Asset data risk detection method, device and equipment
By constructing a knowledge graph to detect risks in enterprise asset data, the problem of insufficient real-time performance and visualization in existing asset data risk detection technologies is solved. This enables real-time tracking and risk assessment of asset changes, improving the real-time performance and effectiveness of risk detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ALIBABA CLOUD COMPUTING CO LTD
- Filing Date
- 2024-12-23
- Publication Date
- 2026-06-23
Smart Images
Figure CN122264938A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to a method, apparatus and equipment for detecting asset data risks. Background Technology
[0002] With the continuous development of technologies such as computers and the internet, enterprises' internal asset systems have gradually become larger and more complex. Therefore, the importance of risk management for the security assets within these systems has become increasingly prominent.
[0003] In related technologies, when managing the risks of security assets, internal personnel of enterprises usually rely on static asset management and regular security scans for risk prevention and control. This method of asset data risk detection lacks the ability to monitor and visualize asset changes in real time, resulting in low real-time performance and effectiveness of risk management. Summary of the Invention
[0004] This application provides a method, apparatus, and equipment for detecting asset data risks, thereby improving the real-time performance and effectiveness of asset data risk detection.
[0005] In a first aspect, embodiments of this application provide an asset data risk detection method, including:
[0006] Based on asset data, identify multiple asset types and determine the relationships between different asset types;
[0007] Based on the multiple asset types and the relationships, candidate knowledge graphs are determined; the candidate knowledge graphs include nodes corresponding to each asset type and connecting lines corresponding to the relationships.
[0008] Add the asset data to the alternative knowledge graph to obtain the target knowledge graph and display the target knowledge graph;
[0009] In the entire target knowledge graph, the target risk link corresponding to the preset risk prevention and control information is determined, and when there is risk data in the target risk link, risk warning information is output.
[0010] In one possible implementation, determining candidate knowledge graphs based on the plurality of asset types and the associated relationships includes:
[0011] Identify the nodes corresponding to each of the asset types, and determine the connecting lines corresponding to each of the association relationships;
[0012] The candidate knowledge graph is generated based on the nodes and the connecting lines.
[0013] In one possible implementation, the step of adding the asset data to the candidate knowledge graph to obtain the target knowledge graph and displaying the target knowledge graph includes:
[0014] The asset data corresponding to each of the asset types is stored separately to obtain the node data corresponding to each of the asset types; the node data is the asset data corresponding to each node in the candidate knowledge graph;
[0015] Based on the relationships between different asset types, the edge data corresponding to the relationships is determined; the edge data is the relationship data corresponding to each connecting line in the candidate knowledge graph;
[0016] The node data and the edge data are imported into the candidate knowledge graph to obtain the target knowledge graph;
[0017] The target knowledge graph is rendered and displayed using a front-end engine.
[0018] In one possible implementation, the step of determining the target risk link corresponding to the preset risk prevention information in the entire target knowledge graph, and outputting risk warning information when risk data exists in the target risk link, includes:
[0019] Obtain the preset risk prevention and control information; the preset risk prevention and control information includes alternative connection line identifiers, alternative node identifiers, and preset risk identification conditions;
[0020] Based on the candidate connection line identifier and the candidate node identifier, the target risk link corresponding to the preset risk prevention and control information is determined in the target knowledge graph, and the preset risk identification condition is added to the target risk link;
[0021] If risk data that meets the preset risk identification conditions exists in the target risk link with the preset risk identification conditions, then the risk warning information is output.
[0022] In one possible implementation, the method further includes:
[0023] If risk data exists in the target risk link, then target nodes and / or target connections including the risk data are determined in the target knowledge graph;
[0024] Add a target risk attribute to the display properties of the target node and / or target connection line;
[0025] The front-end engine renders and displays the target node and / or target connection line according to the target risk attributes.
[0026] In one possible implementation, the method further includes:
[0027] Obtain the node description information and connection line description information of the target knowledge graph containing risky data;
[0028] The risk data, node description information, connection line description information, and preset risk prevention and control information are input into the target dialogue model to obtain the target risk information corresponding to the target knowledge graph.
[0029] In one possible implementation, the method further includes:
[0030] Obtain the problem description text and convert it into a graph query statement;
[0031] The target knowledge graph is rendered and interacted with based on the graph query statement, and the target text result and target graph result corresponding to the question description text are output.
[0032] In one possible implementation, the method further includes:
[0033] The strategy-generated statement, the target text result, and the target knowledge graph result are input into the target dialogue model to generate the target risk prevention and control information corresponding to the target knowledge graph.
[0034] Secondly, embodiments of this application provide an asset data risk detection device, comprising:
[0035] The first determination module is used to determine multiple asset types based on asset data and to determine the relationships between different asset types;
[0036] The second determining module is used to determine candidate knowledge graphs based on the multiple asset types and the relationships; the candidate knowledge graphs include nodes corresponding to each asset type and connecting lines corresponding to the relationships.
[0037] An add module is used to add the asset data to the candidate knowledge graph, obtain the target knowledge graph, and display the target knowledge graph.
[0038] The output module is used to determine the target risk link corresponding to the preset risk prevention and control information in the entire target knowledge graph, and to output risk warning information when there is risk data in the target risk link.
[0039] In one possible implementation, the second determining module is specifically used for:
[0040] Identify the nodes corresponding to each of the asset types, and determine the connecting lines corresponding to each of the association relationships;
[0041] The candidate knowledge graph is generated based on the nodes and the connecting lines.
