowledge graph is a graph-based data model composed of nodes (entities) and edges (relationships between entities), used to intuitively represent the relationships between knowledge. The knowledge graph library in this invention refers to a structured database that stores vulnerability entities, attributes, and relation triples.

[0068] In this embodiment, the core objects related to the vulnerability entity include the vulnerability number (CVE-XXXX-XXXX), affected vendors (Microsoft, Huawei), and components (Windows system, Apache server). Vulnerability entity attributes refer to the characteristic information describing the vulnerability entity. For example, the attributes of the vulnerability entity "CVE-2024-0001" may include the version range (Windows 10 1903-21H2), vendor (Microsoft), etc.

[0069] In this embodiment, the vulnerability description texts are massive amounts of vulnerability data from various sources. These data are diverse in form, covering natural language descriptions, patch information, product lists, impact scope descriptions, security scan results, and PoC / EXP samples released by attackers in communities or code repositories. The vulnerability information described by multiple vulnerability description texts from different sources has problems such as structural differences, inconsistent naming, and inconsistent description granularity, which brings great challenges to vulnerability correlation analysis and knowledge integration.

[0070] In this embodiment, the vulnerability description text is first standardized, and then entity boundaries are identified based on BIO / BIOES to obtain the vulnerability entity information in the vulnerability description text. Then, attribute extraction is performed on the entity-annotated vulnerability description text to extract attributes related to the product affected by the vulnerability.

[0071] Step S120: Calculate the semantic vector similarity and the rule verification similarity for any two vulnerability description texts, and weight the semantic vector similarity result and the rule verification similarity result to obtain the comprehensive similarity.

[0072] In this embodiment, the semantic vector is a vector representation of text in a high-dimensional space, used to quantify the semantic similarity of text, so that the relevance of unstructured text can be calculated through mathematical methods.

[0073] In this embodiment, the preset threshold refers to a similarity threshold (such as 0.7) set according to the actual application scenario. It is used to determine whether two vulnerability description texts belong to the same vulnerability or highly related vulnerabilities, and serves as the basis for entity attribute fusion.

[0074] In this embodiment, dual similarity calculation and weighting are used to quantify the semantic relevance of texts through semantic vectors and verify the consistency of key features through rule validation. The results of the two are then fused according to weights to obtain a comprehensive similarity, thus avoiding the bias of single similarity calculation.

[0075] Step S130: Merge the vulnerability entity attributes in multiple vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold to obtain a sub-vulnerability entity set, and determine the relationship type between any two vulnerability entities in the sub-vulnerability entity set based on a relational reasoning network; multiple sub-vulnerability entity sets constitute a vulnerability entity set.

[0076] In this embodiment, if the overall similarity is greater than or equal to a preset threshold, it indicates that the two vulnerability description texts are highly similar and describe the same vulnerability entity. Therefore, the vulnerability entities in these two vulnerability description texts can be fused to form a sub-vulnerability entity set. For example, a preset large model is used to determine whether A and B in the two vulnerability description texts point to the same vulnerability entity. If so, A or B is added to the sub-vulnerability entity set. In other words, name disambiguation is performed on the vulnerability entities in the two vulnerability description texts describing the same vulnerability entity, and then the intersection of the vulnerability entities in the two vulnerability description texts is calculated to obtain the sub-vulnerability entity set.

[0077] In this embodiment, multiple vulnerability description texts can be divided into multiple categories based on comprehensive similarity. Each category represents a description of the same vulnerable entity. Then, a sub-vulnerability entity set can be established for each category. Multiple sub-vulnerability entity sets form a vulnerability entity set.

[0078] In this embodiment, the relational reasoning network is a deep learning or rule-based model used to mine and determine the semantic relationship between two vulnerable entities (such as "vulnerability affects components" or "component belongs to a vendor").

[0079] Specifically, many vulnerability descriptions contain relationships that span multiple sentences or even paragraphs, such as: "This vulnerability affects version XXX... An attacker can exploit this vulnerability... to trigger out-of-bounds writes," etc. This invention treats relationship extraction as a cross-sentence reasoning task and automatically captures it using a long-range attention mechanism of a large model.

[0080] Let there be two entities , In text, it is represented as , The model calculates the probability of their relationship:

[0081]

[0082] in, It is global context encoding. It is a relational reasoning network (which can be a Transformer or Pointer Network). Based on this method, it can identify multiple types of relationships such as "vulnerability-cause", "vulnerability-attack condition", "vulnerability-affected component", "vulnerability-patch", and "PoC-vulnerability number", and is suitable for relational chains with large spans such as across sentences, paragraphs, and texts.

[0083] Step S140: Construct a relation triple based on any two vulnerability entities in the vulnerability entity set and the relationship type between the two vulnerability entities, and store it in the knowledge graph library; wherein, the knowledge graph library represents the result of aggregating vulnerability meta-knowledge from different vulnerability description texts.

[0084] In this embodiment, it is assumed that the fused set of vulnerability entities is:

[0085]

[0086] in, A sub-vulnerability entity set includes types such as vulnerability entities, products, components, versions, supply chain nodes, PoC / EXP, and patches. The relationship set in the knowledge graph is represented as follows: .

[0087] Each relationship In triplet form:

[0088]

[0089] in, Subject entity, For relational types, This is an object entity. Typical relationships include: vulnerability → impact → product, product → contain → component, vulnerability → impact → version range, vulnerability → have → attack conditions, vulnerability → correspond to → PoC, vulnerability → fix → patch.

[0090] The overall diagram structure is represented as follows: This graph not only includes a static structure, but also incorporates sequential structures such as version chains and supply chain dependency chains, giving the graph strong expressive power.

[0091] In this embodiment, relation triples are the core data units of the knowledge graph, formatted as (head entity, relation type, tail entity), such as (CVE-2024-0001, impact, Windows 10). Specifically, for example, relations extracted from the large model (such as "impacted version," "attack conditions," "causal mechanism," etc.) need to be mapped to graph-structured relations. Given the relation text output by the large model:

[0092]

[0093] It needs to be parsed into relational triples:

[0094]

[0095] The parsing functions include: text-relation template matching, semantic role labeling, referential resolution, and relation mapping tables. For example, the texts "This vulnerability affects Apache Log4j 1.2.x" and "An attacker can trigger remote command execution by exploiting unauthorized access" will generate: , This forms the basic structure of the relationship chain.

[0096] The constructed graph structure data needs to be stored in the Neo4j graph database to obtain the knowledge graph library. The entity set, attribute set, and relation set are modeled as follows:

[0097]

[0098]

[0099] in, The confidence level for a relationship is determined jointly by the extracted confidence level and the fused confidence level. Graph databases provide efficient graph traversal capabilities, relationship query capabilities, deep path search capabilities, and inference result storage capabilities.

