A knowledge graph-based threat intelligence correlation method and system

Abstract

This invention provides a method and system for threat intelligence association based on knowledge graphs. The method includes: S1, acquiring and initializing threat intelligence; S2, traversing each piece of threat intelligence and extracting features to obtain a knowledge graph and the nodes and edges corresponding to the threat intelligence; S3, vectorizing the nodes of the knowledge graph to obtain embedding vectors, generating anchor vectors using a graph neural network, inputting the embedding vectors into the graph neural network to obtain the corresponding hidden dimensions, and using the hidden dimensions to correct the specifications of the anchor vectors to obtain a fused vector; S4, normalizing the fused vectors and calculating cosine similarity, sorting the nodes in descending order according to the cosine similarity, and outputting and visualizing the threat intelligence based on the descendingly sorted nodes. This method achieves unified processing of multi-source threat intelligence, solving the problem of difficulty in associating heterogeneous intelligence through a closed-loop process of initialization, feature extraction, vector fusion, and similarity calculation.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, specifically a threat intelligence association method and system based on knowledge graphs. Background Technology

[0002] In the field of cybersecurity, threat intelligence is an evidence-based collection of knowledge about existing or potential threats, including structured and unstructured data such as contextual information and attack mechanisms. Unlike traditional virus signature databases or security alerts, its core value lies in shifting from passive response to proactive defense, enabling early warning before attacks, blocking during attacks, and post-attack attribution. With the evolution of cyberattacks, single protective measures are insufficient, making threat intelligence a fundamental support capability for modern security systems. Currently, threat intelligence applications revolve around collection, standardization, sharing, and response, and the industry has mature intelligence lifecycle models. At the intelligence presentation level, the industry uses standards such as STIX and TAXII to achieve intelligence interoperability. Despite the widespread application of threat intelligence technology, existing solutions have technical limitations, such as insufficient timeliness and accuracy of intelligence, difficulties in integrating multi-source heterogeneous intelligence, a disconnect between intelligence and response actions, and a lack of scenario-based adaptability. Traditional threat intelligence similarity searches suffer from problems of singular and one-sided correlations.

[0003] Therefore, it is necessary to propose a threat intelligence association method and system based on knowledge graphs to overcome the above problems. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by providing a threat intelligence association method and system based on knowledge graphs.

[0005] This invention is achieved through the following technical solution: A threat intelligence correlation method based on knowledge graphs includes: S1. Obtain threat intelligence and initialize it; S2. Traverse each threat intelligence and extract its features to obtain a knowledge graph and the nodes and edges corresponding to the threat intelligence. S3. Vectorize the nodes of the knowledge graph to obtain the embedding vectors. Generate anchor vectors from the graph neural network. Input the embedding vectors into the graph neural network to obtain the hidden dimensions of the corresponding specifications. Use the hidden dimensions to correct the specifications of the anchor vectors to obtain the fusion vector. S4. Normalize the fused vector and calculate the cosine similarity. Sort the nodes in descending order based on the cosine similarity. Output and visualize the threat intelligence based on the nodes in descending order.

[0006] Furthermore, step S1 includes: S11. Obtain the user-preset intelligence collection source set S, and obtain the threat intelligence set of the collection source set S. ; S12. Using web crawlers to collect threat intelligence data. Initialization yields a collection of page objects. The initialization method is as follows: ; in, Represents a mapping function based on a web crawler program; For the i-th page object; This represents the i-th threat intelligence; This represents the content of the i-th rendered page; This represents the image of the i-th rendered page; S13. Convert the page object collection P into an intelligence data collection. The conversion method is as follows: ; in, Represents data transformation and parsing functions; This represents the i-th intelligence data; This represents the i-th summary text; This represents the i-th intelligence type label; This represents the timestamp of the i-th occurrence.

[0007] Furthermore, step S2 includes: S21. Traverse each threat intelligence and extract its features to generate a set of triples. ; S22, Set the triplet set Merged into an initial unified knowledge graph .