[0042] In one possible implementation, the adding module is specifically used for:
[0043] The asset data corresponding to each of the asset types is stored separately to obtain the node data corresponding to each of the asset types; the node data is the asset data corresponding to each node in the candidate knowledge graph;
[0044] Based on the relationships between different asset types, the edge data corresponding to the relationships is determined; the edge data is the relationship data corresponding to each connecting line in the candidate knowledge graph;
[0045] The node data and the edge data are imported into the candidate knowledge graph to obtain the target knowledge graph;
[0046] The target knowledge graph is rendered and displayed using a front-end engine.
[0047] In one possible implementation, the output module is specifically used for:
[0048] Obtain the preset risk prevention and control information; the preset risk prevention and control information includes alternative connection line identifiers, alternative node identifiers, and preset risk identification conditions;
[0049] Based on the candidate connection line identifier and the candidate node identifier, the target risk link corresponding to the preset risk prevention and control information is determined in the target knowledge graph, and the preset risk identification condition is added to the target risk link;
[0050] If risk data that meets the preset risk identification conditions exists in the target risk link with the preset risk identification conditions, then the risk warning information is output.
[0051] In one possible implementation, the device is further used for:
[0052] If risk data exists in the target risk link, then target nodes and / or target connections including the risk data are determined in the target knowledge graph;
[0053] Add a target risk attribute to the display properties of the target node and / or target connection line;
[0054] The front-end engine renders and displays the target node and / or target connection line according to the target risk attributes.
[0055] In one possible implementation, the device is further used for:
[0056] Obtain the node description information and connection line description information of the target knowledge graph containing risky data;
[0057] The risk data, node description information, connection line description information, and preset risk prevention and control information are input into the target dialogue model to obtain the target risk information corresponding to the target knowledge graph.
[0058] In one possible implementation, the device is further used for:
[0059] Obtain the problem description text and convert it into a graph query statement;
[0060] The target knowledge graph is rendered and interacted with based on the graph query statement, and the target text result and target graph result corresponding to the question description text are output.
[0061] In one possible implementation, the device is further used for:
[0062] The strategy-generated statement, the target text result, and the target knowledge graph result are input into the target dialogue model to generate the target risk prevention and control information corresponding to the target knowledge graph.
[0063] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;
[0064] The memory stores computer-executed instructions;
[0065] The processor executes computer execution instructions stored in the memory, causing the processor to perform the asset data risk detection method according to any one of the first aspects.
[0066] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the asset data risk detection method described in any of the first aspects.
[0067] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the asset data risk detection method shown in any of the first aspects.
[0068] In this embodiment, the electronic device determines multiple asset types and their relationships based on asset data. It then determines candidate knowledge graphs based on these asset types and their relationships. Each candidate knowledge graph includes nodes corresponding to each asset type and connecting lines corresponding to their relationships. Asset data is added to the candidate knowledge graphs to obtain and display the target knowledge graph. Within the entire target knowledge graph, a target risk link corresponding to preset risk control information is determined, and a risk warning message is output when risk data is detected in the target risk link. In this application, the electronic device determines candidate knowledge graphs based on asset types and their relationships, adds asset data to these candidate knowledge graphs to obtain and display the target knowledge graph, then determines the target risk link based on preset risk control information, and outputs a risk warning message when risk data is detected. This allows the electronic device to perform asset data risk detection based on the target knowledge graph, achieving real-time monitoring and visualization of asset data. It can promptly output risk warning messages when risk data is detected, improving the real-time performance and effectiveness of asset data risk detection. Attached Figure Description
[0069] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0070] Figure 1 A flowchart illustrating an asset data risk detection method provided for an exemplary embodiment of this application;
[0071] Figure 2 A flowchart illustrating an asset data risk detection method provided for an exemplary embodiment of this application;
[0072] Figure 3 A schematic diagram of an alternative knowledge graph provided for an exemplary embodiment of this application;
[0073] Figure 4 A logical diagram illustrating an intelligent question-and-answer interaction for security assets, provided as an exemplary embodiment of this application;
[0074] Figure 5 A schematic diagram of the structure of an asset data risk detection device provided as an exemplary embodiment of this application;
[0075] Figure 6 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application.
[0076] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0077] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with relevant laws, regulations, and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.
[0078] With the continuous development of internet technology, the application of large and complex cloud network environments such as Virtual Private Clouds (VPCs) is becoming increasingly widespread, leading to a gradual increase in the scale and complexity of enterprise asset systems. A Virtual Private Cloud refers to an isolated and customizable virtual network environment created in the cloud for users and enterprises. Security assets within an enterprise's asset system can refer to digital assets and application systems, specifically massive amounts of asset data. Based on this, the importance of risk management for security assets is gradually increasing to ensure the security and stability of network operations.
[0079] In related technologies, to achieve risk management of secure assets, enterprises need to invest significant manpower in asset operation and management, typically relying on static asset management and periodic security scans for risk prevention. While this asset data risk detection method can achieve asset identification and basic risk assessment, periodic security scans are relatively lagging in the face of rapidly changing cloud environments, failing to promptly detect and respond to changes in asset configuration or emerging threats. Therefore, asset data risk detection methods in related technologies lack real-time monitoring and visualization capabilities for asset changes, especially in dynamic scenarios such as asset additions, changes, or decommissioning. The low real-time nature and effectiveness of asset data risk detection lead to situations where security risks may go undetected for extended periods, increasing the probability of security incidents.