[0100] In the above embodiments, by structuring the multi-source vulnerability description text, core entities and corresponding feature attributes are identified and extracted from the unstructured text, achieving preliminary structuring of vulnerability information. Then, a dual similarity calculation and weighting is performed on any two vulnerability texts. On the one hand, semantic vectors quantify the semantic relevance of the texts; on the other hand, rule verification verifies the consistency of key features. The results of both are then fused according to weights to obtain a comprehensive similarity, avoiding the bias of a single similarity calculation. For vulnerability texts that meet the similarity threshold, duplicate or similar entity attributes are merged to form a sub-entity set; potential associations between entities are mined through a relational reasoning network to clarify the relation types. Finally, entities and relations are combined into standardized triples and stored in a knowledge graph database, achieving graph-based aggregation and unified storage of dispersed vulnerability meta-knowledge, thereby improving the accuracy of vulnerability meta-knowledge aggregation to a certain extent.

[0101] Furthermore, by using dual similarity calculation to improve the accuracy of vulnerability association judgment, and by using relational reasoning to achieve structured association of vulnerability knowledge, the problem of fragmented and inconsistent expression of existing vulnerability knowledge can be solved. The knowledge graph library finally constructed can realize centralized management of vulnerability meta-knowledge, provide unified knowledge support for subsequent vulnerability analysis and early warning, and improve the efficiency of vulnerability assessment.

[0102] In some embodiments, step S110 may include the following steps: extracting vulnerability entities and their corresponding vulnerability entity attributes from multiple different vulnerability description texts.

[0103] Step S111: Convert multiple original security text sequences into vulnerability description texts using a preset mapping function; wherein each original security text sequence corresponds to a vulnerability description text; the preset mapping function conversion includes at least one of the following: tag removal, structure tag preservation, and field name preservation.

[0104] In this embodiment, the original security text sequence refers to the unprocessed original information of multi-source vulnerabilities, such as the full text of security bulletins, the original description of vulnerability databases, technical blog articles, etc., which are mostly unstructured text.

[0105] In this embodiment, the preset mapping function refers to a predefined text conversion rule used to transform unstructured raw security text into vulnerability description text with a unified format and retained key information, supporting three structured representation methods. Tag removal, structure mark retention, and field name retention are all processing methods of the mapping function. Tag removal removes redundant tags (such as HTML tags and formatting tags) from the text, retaining only the core information of the plain text. Structure mark retention preserves key structural marks (such as heading marks and paragraph separators) in the text, facilitating subsequent entity location and extraction. Field name retention preserves field names related to the vulnerability (such as "version," "vendor," and "patch") in the text, providing guidance for attribute extraction.

[0106] In this embodiment, different vulnerability description texts may originate from official CVE announcements; CNVD and CNNVD national vulnerability databases; vendor announcements; GitHub open-source project announcements; annotation text of PoC / EXP samples; and security forum discussions. Since different platforms use different language styles and formats, they need to be first converted into a unified representation that can be processed by a large model. Assume the original security text sequences from different data sources are represented as follows:

[0107]

[0108] Generate semantic embeddings using a large model encoder:

[0109]

[0110] in, For the first The semantic vector representation of each text reflects its vulnerability semantic features, including the scope of impact, cause description, ID reference, and vendor information. Meanwhile, to enhance the comparability of texts from different sources within the same semantic space, this invention employs a semantic normalization function: The normalization function is used as the vulnerability description text in subsequent entity annotation and attribute extraction.

[0111] Step S112: Perform entity annotation on the vulnerability description text to obtain vulnerability annotation text; wherein, the vulnerability annotation text includes multiple vulnerability entities.

[0112] In this embodiment, entity annotation uses manual or automatic annotation tools to mark the vulnerable entities in the vulnerability description text (such as using tags to mark the vulnerability number and vendor name) and generate vulnerability annotation text.

[0113] In this embodiment, to identify vulnerable entities (such as vulnerability type, affected software, version number, attack conditions, etc.), this invention employs sequence labeling technology, inputting the token sequence encoded by the large model into a classification head to generate BIO / BIOES tags. Let the vector representation of the large model be:

[0114]

[0115] The entity label for each token is generated by the following classifier:

[0116]

[0117] in, Alternatively, BIOES extended tags can be used to identify the boundaries and types of entities. Compared to traditional NER, this invention further integrates entity definitions from the security domain and constrains the scope of entities through prompt words, such as: "Please label the following text based on vulnerability semantics: (1) vulnerability name; (2) affected product; (3) version range; (4) vulnerability cause. Use BIOES format for labeling." This prompt word mechanism ensures that the model is specifically identified according to security semantic tasks, effectively improving accuracy.

[0118] Step S113: Based on the vulnerability annotation text and the preset vulnerability extraction strategy, extract vulnerability entity attributes from the vulnerability description text on multiple different vulnerability description dimensions; wherein, the vulnerability description dimension includes at least one of the following: vulnerability version range, vendor, component name.

[0119] In this embodiment, the preset vulnerability extraction strategy predefines attribute extraction rules or models to accurately extract corresponding entity attributes for different vulnerability description dimensions (such as extracting version range attributes from "Affected version: Windows 10 1903-21H2").

[0120] In this embodiment, the vulnerability description dimension refers to the classification dimension of vulnerability attributes. The core includes version range (the range of software and hardware versions affected by the vulnerability), vendor (the software and hardware vendors involved in the vulnerability), and component name (the specific software and hardware components affected). Other dimensions can be expanded as needed.

[0121] Specifically, some vulnerable entities have multidimensional attributes (such as CVE-ID publication time, CVSS score, attack vector, affected components, etc.). This invention uses a generative extraction strategy, treating attribute extraction as a conditional generation problem.

[0122] Given entity With text Attribute extraction is represented as:

[0123]

[0124] in, For example: "Please extract the attributes related to the products affected by the vulnerability from the text: {version range, vendor, component name}, and return them in JSON format." The large model automatically completes the structured attributes based on the context, thus avoiding the limitations of traditional attribute filling methods that rely on rules.

[0125] In the above embodiments, multi-source unstructured raw security text is transformed into uniformly formatted vulnerability description text through a preset mapping function. Three structured representation methods can be flexibly selected according to the text type, ensuring that critical information is not lost. The transformed vulnerability description text is then labeled with entities to identify the core vulnerability entities within the text, laying the foundation for subsequent attribute extraction. Based on the labeled text and a preset extraction strategy, the attribute information corresponding to each entity is accurately extracted according to the set vulnerability description dimensions, achieving a structured transformation of vulnerability information from "text" to "entity-attribute".

[0126] The above embodiments eliminate format differences between texts from different channels by standardizing multi-source original text, and ensure the integrity and accuracy of vulnerability entity and attribute information through precise entity annotation and attribute extraction. This provides high-quality structured data input for subsequent similarity calculation and entity fusion, thereby improving the reliability of the entire aggregation method.