[0008] Furthermore, in step S21, the Doubao large model combined with KGGen is used to achieve entity extraction and relation extraction. The extraction method is as follows: ; in, Represents the triple generation function of a knowledge graph; Indicates the head entity; Indicates the tail entity; The original relational phrase; i represents the corresponding threat intelligence. The extracted triples, j represents different triples under this threat intelligence; In step S22, the merging method is as follows: ; in, Represents the set of entities in the initial knowledge graph; This represents the set of relations in the initial knowledge graph.

[0009] Furthermore, step S22 includes: Construct entity category set Using entity classifiers Each entity Mapping to entity category set ,get For the categories of entities, the mapping relationship is as follows: ; Construct a set of relation categories Using entity classifiers Each original relation phrase Mapping to entity category set ,get The mapping relationship is as follows, based on the edge categories: ; Through knowledge graphs and Build nodes corresponding to threat intelligence With edge : ; in, This represents the entity mapping function.

[0010] Furthermore, step S3 specifically includes: S31, Move the node Vectorization yields the embedding vector. ; S32, embed the vector and entity type encoding The input features are obtained by concatenation. ; Among them, input features It can be represented as: ; S33. Generating anchor vectors using graph neural networks. and the corresponding hidden dimensions ; S34. Using anchor vectors and the corresponding hidden dimensions Generate fusion vector .

[0011] Furthermore, the hidden dimensions corresponding to the specifications The hidden dimension is 128. Step S33 specifically includes: S331, Input Features The initial hidden layer is obtained by normalizing with LayerNorm using a linear projection layer and applying Dropout. : ; in, ; S332. Generate anchor vector : ; in, ; Indicates hidden dimensions; Indicates the dimension of the output vector; S333, Initial Hiding By sequentially setting up GATConv1 with two attention heads and then setting up GATConv2 with a single attention head, the hidden dimensions of the corresponding specifications are obtained. : ; in, Indicates the attention coefficient; Indicates the single-head attention coefficient; Represents the set of neighboring nodes of a node; This represents the weight matrix of the second-layer graph attention convolution.

[0012] Furthermore, step S34 specifically includes: S341. Select based on the gating coefficient. , These are the gating fusion weight coefficients for knowledge graph node V: ; in, This represents the set of core intelligence nodes in a knowledge graph.

[0013] D342. Calculate the fusion vector. : .

[0014] Furthermore, step S4 includes: S41, regarding the fusion vector Perform L2 normalization to obtain the entity embedding. : ; in, Indicates the spatial stretching factor; S42, via entity embedding Calculate the cosine degree of any two intelligence nodes. : ; in, This represents the entity embedding of the i-th node. This represents the entity embedding of the q-th node; S43. Exponentially sharpen the cosine similarity to obtain enhanced similarity. : ; Where γ represents the sharpening index; S44. Sort the nodes in descending order and select the K nodes with the highest similarity as the recommendation results: ; This represents the set of all intelligence nodes except for the query node.

[0015] A threat intelligence association system for implementing the above includes: The data input module is used to acquire and initialize threat intelligence. The entity splitting and classification module is used to traverse each threat intelligence and extract features to obtain a knowledge graph and the nodes and edges corresponding to the threat intelligence. The node vector fusion module is used to vectorize the nodes of the knowledge graph to obtain embedding vectors. The graph neural network generates anchor vectors, and the embedding vectors are input into the graph neural network to obtain the hidden dimensions of the corresponding specifications. The specifications of the anchor vectors are corrected using the hidden dimensions to obtain the fused vector. The intelligence recommendation module and the similarity intelligence recommendation module are used to normalize the fused vector and calculate the cosine similarity. The nodes are sorted in descending order according to the cosine similarity, and the threat intelligence is output and visualized based on the nodes sorted in descending order.