[0080] To address the aforementioned issues, this application provides an asset data risk detection method, apparatus, and device. The electronic device identifies multiple asset types based on asset data and determines the relationships between different asset types. It then determines candidate knowledge graphs based on the multiple asset types and their relationships, adds asset data to these candidate knowledge graphs to obtain a target knowledge graph, and displays the target knowledge graph. Subsequently, based on preset risk prevention information, it identifies target risk links within the entire target knowledge graph and outputs risk warning information when risk data is detected in the target risk link. In this way, the electronic device performs asset data risk detection based on the target knowledge graph, achieving real-time monitoring and visualization of asset data. It can promptly output risk warning information when risk data is detected, enabling real-time tracking and immediate assessment of risk data in scenarios such as asset changes. The immediate and intuitive output of risk warning information improves the real-time performance and effectiveness of asset data risk detection.
[0081] The technical solutions shown in this application will be described in detail below through specific embodiments. It should be noted that the following embodiments may exist independently or in combination with each other, and the same or similar content will not be described again in different embodiments.
[0082] Figure 1 This is a flowchart illustrating an asset data risk detection method provided for an exemplary embodiment of this application. Please refer to [link / reference]. Figure 1 The asset data risk detection method may include:
[0083] S101. Based on the asset data, identify multiple asset types and determine the relationships between different asset types.
[0084] The executing entity in this application embodiment can be an electronic device or an asset data risk detection device installed in an electronic device. The asset data risk detection device can be implemented through software or a combination of software and hardware. For ease of understanding, the following description uses an electronic device as the executing entity. Specifically, the electronic device can refer to a mobile phone, computer, or cloud server, etc. This application embodiment does not limit the specific type of electronic device.
[0085] In this embodiment, asset data can refer to various security asset data within an enterprise, such as digital asset data like domain names, network addresses, network ports, and digital certificates, as well as application system data like various applications, middleware, frameworks, application programming interfaces (APIs), and source code. Asset type can refer to the various data types corresponding to the asset data. This asset type can be determined based on existing asset data or can be a user-defined asset type (e.g., security engineers). Specifically, it can include applications, regions, etc., though this embodiment does not limit this. Association relationship can refer to the association relationship between different asset types. For example, asset types can include applications, regions, and availability zones, where the application is deployed in a region, and the region is located in an availability zone. This interrelationship and interdependence constitutes the association relationship between different asset types.
[0086] In this step, given the massive amount of asset data in the asset system, the electronic device can first determine the asset type corresponding to the asset data, and then determine the relationship between different asset types. Specifically, the electronic device can respond to user interaction operations to determine the asset type and relationship corresponding to the interaction operation, or it can perform clustering recognition based on algorithms such as machine learning and neural networks to determine the asset type and relationship corresponding to the asset data. For example, existing asset data can be input into a pre-trained clustering recognition algorithm model, and the algorithm model can output multiple asset types corresponding to the asset data. Of course, other methods can also be used to determine the asset type and relationship, and this application embodiment does not limit this.
[0087] S102. Based on multiple asset types and their relationships, determine the candidate knowledge graphs; the candidate knowledge graphs include nodes corresponding to each asset type and connecting lines corresponding to the relationships.
[0088] In this embodiment of the application, the alternative knowledge graph can refer to the knowledge graph architecture corresponding to each asset type in the asset system, or it can be called an asset graph, etc., which may include nodes corresponding to each asset type and connecting lines corresponding to each relationship.
[0089] In this step, after the electronic device determines the asset type and its relationships, it can build a candidate knowledge graph based on a graph engine. Specifically, it can determine the nodes corresponding to each asset type and the connecting lines corresponding to each relationship. Then, it can connect the nodes based on the connecting lines to obtain an asset graph corresponding to multiple asset types, which is the candidate knowledge graph.
[0090] S103. Add asset data to the candidate knowledge graph to obtain the target knowledge graph and display it.
[0091] In this embodiment, the target knowledge graph can refer to a knowledge graph that includes specific asset data. Specifically, after generating a candidate knowledge graph, since the candidate knowledge graph is a graph architecture and does not include specific asset data, the electronic device can add specific asset data corresponding to each asset type to the candidate knowledge graph to obtain the target knowledge graph. The target knowledge graph can then be visualized for easy viewing and management by the user.
[0092] In this step, the candidate knowledge graph in the graph engine can be a conceptual graph representing the abstract relationships between different asset types. This candidate knowledge graph does not include specific asset data. To achieve risk management of secure assets, the electronic device needs to add specific asset data to this candidate knowledge graph. Specifically, for each node in the candidate knowledge graph, the electronic device can determine the node data corresponding to the node type it represents. Similarly, for each connection line in the candidate knowledge graph, the electronic device can determine the edge data corresponding to the relationship represented by that connection point. Then, the electronic device can import the node data and edge data as asset data into the candidate knowledge graph to obtain the target knowledge graph. Afterward, the electronic device renders the target knowledge graph through the front-end engine, and finally displays the target knowledge graph on the front-end page.
[0093] In this embodiment, the electronic device can improve the comprehensiveness and effectiveness of asset data risk detection by building a target knowledge graph. At the same time, by displaying the target knowledge graph based on the front-end engine, it can realize the visualization processing of asset data risk detection, which is more intuitive.
[0094] S104. Determine the target risk link corresponding to the preset risk prevention and control information in the entire target knowledge graph, and output risk warning information when there is risk data in the target risk link.
[0095] In this embodiment, preset risk control information can refer to pre-set risk control rules or strategies. Target risk link can refer to a link in the target knowledge graph that may contain risks, which may include multiple nodes and connections. Risk data can refer to data that poses a security risk. Risk warning information can refer to warning or alert information regarding the security risk of the presence of risky data.