[0127] In some embodiments, in step S120, the semantic vector similarity calculation and the rule verification similarity calculation are performed on any two vulnerability description texts, and the semantic vector similarity result and the rule verification similarity result are weighted to obtain a comprehensive similarity, which may include the following steps.

[0128] Step S121: Map any two vulnerability description texts in the same semantic space to obtain the first semantic vector and the second semantic vector.

[0129] In this embodiment, the same semantic space is a vector space constructed by a pre-trained language model (such as BERT or RoBERTa). This allows texts with similar semantics to be mapped to vectors that are closer in distance, while texts with large semantic differences are mapped to vectors that are farther apart, thus quantifying the semantics of the text. The first semantic vector and the second semantic vector correspond to two vulnerability description texts to be compared, respectively. The high-dimensional vectors obtained after semantic space mapping are the objects of semantic similarity calculation.

[0130] Specifically, for two vulnerability description texts to be compared... , , generation and The corresponding first semantic vector and with The corresponding second semantic vector .

[0131] In some alternative implementations, semantic associations such as "A security vendor disclosed a remotely exploitable heap overflow vulnerability today," "A CVE was discovered in version 2.3.4 of this component," and "The PoC addresses an unpatched issue in an older version" are often difficult to identify directly using traditional rules. To further enhance the quality of semantic judgment, a multi-representation fusion strategy is adopted, jointly calculating the final semantic vector by combining the text description, the list of affected components, vendor name embedding, and version number sequence embedding. This allows for the automatic determination of corresponding relationships.

[0132] Step S122: Calculate the similarity between the first semantic vector and the second semantic vector to obtain the semantic similarity.

[0133] In this embodiment, semantic similarity is calculated based on the distance (e.g., cosine distance, Euclidean distance) between two semantic vectors, resulting in a value (0-1 range). The closer the value is to 1, the more semantically similar the two texts are. The semantic similarity is calculated as follows:

[0134]

[0135] in, and These represent the results after normalizing the first semantic vector and the second semantic vector, respectively. This indicates the similarity between two vulnerability description texts to be compared.

[0136] Step S123: Perform rule-based similarity calculation on any two vulnerability description texts to obtain rule-based similarity; wherein, the rule-based similarity includes rule verification of multiple different dimensions.

[0137] In this embodiment, the rule verification similarity refers to the similarity obtained after verifying the consistency of the key features of two vulnerability description texts based on preset rules. It reflects the degree of matching of the texts in specific feature dimensions, thereby strengthening the misjudgment that may be introduced by semantic vector matching. This invention constructs a rule verification channel to verify whether the vulnerability is confirmed to be the same vulnerability through string patterns, field logic, version constraints and other means.

[0138] Step S124: The semantic similarity and the rule verification similarity are weighted and summed according to a preset weight coefficient to obtain a comprehensive similarity; wherein the sum of the weights of the semantic similarity and the rule verification similarity is 1.

[0139] In this embodiment, the preset weight coefficient is a weight value set according to the importance of semantic similarity and rule verification similarity (e.g., semantic similarity weight 0.6, rule verification similarity weight 0.4), and the sum of the two is 1, ensuring that the weighted summation result is within a reasonable range.

[0140] In this embodiment, the final fusion decision adopts a dual-channel fusion strategy, which unifies the calculation of the results from the semantic channel and the rule channel:

[0141]

[0142] in, For semantic similarity, Rule validation results This is the fusion coefficient. When the fusion determination value satisfies... When the overall similarity is greater than or equal to a preset threshold, the texts are considered to correspond to the same vulnerable entity. The preset threshold is used. The final output entity link of the fusion algorithm, that is, the set of sub-vulnerable entities, can be represented as:

[0143]

[0144] Each entity It contains meta-knowledge describing the same vulnerable entity from different data sources.

[0145] The above embodiments achieve quantitative representation of text semantics by inputting two vulnerability description texts into a pre-trained language model and transforming them into corresponding semantic vectors in the same semantic space. Then, the correlation between the two semantic vectors is calculated using a vector distance algorithm to obtain a semantic similarity result. Furthermore, based on preset multi-dimensional rules, the consistency of the two texts in key features is verified to obtain a rule-verified similarity, overcoming the deficiency of semantic similarity which only focuses on the overall semantics of the text and ignores specific features. Finally, the semantic similarity and rule-verified similarity are fused according to preset weight coefficients to obtain a comprehensive similarity, taking into account both the overall semantics of the text and specific features, thus improving the accuracy of similarity judgment.

[0146] The above embodiments overcome the limitations of single similarity calculation. Through dual verification of "semantics + rules", they consider both the overall semantic association of the text and the consistency of key features. The comprehensive similarity obtained after weighted fusion is more in line with the actual needs of vulnerability knowledge aggregation, effectively reducing similarity judgment errors caused by semantic ambiguity or feature loss, and providing accurate basis for entity attribute fusion.

[0147] In some embodiments, the rule verification of different dimensions includes number format verification, version range logic verification, vendor / component consistency verification, patch information verification, and PoC / EXP matching verification; in step S123, the similarity calculation based on rule verification is performed on any two vulnerability description texts to obtain the rule verification similarity, which may include the following steps.

[0148] Step S1231: If the number formats of any two vulnerability description texts match, set the first matching degree corresponding to the number format verification to 1; or, if the number formats of any two vulnerability description texts do not match, set the first matching degree corresponding to the number format verification to 0.

[0149] In this embodiment, the number format verification checks the format standardization and consistency of vulnerability numbers (such as CVE and CNVD numbers). The vulnerability number is one of the unique identifiers of a vulnerability, and the format matching degree directly reflects the vulnerability's relevance. For example, if the number formats of two different vulnerability description texts, CVE-2024-12345↔CNVD-2024-12345, are consistent, then the first matching degree is 1. Conversely, if the number formats of two different vulnerability description texts are inconsistent, then the first matching degree is 0.

[0150] Step S1232: If the version ranges corresponding to any two vulnerability description texts belong to the same version range, set the second matching degree corresponding to the version range logical verification to 1; or, if the version ranges corresponding to any two vulnerability description texts do not belong to the same version range, set the second matching degree corresponding to the version range logical verification to 0.

[0151] In this embodiment, the version range logic check is used to verify whether there is an overlap or inclusion relationship between the affected version ranges recorded in the two vulnerability description texts, and to determine whether they target the same batch of software and hardware versions. For example, if the version descriptions of the two data sources are inconsistent, the match will fail. In this case, the corresponding second matching degree is 0. If it is a subset relation... If so, the second matching degree is 1.

[0152] Step S1233: If the vendors / components corresponding to any two vulnerability description texts are consistent, set the third matching degree corresponding to the vendor / component consistency check to 1; or, if the vendors / components corresponding to any two vulnerability description texts are inconsistent, set the third matching degree corresponding to the vendor / component consistency check to 0.