[0016] The advantages and beneficial effects of this invention are as follows: This method achieves unified processing of multi-source threat intelligence, solving the problem of difficulty in associating heterogeneous intelligence through a closed-loop process of initialization, feature extraction, vector fusion, and similarity calculation. Combining knowledge graphs and graph neural networks, it overcomes the limitations of traditional text matching, achieving accurate association of threat intelligence from both structural and semantic dimensions. With vector fusion, cosine similarity, and visualization output, it improves the efficiency and interpretability of threat intelligence retrieval, supporting rapid decision-making in security operations. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of the knowledge graph-based threat intelligence association method of the present invention.

[0019] Figure 2 This is a schematic diagram of the knowledge graph-based threat intelligence association method of the present invention.

[0020] Figure 3 This is a model diagram of the knowledge graph-based threat intelligence association system of the present invention. Detailed Implementation

[0021] To enable those skilled in the art to better understand the present invention, the technical solution of the present invention will be further described below with reference to specific embodiments.

[0022] This embodiment provides a threat intelligence association method based on knowledge graphs, such as... Figure 1 and Figure 2 As shown, it includes: S1. Obtain threat intelligence and initialize it; S2. Traverse each threat intelligence and extract its features to obtain a knowledge graph and the nodes and edges corresponding to the threat intelligence. S3. Vectorize the nodes of the knowledge graph to obtain the embedding vectors. Generate anchor vectors from the graph neural network. Input the embedding vectors into the graph neural network to obtain the hidden dimensions of the corresponding specifications. Use the hidden dimensions to correct the specifications of the anchor vectors to obtain the fusion vector. S4. Normalize the fused vector and calculate the cosine similarity. Sort the nodes in descending order based on the cosine similarity. Output and visualize the threat intelligence based on the nodes in descending order.

[0023] This method achieves unified processing of multi-source threat intelligence, solving the problem of difficulty in associating heterogeneous intelligence through a closed-loop process encompassing initialization, feature extraction, vector fusion, and similarity calculation. By combining knowledge graphs and graph neural networks, it overcomes the limitations of traditional text matching, achieving accurate association of threat intelligence from both structural and semantic dimensions. Vector fusion, cosine similarity, and visualization output improve the efficiency and interpretability of threat intelligence retrieval, supporting rapid decision-making in security operations.

[0024] Furthermore, step S1 includes: S11. Obtain the user-preset intelligence collection source set S, and obtain the threat intelligence set of the collection source set S. ; S12. Using web crawlers to collect threat intelligence data. Initialization yields a collection of page objects. The initialization method is as follows: ; in, Represents a mapping function based on a web crawler program; For the i-th page object; This represents the i-th threat intelligence; This represents the content of the i-th rendered page; This represents the image of the i-th rendered page; S13. Convert the page object collection P into an intelligence data collection. The conversion method is as follows: ; in, Represents data transformation and parsing functions; This represents the i-th intelligence data; This represents the i-th summary text; This represents the i-th intelligence type label; This represents the timestamp of the i-th occurrence.

[0025] By using web crawler rendering and structured page parsing, unstructured web page intelligence is transformed into standardized data, reducing intelligence preprocessing costs. It supports custom intelligence collection sources to adapt to the intelligence acquisition needs of different security scenarios, improving system versatility. It outputs summary, type, and timestamp triples, providing standardized input for subsequent entity relation extraction and improving the quality of knowledge graph construction.

[0026] Specifically, threat intelligence entities are categorized as assets, threats, behaviors, events, intelligence, functions, time, organizations, personnel, and irrelevant entities.

[0027] Furthermore, step S2 includes: S21. Traverse each threat intelligence and extract its features to generate a set of triples. ; S22, Set the triplet set Merged into an initial unified knowledge graph .

[0028] Multiple intelligence ternary combinations are integrated into a unified knowledge graph, enabling global association across intelligence entities and relationships, eliminating information silos. Individual intelligence features are extracted to avoid information loss and ensure the completeness of association analysis. The knowledge graph structure is clear, providing a standard structural input for graph neural network computation and improving the accuracy of vector generation.