[0096] In this step, after identifying the target knowledge graph, the electronic device can acquire preset risk prevention information. This preset risk prevention information can be user-defined or automatically generated by the electronic device. Based on this preset risk prevention information, the electronic device can identify the target risk links within the entire target knowledge graph. Then, it can continuously and dynamically detect whether risky data exists in the target risk links based on the preset risk prevention information. When risky data is found in the target risk links, the electronic device can output risk warning information to provide real-time alerts to the user. This facilitates timely risk management for the user and improves the effectiveness and real-time nature of asset data risk detection.
[0097] In this embodiment, the electronic device determines multiple asset types and their relationships based on asset data. It then determines candidate knowledge graphs based on these asset types and their relationships. Each candidate knowledge graph includes nodes corresponding to each asset type and connecting lines corresponding to their relationships. Asset data is added to the candidate knowledge graphs to obtain and display the target knowledge graph. Within the entire target knowledge graph, a target risk link corresponding to preset risk control information is determined, and a risk warning message is output when risk data is detected in the target risk link. In this application, the electronic device determines candidate knowledge graphs based on asset types and their relationships, adds asset data to these candidate knowledge graphs to obtain and display the target knowledge graph, then determines the target risk link based on preset risk control information, and outputs a risk warning message when risk data is detected. This allows the electronic device to perform asset data risk detection based on the target knowledge graph, achieving real-time monitoring and visualization of asset data. It can promptly output risk warning messages when risk data is detected, improving the real-time performance and effectiveness of asset data risk detection.
[0098] Based on the above embodiments, Figure 2 A flowchart illustrating another asset data risk detection method provided for an exemplary embodiment of this application. Please refer to... Figure 2 The asset data risk detection method may include:
[0099] S201. Based on asset data, identify multiple asset types and determine the relationships between different asset types.
[0100] In this embodiment, the electronic device can acquire predefined asset types. For example, these asset types may include networks, logical digital assets, security risks, physical devices, computing devices, identity credentials, traffic logs, big data storage, network boundaries, and supply chains. Specifically, networks may include domain names, Internet Protocol (IP) addresses, VPCs, and call chains; logical digital assets may include applications, cloud products, and application groups; security risks may include intelligence, risks, vulnerabilities, and work orders; physical devices may include physical machines, availability zones, regions, and data centers; computing devices may include application runtimes, processes, containers (Pods), and Elastic Compute Service (ECS); identity credentials may include user identities, cloud accounts, roles, and access keys (AKs); traffic logs may include security logs, intercept logs, and system logs; and big data storage may include various databases, such as Relational Database Service (RDS), Open Data Processing Service (ODPS), and Object Storage Service (ODS). Services (OSS) can also include stream processing frameworks (such as Flink); network convenience can specifically include public network fingerprints, network fingerprints, and network interfaces; supply chain can specifically include static components, code repositories, and digital certificates. Of course, based on actual asset data or actual needs, the asset type determined by the electronic device can also include other types, and this application embodiment does not limit this.
[0101] In this step, after determining the asset type corresponding to the asset data, the electronic device can determine the asset attributes corresponding to each asset type. Then, based on the internal relationships between different asset types, such as the correspondence between asset attributes, the electronic device can determine the association between asset types. For example, the electronic device can respond to user interaction operations, determine the asset attributes corresponding to each asset type based on these operations, and determine the association between different asset types based on the correspondence between asset attributes of different asset types, such as the location attribute relationship between an application and a region, or the location attribute relationship between a region and an availability zone. Of course, the electronic device can also use other methods to determine the association between asset types, and this embodiment does not limit this approach.
[0102] S202. Determine the nodes corresponding to each asset type and the connecting lines corresponding to each relationship; generate alternative knowledge graphs based on the nodes and connecting lines.
[0103] In this embodiment, a node can refer to a knowledge graph node corresponding to an asset type. Connecting lines can be used to represent the relationships between nodes corresponding to asset types. Specifically, after obtaining the asset types and their relationships, the electronic device can create nodes corresponding to each asset type and connecting lines corresponding to each relationship. Then, the nodes are connected in the graph engine using these connecting lines to construct a candidate knowledge graph. Alternatively, the electronic device can respond to user interactions on the graph engine, creating nodes and connecting lines based on these interactions, and then creating a candidate knowledge graph based on the nodes and connecting lines. These interactions can refer to user actions such as visual dragging or clicking on the graph engine; this embodiment does not limit this approach.
[0104] For example, Figure 3 This is a schematic diagram of an alternative knowledge graph provided for an exemplary embodiment of this application. For example... Figure 3 As shown, the alternative knowledge graph includes nodes such as applications, regions, availability zones, containers, cloud servers, physical machines, IPs, and VPCs. Nodes are connected based on corresponding connection lines, such as an application deployed in a region, a region located in an availability zone, and an availability zone containing physical machines and containers. Of course, depending on the asset type and the relationship, the alternative knowledge graph can also take other forms, and this embodiment does not limit it.
[0105] S203. Store the asset data corresponding to each asset type separately to obtain the node data corresponding to each asset type; the node data is the asset data corresponding to each node in the candidate knowledge graph; determine the edge data corresponding to the association relationship based on the association relationship between different asset types; the edge data is the association relationship data corresponding to each connecting line in the candidate knowledge graph.