[0153] In this embodiment, vendor / component consistency verification is used to check whether the vendors and affected components involved in the vulnerabilities described in two texts are consistent, which is one of the core features for determining vulnerability correlation. Logical comparison is performed using vendor names, component names, and product line keywords. For example, if text A describes "Apache Log4j" and text B describes "Nginx," they are directly determined to be different vulnerabilities, and the third-degree match is 0. If the descriptions in text A and text B point to the same vulnerability, the third-degree match is 1.

[0154] Step S1234: If any two vulnerability description texts reference the same patch link or patch number, set the fourth matching degree corresponding to the patch information verification to 1; or, if any two vulnerability description texts do not reference the same patch link and do not reference the same patch number, set the fourth matching degree corresponding to the patch information verification to 0.

[0155] In this embodiment, patch information verification involves checking the consistency of patch links and patch numbers referenced by two text files. The same vulnerability typically corresponds to the same patch, and patch information consistency is strong evidence of vulnerability association. If two text files reference the same patch link or patch number, the fourth match degree is 1. If two text files do not reference the same patch link or the same patch number, the fourth match degree is 0.

[0156] Step S1235: If the same echo exists in the exploit code of any two vulnerability description texts, set the fifth matching degree corresponding to the PoC / EXP matching verification to 1; or, if different echoes exist in the exploit code of any two vulnerability description texts, set the fifth matching degree corresponding to the PoC / EXP matching verification to 0.

[0157] In this embodiment, PoC (Proof of Confirmation) and EXP (Exploitation Programming) are the core technical characteristics of the vulnerability. Verifying the consistency of the echoed information in both exploit codes determines whether they represent the same vulnerability. If the exploit code contains the structure: "This exploit targets CVE-2024-XXXX", a mapping relationship can be directly established. The output of the rule channel is a binary classification result: Here, 1 indicates that the relationship may be true, and 0 indicates direct negation. If the output result is 1, then the fifth matching degree is also 1; if the output result is 0, then the fifth matching degree is also 0.

[0158] Step S1236: The first matching degree, the second matching degree, the third matching degree, the fourth matching degree, and the fifth matching degree are summed according to preset weight coefficients to obtain the rule verification similarity; wherein, the sum of the preset weight coefficients corresponding to the first matching degree, the second matching degree, the third matching degree, the fourth matching degree, and the fifth matching degree is 1.

[0159] In this embodiment, the first, second, third, fourth, and fifth matching scores correspond to the matching results of the five verification dimensions, respectively. They are represented using a 0-1 binary format, where 1 represents a complete match and 0 represents a no-match, simplifying the judgment logic within each dimension. Preset weights are assigned to the matching scores of the five dimensions (e.g., manufacturer / component verification weight 0.3, patch information verification weight 0.25, and other dimensions weights are assigned sequentially), with the sum of the weights being 1. The weighted sum of the matching scores of each dimension yields the rule verification similarity, achieving a comprehensive evaluation of multi-dimensional features.

[0160] The above embodiments, by refining the rule verification dimensions, cover five core attributes: vulnerability identifier, scope of impact, associated objects, remediation plan, and technical characteristics. Through binary matching and weighted accumulation, the rule verification similarity calculation is made more targeted and operable, significantly improving the accuracy of rule verification, providing reliable feature support for comprehensive similarity, and further reducing the error rate of vulnerability association judgment.

[0161] It is understood that in other embodiments, other rule verification methods may also be included. These other rule verification methods may also adopt a binary representation of 0-1, and then assign different weights to rule verification of different dimensions, and the sum of the weights corresponding to the matching degree of rule verification of different dimensions is 1.

[0162] In some embodiments, in step S130, the vulnerability entity attributes in multiple vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold are fused to obtain a sub-vulnerability entity set, and the relationship type between any two vulnerability entity attributes in the sub-vulnerability entity set is determined based on a relational reasoning network, which may include the following steps.

[0163] Step S131: Input the vulnerability entity attributes from multiple vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold into a preset large model to obtain a set of sub-vulnerability entities; wherein, the preset large model is used to merge two similar vulnerability entity attributes into one vulnerability entity attribute.

[0164] In this embodiment, the pre-set large model refers to a pre-trained natural language processing model (such as GPT or LLaMA) that possesses text understanding and knowledge fusion capabilities, and can normalize the attributes of similar vulnerability entities into a unified representation. The sub-vulnerability entity set is a standardized entity set formed by fusing the entity attributes of texts that meet the comprehensive similarity standard and belong to the same or highly related vulnerabilities. Each set corresponds to the meta-knowledge of a type of vulnerability.

[0165] In this embodiment, if the overall similarity is greater than or equal to a preset threshold, it indicates that the two vulnerability description texts are highly similar and describe the same vulnerability entity. Therefore, the vulnerability entities in these two vulnerability description texts can be fused to form a sub-vulnerability entity set. For example, a preset large model is used to determine whether A and B in the two vulnerability description texts point to the same vulnerability entity. If so, A or B is added to the sub-vulnerability entity set. In other words, name disambiguation is performed on the vulnerability entities in the two vulnerability description texts describing the same vulnerability entity, and then the intersection of the vulnerability entities in the two vulnerability description texts is calculated to obtain the sub-vulnerability entity set.

[0166] Step S132: Based on the relational reasoning network, determine the relationship type between any two vulnerability entities in the sub-vulnerability entity set in the same vulnerability description text or two similar vulnerability description texts.

[0167] In this embodiment, "same vulnerability description text" refers to vulnerability description text from the same source. "Two similar vulnerability texts" refers to description texts that meet the comprehensive similarity standard and belong to highly related vulnerabilities, serving as the contextual basis for relational reasoning.

[0168] In this embodiment, the relational reasoning network is a deep learning or rule-based model used to mine and determine the semantic relationship between two vulnerable entities (such as "vulnerability affects components" or "component belongs to a vendor").

[0169] Specifically, many vulnerability descriptions contain relationships that span multiple sentences or even paragraphs, such as: "This vulnerability affects version XXX... An attacker can exploit this vulnerability... to trigger out-of-bounds writes," etc. This invention treats relationship extraction as a cross-sentence reasoning task and automatically captures it using a long-range attention mechanism of a large model.

[0170] Let there be two entities , In text, it is represented as , The model calculates the probability of their relationship:

[0171]

[0172] in, It is global context encoding. It is a relational reasoning network (which can be a Transformer or Pointer Network). Based on this method, it can identify multiple types of relationships such as "vulnerability-cause", "vulnerability-attack condition", "vulnerability-affected component", "vulnerability-patch", and "PoC-vulnerability number", and is suitable for relational chains with large spans such as across sentences, paragraphs, and texts.