[0029] Furthermore, in step S21, the Doubao large model combined with KGGen is used to achieve entity extraction and relation extraction. The extraction method is as follows: ; in, Represents the triple generation function of a knowledge graph; Indicates the head entity; Indicates the tail entity; The original relational phrase; i represents the corresponding threat intelligence. The extracted triples, j represents the different triples under this threat intelligence; In step S22, the merging method is as follows: ; in, Represents the set of entities in the initial knowledge graph; This represents the set of relations in the initial knowledge graph.

[0030] Employing the Doubao large model and KGGen, it achieves high accuracy and speed in entity and relation extraction, adaptable to massive threat intelligence processing. Standardized head-entity-relation-tail-entity triples provide a rigorous knowledge graph structure, facilitating entity classification and relation normalization. Clearly defined entity and relation sets reduce the complexity of subsequent classification and vector calculations, improving system stability.

[0031] Furthermore, step S22 includes: Construct entity category set Using entity classifiers Each entity Mapping to entity category set ,get For the categories of entities, the mapping relationship is as follows: ; Construct a set of relation categories Using entity classifiers Each original relation phrase Mapping to entity category set ,get The mapping relationship is as follows, based on the edge categories: ; Through knowledge graphs and Build nodes corresponding to threat intelligence With edge : ; in, This represents the entity mapping function.

[0032] By constructing nodes and edges with type labels, the semantics of the knowledge graph become richer, and vector learning can capture deeper threat relationships. Entity and relationship classification standardizes the labeling of threat elements, reducing semantic ambiguity and improving the accuracy of associations. Unified mapping rules ensure that entities and relationships from different sources can be aligned, enhancing cross-source intelligence fusion capabilities.

[0033] Furthermore, step S3 specifically includes: S31, Move the node Vectorization yields the embedding vector. ; S32, embed the vector and entity type encoding The input features are obtained by concatenation. ; Among them, input features It can be represented as: ; S33. Generating anchor vectors using graph neural networks. and the corresponding hidden dimensions ; S34. Using anchor vectors and the corresponding hidden dimensions Generate fusion vector .

[0034] Node vectorization and type encoding concatenation, integrating semantic and type features, result in more comprehensive vector representation. Graph neural networks generate anchor vectors and multiple hidden dimensions to capture graph topology information and enhance association depth. The fusion of anchor vectors and hidden layers generates unique vectors, solving the homogenization problem of traditional vectors and highlighting individual intelligence characteristics.

[0035] Furthermore, the hidden dimensions corresponding to the specifications The hidden dimension is 128. Step S33 specifically includes: S331, Input Features The initial hidden layer is obtained by normalizing with LayerNorm using a linear projection layer and applying Dropout. : ; in, ; S332. Generate anchor vector : ; in, ; Indicates hidden dimensions; Indicates the dimension of the output vector; S333, Initial Hiding By sequentially setting up GATConv1 with two attention heads and then setting up GATConv2 with a single attention head, the hidden dimensions of the corresponding specifications are obtained. : ; in, Indicates the attention coefficient; Indicates the single-head attention coefficient; Represents the set of neighboring nodes of a node; This represents the weight matrix of the second-layer graph attention convolution.

[0036] The combination of LayerNorm, Dropout, and ELU improves model training stability, prevents overfitting, and adapts to small-sample threat intelligence. A dual-layer GAT attention convolution, using both multi-head and single-head attention, balances local details and global structure, resulting in more efficient feature extraction. A fixed 128-dimensional output ensures uniform vector specifications, facilitating subsequent similarity calculations and storage, and reducing system resource consumption. Clearly defined neighbor nodes and attention coefficients enhance model interpretability and facilitate debugging and optimization.

[0037] Furthermore, step S34 specifically includes: S341. Select based on the gating coefficient. , These are the gating fusion weight coefficients for knowledge graph node V: ; in, This represents the set of core intelligence nodes in a knowledge graph.