[0106] In this embodiment, node data can refer to the asset data corresponding to each node in the candidate knowledge graph. Edge data can refer to the relationship data corresponding to each connection line in the candidate knowledge graph. Specifically, since the candidate knowledge graph does not include specific data, the electronic device needs to instantiate the candidate knowledge graph, i.e., import asset data. The electronic device can store the asset data corresponding to each asset type, i.e., each node, separately. For example, the asset data corresponding to each node can be stored in a data table (node table) to obtain the node data corresponding to each asset type; at the same time, the data corresponding to each connection line representing the relationship can be stored in a data table (edge table) to obtain the edge data corresponding to each relationship.
[0107] S204. Import the node data and edge data into the candidate knowledge graph to obtain the target knowledge graph; render and display the target knowledge graph through the front-end engine.
[0108] In this embodiment, after determining the node data corresponding to each node and the edge data corresponding to each connection line in the candidate knowledge graph, the electronic device can import the node data and edge data into the candidate knowledge graph to form a target knowledge graph including specific asset data. Specifically, the electronic device can import data according to a preset periodic task, that is, it can periodically import or update data from each data table into the candidate knowledge graph according to a preset periodic schedule, and finally obtain the target knowledge graph. At the same time, it can also realize the periodic updating of the target knowledge graph.
[0109] Afterwards, the electronic device can use the front-end engine to render the target knowledge graph and display it on the page for easy viewing by the user. Specifically, since the target knowledge graph involves many asset types, the electronic device can respond to the user's query, determine the starting point of the target knowledge graph subgraph to be displayed, and then determine the connecting lines and other nodes associated with that starting point, obtaining a connected subgraph related to the starting point as the knowledge graph subgraph to be displayed. Then, the electronic device can use the front-end engine to render and display the target knowledge graph according to its hierarchy, ultimately displaying the target knowledge graph subgraph corresponding to the starting point specified by the user.
[0110] In this embodiment, the electronic device determines the node data and edge data corresponding to the nodes and connections in the candidate knowledge graph, imports the node data and edge data from the data table into the candidate knowledge graph in the graph engine, obtains the target knowledge graph, and renders and displays it through the front-end engine. In this way, the electronic device constructs an asset association graph centered on applications, including numerous asset types such as IP segments, physical machines, applications, and public networks, as well as various relationships. This enables the instantiation and visualization of the asset graph; it also provides instantiation processing such as data entry, improving the real-time update of security asset data and thus enhancing the effectiveness of risk management; it also allows users to intuitively perform asset data risk detection, improving user processing efficiency.
[0111] S205. Determine the target risk link corresponding to the preset risk prevention and control information in the entire target knowledge graph, and output risk warning information when there is risk data in the target risk link.
[0112] In one possible implementation, step S205 can be specifically implemented in the following way:
[0113] Obtain preset risk prevention and control information; the preset risk prevention and control information includes alternative connection line identifiers, alternative node identifiers, and preset risk identification conditions; based on the alternative connection line identifiers and alternative node identifiers, determine the target risk link corresponding to the preset risk prevention and control information in the target knowledge graph, and add preset risk identification conditions to the target risk link; if there is risk data that meets the preset risk identification conditions in the target risk link with added preset risk identification conditions, output risk warning information.
[0114] In this embodiment, the preset risk prevention information can be generated based on a preset rule set template, used to indicate which nodes and connections in the target knowledge graph may introduce what kind of security risks. The specific form of this preset risk prevention information can be a Knowledge Graph Domain Specific Language (KGDSL), etc., and this embodiment does not limit this. Specifically, the preset risk prevention information may include candidate connection identifiers, candidate node identifiers, and preset risk identification conditions. The candidate connection identifier can refer to the identifier of a connection that may have security risks, such as a connection code; the candidate node identifier can refer to the identifier corresponding to a node that may have security risks, such as a node code. The preset risk identification conditions can refer to pre-set judgment conditions regarding the existence of risky data.
[0115] For example, if an enterprise's internal services are bound to a public IP address, allowing external access to internal data and services, this process can be considered a security risk due to the exposure of the public IP address; based on this, combined with Figure 3 As shown, the preset risk prevention and control information may include alternative node identifiers and alternative connection line identifiers corresponding to containers, cloud servers, and physical machines. The preset risk identification conditions may include public IP addresses in containers, cloud servers, and physical machines.
[0116] In this step, after acquiring the preset risk prevention and control information, the electronic device can determine the target risk link corresponding to the preset risk prevention and control information based on the candidate node identifiers and candidate connection line identifiers in the preset risk prevention and control information. Then, preset risk identification conditions can be added and applied to the target risk link. Subsequently, the electronic device can identify and judge whether there is risk data in the target risk link based on the preset risk identification conditions. If risk data that meets the preset risk identification conditions is found, the electronic device can output risk warning information. In addition, when it is determined that there is risk data in the target risk link, the electronic device can also directly generate a risk security work order corresponding to the risk data, which can be processed by the user later.
[0117] In this embodiment, the electronic device can improve the real-time performance and effectiveness of asset data risk detection by identifying the target risk link and applying preset risk identification conditions. In asset change scenarios, such as the introduction of new asset types or relationships, it can quickly identify and warn of risk data, thereby achieving dynamic prevention and control of security asset risks.
[0118] S206. If risk data exists in the target risk link, then identify the target node and / or target connection line that includes the risk data in the target knowledge graph.
[0119] S207. Add target risk attributes to the display properties of target nodes and / or target connectors; render and display target nodes and / or target connectors according to the target risk attributes through the front-end engine.