[0173] In the above embodiments, entity attributes from multiple vulnerability texts that meet the comprehensive similarity standard are input into a preset large model. The model normalizes duplicate, synonymous, or inconsistent attributes (e.g., merging "Win10" and "Windows10" into "Windows 10") to generate a sub-vulnerability entity set. Based on a relational reasoning network and combined with the contextual information of the same or similar texts, the semantic association between any two entities in the sub-entity set is mined to determine the relationship type (e.g., "vulnerability-impact-component" or "component-belong-to-vendor").

[0174] The above embodiments achieve intelligent fusion of entity attributes through a large model, solving the problem of inconsistent descriptions of vulnerability attributes in different texts and generating a standardized set of sub-entities; by leveraging relational reasoning networks to mine potential relationships between entities, clarifying the logic of knowledge association, and providing high-quality structured knowledge units for subsequent triple construction and knowledge graph generation, thereby improving the standardization and completeness of the knowledge graph.

[0175] In some embodiments, the vulnerability meta-knowledge aggregation method based on knowledge graphs may further include the following steps.

[0176] Step S151: Generate an explanatory description based on any two of the vulnerability entities, vulnerability entity attributes, and their relationship types, and send the explanatory description and any two of the vulnerability entity attributes to the nodes in the knowledge graph database for verification by security experts.

[0177] In some cases, due to the highly specialized nature of security knowledge, the automated extraction process inevitably suffers from issues such as entity confusion, relational errors, or semantic ambiguity. Therefore, this invention proposes a closed-loop human-machine collaborative process. This mechanism achieves a knowledge credibility enhancement system that combines "machine automation efficiency + human expert judgment" through four stages: generating interpretable summaries from large models, expert verification, feedback learning, and continuous reinforcement fine-tuning.

[0178] In this embodiment, the explanatory description refers to the textual description generated for entities, attributes, and relationship types, which is used to explain the rationality of the knowledge aggregation process and results (such as "the 'impact' relationship between CVE-2024-0001 and Windows 10 is determined based on version range verification and patch information matching"), so as to facilitate the understanding and verification of security experts.

[0179] In one specific embodiment, after the large model completes vulnerability entity identification, attribute extraction, and relationship chain construction, this invention introduces an interpretive generation module to generate readable and traceable explanatory text for each extraction result. It is assumed that the extraction result contains a set of entities. Relation sets and attribute set The explanatory text generation function is represented as:

[0180]

[0181] in, It includes explanatory templates, such as: "Please explain the basis for extracting each vulnerable entity, including: (1) key sentences in the original text; (2) reasons for judging entity boundaries; (3) reasoning steps of the relationship chain; (4) potential uncertainties and possible causes." The explanatory content includes: the original text location corresponding to the entity, the semantic judgment reasons generated by the large model, the basis for each hop in the relationship chain, and hints for possible error locations. For example, for the relationship "vulnerability → impact → Apache Log4j 1.2.x", the explanatory module will output: "The second sentence of the third paragraph of the text contains the phrase "a remote execution vulnerability exists in Log4j 1.2.x". The model judges this entity as an impact component based on entity pattern matching and semantic consistency." The explanatory output facilitates security experts to quickly locate errors and verify correctness, significantly improving verification efficiency.

[0182] Step S152: Receive structured feedback from security experts on the verification results of the explanatory statement, and convert the structured feedback into training samples to adjust the corresponding entity annotation model, attribute extraction model, and relation reasoning network.

[0183] In this embodiment, structured feedback refers to standardized verification results (such as "relationship correct", "attribute fusion error", "a feature needs to be added") given by security experts for explanatory instructions and knowledge nodes, which are easy to convert into model training data.

[0184] In this embodiment, the entity annotation model / attribute extraction model are algorithmic models used to implement vulnerability entity annotation and attribute extraction (such as the BERT-based annotation model and the rule-based and deep learning-based extraction model), which are the core foundational models for knowledge aggregation.

[0185] Specifically, after the explanatory description is generated, the system displays it along with the graph nodes to security experts. The expert verification process includes: verifying the correctness of entity types, the reasonableness of entity boundaries, the accuracy of version ranges, the logical consistency of relationship chains, and the presence of any missing entities or relationships. The expert verification result is expressed as follows:

[0186]

[0187] Each feedback item This includes: feedback type (e.g., entity deletion, entity correction, relationship change, etc.), the corrected structure, the reason for the correction, and the confidence level. The system structures and saves the feedback for incremental training of large models.

[0188] To enable large models to incorporate expert knowledge, this invention introduces an incremental fine-tuning mechanism to convert feedback data into training samples.

[0189] Given the output of the original large model and expert correction results Generate training pairs:

[0190]

[0191] The objective function for the incremental fine-tuning process is:

[0192]

[0193] The system optimizes parameters through backpropagation, gradually aligning the model output with expert annotations. Two fine-tuning strategies are supported: (a) continuous fine-tuning, where accumulated feedback is added to the training set each cycle to continuously optimize model parameters; and (b) reinforcement learning (RLHF, a reward model based on expert feedback), which defines a reward function.

[0194]

[0195] The higher the reward, the more likely the model is to generate similar structures; the more errors there are, the more the model is penalized.

[0196] In the above embodiments, supporting descriptions of entities, attributes, and relationships are generated and submitted to security experts along with knowledge graph nodes. The accuracy of the aggregation results is verified through human experience. The structured feedback from experts is transformed into training samples (such as incorrectly labeled samples, attribute extraction correction samples, and relationship reasoning adjustment samples) to iteratively optimize the entity labeling model, attribute extraction model, and relationship reasoning network, thereby improving model performance.

[0197] In the above embodiments, the introduction of a manual verification step compensates for the limitations of automatic machine aggregation, ensuring the accuracy of the vulnerability metadata aggregation results. Furthermore, by iteratively optimizing the model through expert feedback, a closed loop of "automatic aggregation - manual verification - model optimization" is formed, improving the generalization ability and stability of the entire method and adapting it to vulnerability knowledge aggregation needs in more scenarios.

[0198] In some embodiments, the vulnerability meta-knowledge aggregation method based on knowledge graphs may further include the following steps.

[0199] Step S161: Input the vulnerability entity into the preset rule reasoning model to obtain the propagation chain, supply chain and exploitation chain representing the vulnerability entity; wherein the preset rule reasoning model pre-stores the knowledge graph library.

[0200] In this embodiment, the preset rule reasoning model refers to a model with built-in vulnerability knowledge reasoning rules. Based on existing knowledge in the knowledge graph library, it derives the propagation chain, supply chain, and exploitation chain of the vulnerability. The rules can be preset by security experts or generated through data mining. The propagation chain refers to the path of vulnerability propagation between different systems and components (e.g., "the vulnerability propagates from the Apache server to a web application that depends on this component"). The supply chain refers to the software and hardware supply chain relationship related to the vulnerability (e.g., "the vulnerable component is provided by vendor A and integrated into a terminal device of vendor B"). The exploitation chain refers to the technical path through which the vulnerability is exploited by attackers (e.g., "triggering the vulnerability through PoC code, gaining system privileges, and executing malicious commands").