[0038] D342. Calculate the fusion vector. : ; Anchor vectors are weighted and fused with hidden layers to enhance key features, suppress noise, and improve the quality of the final vector representation. Dynamic gating coefficients differentiate between core intelligence nodes and ordinary nodes, resulting in more reasonable weight allocation and more focused correlations. The fusion formula is simple and calculable, and the model inference speed is fast, meeting the needs of real-time threat intelligence correlation.

[0039] Furthermore, step S4 includes: S41, regarding the fusion vector Perform L2 normalization to obtain the entity embedding. : ; in, Indicates the spatial stretching factor; S42, via entity embedding Calculate the cosine degree of any two intelligence nodes. : ; in, This represents the entity embedding of the i-th node. This represents the entity embedding of the q-th node; S43. Exponentially sharpen the cosine similarity to obtain enhanced similarity. : ; Where γ represents the sharpening index; S44. Sort the nodes in descending order and select the K nodes with the highest similarity as the recommendation results: ; This represents the set of all intelligence nodes except for the query node.

[0040] L2 normalization and spatial stretching result in a more uniform vector distribution and fairer similarity calculation. Cosine similarity and exponential sharpening amplify high-similarity associations and suppress low-similarity interference, leading to more accurate search results. Top-K ranking output directly provides high-value association information, reducing manual screening costs and improving response efficiency. Excluding self-matches ensures that the recommended results are effective and usable.

[0041] This embodiment also provides a threat intelligence association system for implementing the above, such as... Figures 1-3 As shown, it includes: The data input module is used to acquire and initialize threat intelligence. The entity splitting and classification module is used to traverse each threat intelligence and extract features to obtain a knowledge graph and the nodes and edges corresponding to the threat intelligence. The node vector fusion module is used to vectorize the nodes of the knowledge graph to obtain embedding vectors. The graph neural network generates anchor vectors, and the embedding vectors are input into the graph neural network to obtain the hidden dimensions of the corresponding specifications. The specifications of the anchor vectors are corrected using the hidden dimensions to obtain the fused vector. The intelligence recommendation module and the similarity intelligence recommendation module are used to normalize the fused vector and calculate the cosine similarity. The nodes are sorted in descending order according to the cosine similarity, and the threat intelligence is output and visualized based on the nodes sorted in descending order.

[0042] The modular architecture decouples data input, entity splitting, vector fusion, and intelligence recommendation, facilitating development, deployment, and iterative maintenance. The entire process is automated, requiring no manual intervention from data collection to visualization, lowering the barrier to security operations. Visual output intuitively presents relationships, aiding in threat tracing and attack chain analysis.

[0043] Furthermore, the system also includes a visualization module. This module comprises a knowledge graph visualization area within the platform, using nodes V and edges E provided by the entity splitting and classification module as core data inputs. Each node V contains an entity name and an entity category label. Attributes such as these will visually represent the knowledge graph. ={Assets, Threats, Behaviors, Events, Functions, Time, Organizations, People, Irrelevant, Locations}. Multiple threat intelligence categories and tags distinguished by the threat intelligence classification module. , ={attributed to, used, impersonated, targeted, instructed, located, exploited, developed by, affected, belong to, generated, published} The platform prioritizes displaying a knowledge graph composed of threat intelligence of categories of interest to users. Each knowledge graph node V is associated with the original threat intelligence through a unique ID. Users can view the detailed content of each threat intelligence and return to the original webpage for comparison and verification.

[0044] For ease of explanation, spatial relative terms such as “up,” “down,” “left,” and “right” are used in the embodiments to describe the relationship of one element or feature shown in the figures relative to another element or feature. It should be understood that, in addition to the orientations shown in the figures, spatial terms are intended to include different orientations of the device in use or operation. For example, if the device in the figures is inverted, an element described as being “down” of other elements or features would be positioned “up” of those other elements or features. Therefore, the exemplary term “down” can encompass both up and down orientations. The device may be positioned in other ways (rotated 90 degrees or in other orientations), and the spatial relative descriptions used herein will be interpreted accordingly.