[0120] In this embodiment, target nodes and target connecting lines can refer to nodes and connecting lines containing risk data. Target risk attributes can refer to pre-set specific display attributes of target nodes and target connecting lines containing risk data, such as preset color (highlighting), preset font, preset font size, or preset dynamic display.
[0121] Specifically, after identifying risk data in the target risk link, the electronic device can determine the corresponding target node and / or target connection. The electronic device can then add a target risk attribute to this target node and / or target connection. After detecting this target risk attribute through its front-end engine, the electronic device can render and display the target node and / or target connection according to the target risk data. In this way, by adding target risk attributes to target nodes and target connections containing risk data, and by having the front-end engine display the target nodes and target connections according to these attributes, the electronic device can provide intuitive and real-time alerts to users, improving the effectiveness of risk warnings and accelerating the timely handling of risk data.
[0122] S208. Obtain the node description information and connection line description information of the target knowledge graph containing risk data; input the risk data, node description information, connection line description information and preset risk prevention and control information into the target dialogue model to obtain the target risk information corresponding to the target knowledge graph.
[0123] In this embodiment, node description information can refer to the description information of nodes related to risk data, such as the data types and data processing logic included in the nodes. Connector description information can refer to the description information related to risk data, such as the type of association and data mapping relationship. The target dialogue model can refer to a pre-trained large-scale dialogue language model capable of outputting the results required by the user through dialogue. Target risk information can refer to the actual risk information corresponding to the target knowledge graph determined by the target dialogue model based on massive amounts of risk data.
[0124] In this step, due to the complexity of network architecture and system operation, the introduction of a risk node or the establishment of a risky link often does not pose an actual security risk. Taking the public IP exposure scenario as an example, in a cloud network environment, multiple services and applications may have public IPs, but there is no clear boundary between whether an application or service is for internal use only. For example, an application may be open internally or externally, it may be an internal application but need to be open to specific external customers, or it may be an internal application but have strict access controls for external access. Due to the complexity of real-world scenarios, the risk data identified by electronic devices may be theoretically or rule-wise insecure—that is, it may be theoretically risky data but secure in practical application. For massive amounts of risk data, the workload for users to judge each one individually is too large. Electronic devices can identify and analyze based on target dialogue models to reduce labor costs and improve risk identification efficiency.
[0125] Specifically, after identifying risky data within a target risk link, the electronic device can acquire node descriptions and connection descriptions related to the risky data. Then, it can input the risky data, node descriptions, connection descriptions, and pre-defined risk control information into the target dialogue model. This allows it to identify the target risk information corresponding to the actual risk data existing in the target knowledge graph. In this way, the electronic device identifies, analyzes, and summarizes the risk data through the target dialogue model, ultimately obtaining the target risk information corresponding to the target knowledge graph. This enables comprehensive and effective identification of security risks, improving the effectiveness and accuracy of risk identification.
[0126] S209. Obtain the problem description text and convert it into a graph query statement; perform rendering interaction based on the graph query statement in the target knowledge graph, and output the target text result and target graph result corresponding to the problem description text.
[0127] In this embodiment, the problem description text can refer to interactive text input by the user that requires querying and retrieval, specifically a risk and safety work order, etc. The graph query statement can refer to a statement used for graph queries and graph operations, specifically a graph database query language (Gremlin), etc. The target text result can refer to the text result corresponding to the problem description text. The target graph result can refer to the graph subgraph result corresponding to the problem description text.
[0128] In related technologies, in order to use complex target knowledge graphs that cover a large amount of data and diverse assets, users such as security engineers not only need to understand the nodes, connections and their attribute relationships in the graph, but also must be able to use graph query domain-specific languages, resulting in a high technical threshold and cost of using target knowledge graphs. In addition, query results are usually displayed in text form with weak visualization capabilities. Users need to locate the target object from numerous search results, resulting in low user investigation efficiency and affecting the user experience.
[0129] In this embodiment, the electronic device may include a security asset intelligent interaction model. This model takes a user-submitted problem description text as input, first converting it into a graph query statement that the graph engine can directly execute. The electronic device can also display the specific conversion process for user viewing, thus improving the interpretability of the conversion process. Then, the electronic device can execute the graph query statement through the graph engine, ultimately outputting the target text result and the target graph result corresponding to the problem description text. In this way, by displaying the target graph result, users can further view related asset information through interactive operations such as clicking, facilitating rapid analysis and investigation of risk security work orders and improving the user experience.
[0130] For example, Figure 4 This is a logical diagram illustrating an intelligent question-and-answer interaction for security assets, provided as an exemplary embodiment of this application. Figure 4 As shown, the electronic device acquires the user's input question description text, then converts it into a graph query statement, and can display the specific conversion process. Afterwards, the electronic device executes the graph query statement through a graph engine, outputting the corresponding target text result and target graph result. In this way, the electronic device converts the question description text into a graph query statement, then uses the graph query statement to render a visual graph for interaction, ultimately obtaining the target text result and the target graph result. This allows users to search and interact with massive assets without needing to master complex graph query statements; they can do so simply through natural language. This makes the interaction process with the target knowledge graph simpler and more efficient, reducing the technical barriers and human resource costs associated with interacting with complex security graphs.
[0131] S210. Input the strategy-generated statement, target text result, and target graph result into the target dialogue model to generate target risk prevention and control information corresponding to the target knowledge graph.