[0201] Specifically, this invention constructs a set of rules for tasks such as vulnerability propagation paths, supply chain analysis, and exploit chain generation. Rule 1 (Supply Chain Propagation Rule):

[0202]

[0203] Used to analyze scenarios where vulnerabilities in the software supply chain propagate upstream.

[0204] Rule 2 (Attack Chain Reasoning):

[0205] like Then it can be deduced This is used to automatically expand attack conditions.

[0206] Step S162: Input the vulnerability entity into a preset graph neural network model to determine the nodes in the knowledge graph that are related to the vulnerability entity.

[0207] In this embodiment, the preset graph neural network model refers to a neural network trained on graph structure data (such as GCN, GAT), which can mine potential related nodes between entities in the knowledge graph and expand the scope of vulnerability knowledge associations. Specifically, the graph neural network is used to learn entity vector representations. :

[0208]

[0209] in, It is the set of neighboring nodes. Relationship prediction uses a triplet scoring function:

[0210]

[0211] Used to predict unknown relationships, such as: "Which components might be affected by this vulnerability", "Which vulnerabilities might affect this component", and "Predicted vulnerability number corresponding to the PoC". When the score is below the threshold, a new inference relationship is generated.

[0212] Step S163: Construct a target knowledge graph for the vulnerability entity based on the propagation chain, the supply chain, the exploitation chain, and the nodes that are related to the vulnerability entity.

[0213] In this embodiment, the target knowledge graph refers to a specialized knowledge graph constructed by integrating the propagation chain, supply chain, exploitation chain, and associated nodes for a specific vulnerability entity, focusing on the full-dimensional knowledge associations of a single vulnerability. After semantic aggregation and reasoning in the above embodiment, the vulnerability entity will obtain enhanced content, including: scope of impact (product → version → supply chain node), attack path (preconditions → attack method → ​​consequences), exploitation chain (PoC → usage environment → success rate), and remediation chain (patch → applicable version → root cause of weakness → code fix point). This ultimately forms a complete vulnerability knowledge graph.

[0214]

[0215] in, For entities, For the relationship, As an attribute, Embed semantic vectors into the graph.

[0216] In the above embodiments, by inputting the vulnerable entity into a preset rule-based reasoning model, the propagation chain, supply chain, and exploitation chain of the vulnerability are derived based on knowledge in the knowledge graph database, and extended related information of the vulnerability is mined. Furthermore, a graph neural network model is used to analyze nodes in the knowledge graph database that have direct or indirect relationships with the target vulnerable entity, expanding the relational dimensions of vulnerability knowledge. Finally, by fusing chain information and related nodes, a target knowledge graph for a specific vulnerability is constructed, achieving knowledge expansion from "general aggregation" to "specialized in-depth study."

[0217] The above embodiments break through the limitations of the surface associations of general knowledge graphs. By combining rule-based reasoning with graph neural networks, they can mine the deep chain information and potential related nodes of vulnerabilities. The constructed target knowledge graph can comprehensively present the propagation, supply chain, exploitation path and related relationships of a single vulnerability, providing precise specialized knowledge support for vulnerability tracing, risk assessment and defense strategy formulation.

[0218] In some embodiments, the vulnerability meta-knowledge aggregation method based on knowledge graphs may further include the following steps.

[0219] Step S1631: Generate extraction confidence scores for each node of the target knowledge graph, and graph relationship consistency scores for each node in the target knowledge graph.

[0220] In this embodiment, the extraction confidence score refers to the extraction accuracy score (0-1 range) output by the attribute extraction model for each node (entity, attribute) in the target knowledge graph, reflecting the reliability of the node information. The graph relation consistency score refers to the consistency score (0-1 range) of each relation in the target knowledge graph with existing knowledge and logical rules, reflecting the rationality of relation reasoning. Both the extraction confidence score and the graph relation consistency score can be directly generated based on a preset large model.

[0221] Step S1632: Send the target knowledge graph to security experts for verification, and receive the expert verification score of the security experts for the target knowledge graph.

[0222] In this embodiment, the expert verification score refers to the score (0-1 range) given by security experts for the overall accuracy, completeness and rationality of the target knowledge graph, which is the core reference for the credibility of the graph.

[0223] Step S1633: Assign different weights to the extraction confidence score, the graph relationship consistency score, and the expert verification score, and then add them together to obtain the confidence score.

[0224] In this embodiment, the credibility score refers to a comprehensive score (0-1 range) that integrates the extraction confidence score, the relationship consistency score, and the expert verification score, used to determine the credibility of the target knowledge graph. To continuously improve the reliability of the system, this invention introduces a knowledge credibility enhancement module to achieve three-way collaborative optimization of "model capability + graph structure + human feedback".

[0225] Credibility rating can be defined as:

[0226]

[0227] in, Extract confidence scores for large models. Scoring the consistency of the map relationships. The scores are verified by experts.

[0228] Step S1634: If the credibility score is greater than or equal to a preset score, mark the target knowledge graph as trustworthy; or, if the credibility score is less than a preset score, reconstruct the target knowledge graph for the vulnerability entity.

[0229] In this embodiment, the preset score refers to the critical value of the target knowledge graph's credibility (e.g., 0.8). Knowledge above this value is marked as credible, while knowledge below it requires reconstruction. Knowledge with a credibility exceeding the preset score is marked as "highly credible," while low-credible knowledge is automatically scheduled for the next round of review. The system achieves adaptive enhancement through the following strategies: (a) automatically generating secondary verification prompts for low-credible knowledge: "Please check the following vulnerability impact scope again to clarify whether it is correct and explain the reasons."; (b) generating conflict warnings for knowledge that remains inconsistent after multiple rounds of verification: prompting experts to conduct in-depth manual review; (c) using highly credible knowledge to drive graph reasoning, improving overall stability: ultimately forming a closed-loop knowledge credibility enhancement system.

[0230] In the above embodiments, the extraction confidence score and the consistency score of each relation for each node in the target graph are calculated separately, and combined with the expert verification score to form three core scoring dimensions. Then, preset weights are assigned to the three scoring dimensions (e.g., expert verification score weight 0.5, extraction confidence score weight 0.25, relation consistency score weight 0.25), and the weighted sum is used to obtain the credibility score. If the credibility score meets the standard, the target graph is marked as credible and put into use; if it does not meet the standard, the previous steps are returned to reconstruct the target knowledge graph to ensure the quality of the graph.

[0231] The above embodiments establish a multi-dimensional credibility assessment system, which integrates automatic machine scoring and manual verification scoring to comprehensively evaluate the reliability of the target knowledge graph and avoid the application of erroneous knowledge. Through the "scoring-verification-reconstruction" mechanism, the accuracy and usability of the target knowledge graph are ensured, providing reliable knowledge support for vulnerability defense decisions.

[0232] This invention combines the semantic understanding capabilities of large-scale models with the structured representation capabilities of knowledge graphs to achieve automated entity identification, relation extraction, and knowledge aggregation of multi-source heterogeneous vulnerability texts. Compared to traditional extraction methods that rely on rules or small models, this significantly improves the degree of automation and recognition accuracy. Leveraging the long-text modeling and cross-sentence reasoning capabilities of large-scale models, this method can accurately identify key semantic content such as vulnerability numbers, affected components, version ranges, attack conditions, and patch information, avoiding problems such as high maintenance costs and difficulties in handling semantic inconsistencies associated with manual rule manipulation.

[0233] In terms of knowledge fusion, this invention proposes a dual-channel entity alignment method combining semantic vectors and rule verification. This method effectively solves the problems of name disambiguation and number mapping among multiple sources of information, such as CVEs, CNVDs, CNNVDs, vendor announcements, and open-source vulnerability numbers, significantly improving the consistency and completeness of vulnerability knowledge. Simultaneously, the constructed vulnerability knowledge graph can uniformly represent vulnerability impact chains, exploit chains, and remediation chains, and supports automated reasoning based on graph structures, facilitating the rapid acquisition of vulnerability impact scope and potential risk paths.

[0234] Furthermore, this invention introduces a human-machine collaborative verification mechanism. Explanatory summaries generated by a large model assist security experts in reviewing the data, and expert feedback is used to fine-tune the model, achieving continuous optimization and enhanced credibility of the knowledge extraction results. The systematic modular design enables efficient deployment in enterprise security operations centers, vulnerability management platforms, and threat intelligence systems, significantly improving vulnerability analysis efficiency, reducing manual workload, and enhancing the intelligence and controllability of security operations.

[0235] Please see Figure 2 One embodiment of the present invention provides a vulnerability meta-knowledge aggregation device based on a knowledge graph. The vulnerability meta-knowledge aggregation device based on a knowledge graph may include: an entity extraction module, a similarity calculation module, a relationship reasoning module, and an entity aggregation module.

[0236] The entity extraction module is used to extract vulnerability entities and their corresponding vulnerability entity attributes from multiple different vulnerability description texts.

[0237] The similarity calculation module is used to calculate the semantic vector similarity of any two vulnerability description texts, as well as the similarity of rule verification. It then weights the semantic vector similarity results and the rule verification similarity results to obtain a comprehensive similarity.

[0238] The relational reasoning module is used to fuse the vulnerability entity attributes in multiple vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold to obtain a sub-vulnerability entity set, and to determine the relationship type between any two vulnerability entities in the sub-vulnerability entity set based on the relational reasoning network; multiple sub-vulnerability entity sets constitute a vulnerability entity set.

[0239] The entity aggregation module is used to construct relation triples based on any two vulnerability entities in the vulnerability entity set and the relationship type between the two vulnerability entities, and store them in the knowledge graph library; wherein, the knowledge graph library represents the result of aggregating vulnerability meta-knowledge from different vulnerability description texts.

[0240] The specific functions and effects of the knowledge graph-based vulnerability meta-knowledge aggregation device can be explained by referring to other embodiments in this specification, and will not be repeated here. Each module in the knowledge graph-based vulnerability meta-knowledge aggregation device can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0241] Please see Figure 3One embodiment of the present invention can provide an electronic device, the electronic device comprising:

[0242] A memory, and one or more processors communicatively connected to the memory;

[0243] The memory stores instructions that can be executed by the one or more processors, which, when executed by the one or more processors, enable the one or more processors to implement the knowledge graph-based vulnerability meta-knowledge aggregation method in any of the above embodiments.

[0244] One embodiment of the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the knowledge graph-based vulnerability metadata aggregation method in any of the above embodiments.

[0245] This specification also provides a computer program product containing instructions that, when executed by a computer, cause the computer to perform the knowledge graph-based vulnerability metadata aggregation method in any of the above embodiments.

[0246] It is understood that the specific examples in this document are only intended to help those skilled in the art better understand the embodiments described herein, and are not intended to limit the scope of the invention.

[0247] It is understood that in the various embodiments described in this specification, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments described in this specification.

[0248] It is understood that the various implementation methods described in this specification can be implemented individually or in combination, and the implementation methods in this specification are not limited in this respect.

[0249] Unless otherwise stated, all technical and scientific terms used in the embodiments of this specification have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of this specification. The term "and / or" as used in this specification includes any and all combinations of one or more of the associated listed items. The singular forms "a," "the," and "the" as used in the embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0250] It is understood that the processor in this invention can be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method implementation can be completed by the integrated logic circuitry in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this specification. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this specification can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0251] It is understood that the memory in this invention can be volatile memory or non-volatile memory, or may include both. Specifically, the non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM). It should be noted that the memory in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0252] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in the embodiments of the present invention are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0253] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this specification.

[0254] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the aforementioned method implementations, and will not be repeated here.

[0255] In the several embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0256] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0257] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0258] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this specification, in essence, or the parts that contribute to the prior art, or parts of the technical solutions, can be embodied in the form of software products. These computer software products are stored in a storage medium and include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0259] The above description is merely a specific embodiment of this specification, but the scope of protection of this invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this specification should be included within the scope of protection of this specification. Therefore, the scope of protection of this invention should be determined by the scope of the claims.

Claims

1. A method for aggregating vulnerability meta-knowledge based on a knowledge graph, characterized in that, The method comprises: respectively extracting vulnerability entities and vulnerability entity attributes corresponding to the vulnerability entities in a plurality of different vulnerability description texts; performing similarity calculation on semantic vectors of any two vulnerability description texts, and performing similarity calculation on rule verification, and weighting the similarity results of the semantic vectors and the similarity results of the rule verification to obtain a comprehensive similarity; fusing vulnerability entity attributes in a plurality of vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold to obtain a sub-vulnerability entity set, and determining a relationship type between any two vulnerability entities in the sub-vulnerability entity set based on a relationship reasoning network; a plurality of sub-vulnerability entity sets constitute a vulnerability entity set; constructing a relationship triple based on any two vulnerability entities in the vulnerability entity set and the relationship type between the any two vulnerability entities, and storing in a knowledge graph library; wherein the knowledge graph library represents a result of aggregating vulnerability meta-knowledge in different vulnerability description texts.

2. The method of claim 1, wherein, respectively extracting vulnerability entities and vulnerability entity attributes corresponding to the vulnerability entities in a plurality of different vulnerability description texts, comprising: respectively converting a plurality of original security text sequences into vulnerability description texts through a preset mapping function; wherein each original security text sequence corresponds to a vulnerability description text; the preset mapping function conversion at least includes one of the following: label removal, structure label retention, field name retention; performing entity annotation on the vulnerability description text to obtain a vulnerability annotated text; wherein the vulnerability annotated text includes a plurality of vulnerability entities; extracting vulnerability entity attributes in a plurality of different vulnerability description dimensions in the vulnerability description text based on the vulnerability annotated text and a preset vulnerability extraction strategy; wherein the vulnerability description dimension at least includes one of the following: vulnerability version interval, vendor, component name.