[0132] In this embodiment, the strategy generation statement, also known as the rule generation statement, can refer to descriptive text used to instruct the target dialogue model to automatically generate target risk prevention and control information. Target risk prevention and control information can refer to risk prevention and control information automatically generated based on the target dialogue model. Specifically, the target text results and target graph results obtained by the electronic device based on graph interaction can be analyzed and summarized based on the target dialogue model to obtain a new risk rule set template. New target risk prevention and control information can then be generated based on this risk rule set template, enabling rapid generation and application of risk rules to meet the actual needs of users in different scenarios.
[0133] In related technologies, traditional risk control strategies mostly rely on manual configuration. When faced with large-scale, complex, and ever-changing asset environments, this can easily lead to problems such as incomplete strategy development and untimely updates. For example, due to the unique nature of enterprise environments, users need to perform a lot of customization work, which is not only time-consuming and labor-intensive, but also makes it difficult to ensure the accuracy and coverage of the strategies.
[0134] In this embodiment, the electronic device uses graph-based intelligent question answering based on the target dialogue model to query and analyze the knowledge graph, which can associate and visualize the assets that the user is interested in, making the risk management strategy more flexible and accurate. In addition, based on the target text results and target graph results, corresponding risk rule templates and target risk prevention and control information can be generated, which can reduce the cost and difficulty of strategy maintenance.
[0135] It should be understood that in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and not by the implementation process of the embodiments of this application.
[0136] When faced with massive amounts of asset data and diverse asset types, traditional asset data risk detection faces severe challenges, with issues of low real-time performance and effectiveness.
[0137] The asset data risk detection method in this application embodiment involves the electronic device first acquiring the asset types of interest and determining the relationships between different asset types, then generating an abstract candidate knowledge graph based on the asset types and relationships. Next, the electronic device determines the node data corresponding to each asset type and the edge data corresponding to each relationship, instantiates the candidate knowledge graph to obtain the target knowledge graph, and visualizes the target knowledge graph. Then, the electronic device determines the target risk link based on predefined preset risk prevention information and promptly outputs risk warning information when risk data is detected, achieving real-time dynamic perception and alerting of security risks. Furthermore, the electronic device introduces a security asset intelligent question-answering model, converting the user's natural language question (question description text) into a graph query statement executable by the graph engine, outputting the target text result and the target graph result, and visually displaying the result corresponding to the question description text. This lowers the barrier to entry for using the target knowledge graph and facilitates rapid handling of security risks.
[0138] The asset data risk detection method in this application integrates target dialogue models and knowledge graph technology to construct a hierarchical target knowledge graph centered on applications, facilitating asset data risk detection for users. Based on risk prevention and control strategies, it can achieve timely early warning of risk data. In addition, through natural language interactive graph-based intelligent question answering and graph rendering display, users can quickly query and analyze, improving the speed and accuracy of risk identification and response, and helping to reduce security risks.
[0139] Figure 5 Please refer to the structural schematic diagram of an asset data risk detection device provided for an exemplary embodiment of this application. Figure 5 The asset data risk detection device 50 includes:
[0140] The first determining module 51 is used to determine multiple asset types based on asset data and to determine the relationship between different asset types;
[0141] The second determining module 52 is used to determine the candidate knowledge graph corresponding to each asset type based on multiple asset types and their relationships; the candidate knowledge graph includes nodes corresponding to each asset type and connecting lines corresponding to the relationships.
[0142] Add module 53 to add asset data to the candidate knowledge graph, obtain the target knowledge graph and display the target knowledge graph;
[0143] Output module 54 is used to determine the target risk link corresponding to the preset risk prevention and control information in the entire target knowledge graph, and output risk warning information when there is risk data in the target risk link.
[0144] In one possible implementation, the second determining module 52 is specifically used for:
[0145] Identify the nodes corresponding to each asset type and determine the connecting lines corresponding to each relationship;
[0146] Based on the nodes and connecting lines, generate alternative knowledge graphs.
[0147] In one possible implementation, module 53 is added, specifically for:
[0148] The asset data corresponding to each asset type is stored separately to obtain the node data corresponding to each asset type; the node data is the asset data corresponding to each node in the candidate knowledge graph.
[0149] Based on the relationships between different asset types, determine the edge data corresponding to the relationships; the edge data is the relationship data corresponding to each connecting line in the candidate knowledge graph;
[0150] Import node data and edge data into the candidate knowledge graph to obtain the target knowledge graph;
[0151] The target knowledge graph is rendered and displayed using a front-end engine.
[0152] In one possible implementation, the output module 54 is specifically used for:
[0153] Obtain preset risk control information; the preset risk control information includes alternative connection line identifiers, alternative node identifiers, and preset risk identification conditions;
[0154] Based on the alternative connection line identifier and alternative node identifier, the target risk link corresponding to the preset risk prevention and control information is determined in the target knowledge graph, and preset risk identification conditions are added to the target risk link.
[0155] If risk data that meets the preset risk identification conditions exists in the target risk link with preset risk identification conditions, a risk warning message will be output.
[0156] In one possible implementation, the device 50 is further used for:
[0157] If risk data exists in the target risk link, then identify the target node and / or target connection line that includes the risk data in the target knowledge graph;
[0158] Add a target risk attribute to the display properties of the target node and / or target connector;
[0159] The front-end engine renders and displays target nodes and / or target connections according to the target risk attributes.
[0160] In one possible implementation, the device 50 is further used for:
[0161] Obtain node descriptions and connection descriptions of risky data in the target knowledge graph;
[0162] Input risk data, node description information, connector description information, and preset risk prevention and control information into the target dialogue model to obtain the target risk information corresponding to the target knowledge graph.
[0163] In one possible implementation, the device 50 is further used for:
[0164] Retrieve the problem description text and convert it into a graph query statement;
[0165] The target knowledge graph is rendered and interacted with based on graph query statements, and the target text results and target graph results corresponding to the question description text are output.
[0166] In one possible implementation, the device 50 is further used for:
[0167] The strategy-generated statements, target text results, and target graph results are input into the target dialogue model to generate target risk prevention and control information corresponding to the target knowledge graph.
[0168] The asset data risk detection device 50 provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.
[0169] Figure 6 For a schematic diagram of an electronic device provided as an exemplary embodiment of this application, please refer to [link / reference]. Figure 6 The electronic device 60 may include a processor 61 and a memory 62. Exemplarily, the processor 61 and the memory 62 are interconnected via a bus 63.
[0170] Memory 62 stores computer-executed instructions;
[0171] The processor 61 executes computer execution instructions stored in the memory 62, causing the processor 61 to execute the asset data risk detection method as shown in the above method embodiment.
[0172] Accordingly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the asset data risk detection method of the above-described method embodiments.
[0173] Accordingly, embodiments of this application may also provide a computer program product, including a computer program, which, when executed by a processor, can implement the asset data risk detection method shown in the above method embodiments.
[0174] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0175] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0176] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0177] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0178] In a typical configuration, a computing device includes one or more processors, input / output interfaces, network interfaces, and memory.
[0179] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0180] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0181] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0182] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. A method for detecting asset data risks, characterized in that, include: Based on asset data, identify multiple asset types and determine the relationships between different asset types; Based on the multiple asset types and the relationships, candidate knowledge graphs are determined; the candidate knowledge graphs include nodes corresponding to each asset type and connecting lines corresponding to the relationships. Add the asset data to the alternative knowledge graph to obtain the target knowledge graph and display the target knowledge graph; In the entire target knowledge graph, the target risk link corresponding to the preset risk prevention and control information is determined, and when there is risk data in the target risk link, risk warning information is output.
2. The method according to claim 1, characterized in that, The step of determining candidate knowledge graphs based on the multiple asset types and the relationships includes: Identify the nodes corresponding to each of the asset types, and determine the connecting lines corresponding to each of the association relationships; The candidate knowledge graph is generated based on the nodes and the connecting lines.
3. The method according to claim 1, characterized in that, The step of adding the asset data to the candidate knowledge graph to obtain the target knowledge graph and displaying the target knowledge graph includes: The asset data corresponding to each of the asset types is stored separately to obtain the node data corresponding to each of the asset types; the node data is the asset data corresponding to each node in the candidate knowledge graph; Based on the relationships between different asset types, the edge data corresponding to the relationships is determined; the edge data is the relationship data corresponding to each connecting line in the candidate knowledge graph; The node data and the edge data are imported into the candidate knowledge graph to obtain the target knowledge graph; The target knowledge graph is rendered and displayed using a front-end engine.
4. The method according to claim 1, characterized in that, The step of determining the target risk link corresponding to the preset risk prevention information in the entire target knowledge graph, and outputting risk warning information when risk data exists in the target risk link, includes: Obtain the preset risk prevention and control information; the preset risk prevention and control information includes alternative connection line identifiers, alternative node identifiers, and preset risk identification conditions; Based on the candidate connection line identifier and the candidate node identifier, the target risk link corresponding to the preset risk prevention and control information is determined in the target knowledge graph, and the preset risk identification condition is added to the target risk link; If risk data that meets the preset risk identification conditions exists in the target risk link with the preset risk identification conditions, then the risk warning information is output.
5. The method according to claim 1, characterized in that, The method further includes: If risk data exists in the target risk link, then target nodes and / or target connections including the risk data are determined in the target knowledge graph; Add a target risk attribute to the display properties of the target node and / or target connection line; The front-end engine renders and displays the target node and / or target connection line according to the target risk attributes.
6. The method according to claim 1, characterized in that, The method further includes: Obtain the node description information and connection line description information of the target knowledge graph containing risky data; The risk data, node description information, connection line description information, and preset risk prevention and control information are input into the target dialogue model to obtain the target risk information corresponding to the target knowledge graph.
7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: Obtain the problem description text and convert it into a graph query statement; The target knowledge graph is rendered and interacted with based on the graph query statement, and the target text result and target graph result corresponding to the question description text are output.
8. The method according to claim 7, characterized in that, The method further includes: The strategy-generated statement, the target text result, and the target knowledge graph result are input into the target dialogue model to generate the target risk prevention and control information corresponding to the target knowledge graph.
9. An asset data risk detection device, characterized in that, include: The first determination module is used to determine multiple asset types based on asset data and to determine the relationships between different asset types; The second determining module is used to determine candidate knowledge graphs based on the multiple asset types and the relationships; the candidate knowledge graphs include nodes corresponding to each asset type and connecting lines corresponding to the relationships. An add module is used to add the asset data to the candidate knowledge graph, obtain the target knowledge graph, and display the target knowledge graph. The output module is used to determine the target risk link corresponding to the preset risk prevention and control information in the entire target knowledge graph, and to output risk warning information when there is risk data in the target risk link.
10. An electronic device, characterized in that, include: Memory and processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the asset data risk detection method as described in any one of claims 1 to 8.
11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the asset data risk detection method according to any one of claims 1 to 8.
12. A computer program product, characterized in that, It includes a computer program, which, when executed by a computer, implements the asset data risk detection method as described in any one of claims 1 to 8.