3. The method of claim 1, wherein, performing similarity calculation on semantic vectors of any two vulnerability description texts, and performing similarity calculation on rule verification, and weighting the similarity results of the semantic vectors and the similarity results of the rule verification to obtain a comprehensive similarity, comprising: mapping any two vulnerability description texts in the same semantic space to obtain a first semantic vector and a second semantic vector; performing similarity calculation based on the first semantic vector and the second semantic vector to obtain a semantic similarity; performing similarity calculation based on rule verification on any two vulnerability description texts to obtain a rule verification similarity; wherein the rule verification similarity includes a plurality of different dimensions of rule verification; weighting and summing the semantic similarity and the rule verification similarity according to a preset weight coefficient to obtain a comprehensive similarity; wherein the sum of the weights of the semantic similarity and the rule verification similarity is 1.

4. The method of claim 3, wherein, The different dimensions of rule verification include number format verification, version range logic verification, vendor / component consistency verification, patch information verification, and PoC / EXP matching verification; performing similarity calculation based on rule verification on any two vulnerability description texts to obtain a rule verification similarity, comprising: In the case that the numbering formats of any two vulnerability description texts coincide, the first matching degree corresponding to the numbering format check is set to 1; or in the case that the numbering formats of any two vulnerability description texts do not coincide, the first matching degree corresponding to the numbering format check is set to 0; In the case that the version ranges of any two vulnerability description texts belong to the same version range, the second matching degree corresponding to the version range logical check is set to 1; or in the case that the version ranges of any two vulnerability description texts do not belong to the same version range, the second matching degree corresponding to the version range logical check is set to 0; In the case that the manufacturers / components of any two vulnerability description texts are consistent, the third matching degree corresponding to the manufacturer / component consistency check is set to 1; or in the case that the manufacturers / components of any two vulnerability description texts are inconsistent, the third matching degree corresponding to the manufacturer / component consistency check is set to 0; In the case that any two vulnerability description texts refer to the same patch link or patch number, the fourth matching degree corresponding to the patch information check is set to 1; or in the case that any two vulnerability description texts do not refer to the same patch link and do not refer to the same patch number, the fourth matching degree corresponding to the patch information check is set to 0; In the case that the same echo exists in the exploit codes of any two vulnerability description texts, the fifth matching degree corresponding to the PoC / EXP matching check is set to 1; or in the case that different echoes exist in the exploit codes of any two vulnerability description texts, the fifth matching degree corresponding to the PoC / EXP matching check is set to 0; The first matching degree, the second matching degree, the third matching degree, the fourth matching degree and the fifth matching degree are accumulated according to preset weight coefficients to obtain a rule check similarity; wherein the sum of the preset weight coefficients corresponding to the first matching degree, the second matching degree, the third matching degree, the fourth matching degree and the fifth matching degree is 1.

5. The method of claim 1, wherein, The vulnerability entity attributes in the multiple vulnerability description texts with the comprehensive similarity greater than or equal to the preset threshold are fused to obtain a sub-vulnerability entity set, and the relationship type between any two vulnerability entity attributes in the sub-vulnerability entity set is determined based on a relationship reasoning network, including: The vulnerability entity attributes in the multiple vulnerability description texts with the comprehensive similarity greater than or equal to the preset threshold are input into a preset large model to obtain a sub-vulnerability entity set; wherein the preset large model is used to fuse two similar vulnerability entity attributes into one vulnerability entity attribute; Based on the relationship reasoning network, the relationship type between any two vulnerability entities in the same vulnerability description text or similar two vulnerability description texts in the sub-vulnerability entity set is determined.

6. The method according to any one of claims 1 to 5, characterized in that, The method further comprises: generating an explanatory statement based on any two vulnerability entities, vulnerability entity attributes and their relationship types, and sending the explanatory statement and the nodes of any two vulnerability entity attributes in the knowledge graph library to a security expert for verification; Receive structured feedback from security experts on the verification results of the explanatory statement, and transform the structured feedback into training samples to adjust the corresponding entity annotation model, attribute extraction model, and relation reasoning network.

7. The method of claim 1, wherein, The method further includes: The vulnerability entity is input into a preset rule reasoning model to obtain the propagation chain, supply chain, and exploitation chain representing the vulnerability entity; wherein the preset rule reasoning model pre-stores the knowledge graph library; The vulnerability entity is input into a preset graph neural network model to determine the nodes in the knowledge graph that are related to the vulnerability entity. Based on the propagation chain, the supply chain, the exploitation chain, and the nodes that are related to the vulnerable entity, a target knowledge graph is constructed for the vulnerable entity.

8. The method of claim 7, wherein, The method further includes: Generate extraction confidence scores for each node of the target knowledge graph, and graph relationship consistency scores for each node in the target knowledge graph; The target knowledge graph is sent to security experts for verification, and the security experts' verification scores for the target knowledge graph are received. The confidence score is obtained by assigning different weights to the extraction confidence score, the graph relationship consistency score, and the expert verification score, and then summing them together. If the credibility score is greater than or equal to a preset score, the target knowledge graph is marked as trustworthy; or, if the credibility score is less than a preset score, the target knowledge graph for the vulnerable entity is reconstructed.

9. A knowledge graph-based vulnerability meta-knowledge aggregation apparatus, characterized in that, The knowledge graph-based vulnerability meta-knowledge aggregation device includes: The entity extraction module is used to extract vulnerability entities and their corresponding vulnerability entity attributes from multiple different vulnerability description texts. The similarity calculation module is used to calculate the semantic vector similarity of any two vulnerability description texts, as well as the similarity of rule verification, and to weight the semantic vector similarity results and the rule verification similarity results to obtain a comprehensive similarity. The relational reasoning module is used to fuse the vulnerability entity attributes in multiple vulnerability description texts with a comprehensive similarity greater than or equal to a preset threshold to obtain a sub-vulnerability entity set, and to determine the relationship type between any two vulnerability entities in the sub-vulnerability entity set based on the relational reasoning network; multiple sub-vulnerability entity sets constitute a vulnerability entity set; The entity aggregation module is used to construct relation triples based on any two vulnerability entities in the vulnerability entity set and the relationship type between the two vulnerability entities, and store them in the knowledge graph library; wherein, the knowledge graph library represents the result of aggregating vulnerability meta-knowledge from different vulnerability description texts.

10. An electronic device, comprising: The device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the vulnerability meta-knowledge aggregation method based on the knowledge graph as described in any one of claims 1 to 8.

Images