[0045] Moreover, relational terms such as “first” and “second” are used merely to distinguish one component from another that has the same name, without necessarily requiring or implying any such actual relationship or order between the components.

[0046] The above description is only a preferred embodiment of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A threat intelligence association method based on knowledge graphs, characterized in that, include: S1. Obtain threat intelligence and initialize it; S2. Traverse each threat intelligence and extract its features to obtain a knowledge graph and the nodes and edges corresponding to the threat intelligence. S3. Vectorize the nodes of the knowledge graph to obtain the embedding vectors. Generate anchor vectors from the graph neural network. Input the embedding vectors into the graph neural network to obtain the hidden dimensions of the corresponding specifications. Use the hidden dimensions to correct the specifications of the anchor vectors to obtain the fusion vector. S4. Normalize the fused vector and calculate the cosine similarity. Sort the nodes in descending order based on the cosine similarity. Output and visualize the threat intelligence based on the nodes in descending order.

2. The threat intelligence association method based on knowledge graphs according to claim 1, characterized in that, Step S1 includes: S11. Obtain the user-preset intelligence collection source set S, and obtain the threat intelligence set of the collection source set S. ； S12. Using web crawlers to collect threat intelligence data. Initialization yields a collection of page objects. The initialization method is as follows: ； in, Represents a mapping function based on a web crawler program; For the i-th page object; This represents the i-th threat intelligence; This represents the content of the i-th rendered page; This represents the image of the i-th rendered page; S13. Convert the page object collection P into an intelligence data collection. The conversion method is as follows: ； in, Represents data transformation and parsing functions; This represents the i-th intelligence data; This represents the i-th summary text; This represents the i-th intelligence type label; This represents the timestamp of the i-th occurrence.

3. The threat intelligence association method based on knowledge graphs according to claim 2, characterized in that, Step S2 includes: S21. Traverse each threat intelligence and extract its features to generate a set of triples. ; S22, Set the triplet set Merged into an initial unified knowledge graph .

4. The threat intelligence association method based on knowledge graphs according to claim 3, characterized in that, In step S21, the Doubao large model combined with KGGen is used to achieve entity extraction and relation extraction. The extraction method is as follows: ； in, Represents the triple generation function of a knowledge graph; Indicates the head entity; Indicates the tail entity; The original relational phrase; i represents the corresponding threat intelligence. The extracted triples, j represents different triples under this threat intelligence; In step S22, the merging method is as follows: ； in, Represents the set of entities in the initial knowledge graph; This represents the set of relations in the initial knowledge graph.

5. The threat intelligence association method based on knowledge graphs according to claim 4, characterized in that, Step S22 includes: Construct entity category set Using entity classifiers Each entity Mapping to entity category set ,get For the categories of entities, the mapping relationship is as follows: ； Construct a set of relation categories Using entity classifiers Each original relation phrase Mapping to entity category set ,get The mapping relationship is as follows, based on the edge categories: ； Through knowledge graphs and Build nodes corresponding to threat intelligence With edge : ； in, This represents the entity mapping function.

6. The threat intelligence association method based on knowledge graphs according to claim 5, characterized in that, Step S3 specifically includes: S31, Move the node Vectorization yields the embedding vector. ; S32, embed the vector general Vectorized entity type encoding The input features are obtained by concatenation. ; Among them, input features It can be represented as: ； S33. Generating anchor vectors using graph neural networks. and the corresponding hidden dimensions ; S34. Using anchor vectors and the corresponding hidden dimensions Generate fusion vector .

7. The threat intelligence association method based on knowledge graphs according to claim 6, characterized in that, Hidden dimensions corresponding to specifications The hidden dimension is 128. Step S33 specifically includes: S331, Input Features The initial hidden layer is obtained by normalizing with LayerNorm using a linear projection layer and applying Dropout. : ； in, ; S332. Generate anchor vector : ； in, ; Indicates hidden dimensions; Indicates the dimension of the output vector; S333, Initial Hiding By sequentially setting up GATConv1 with two attention heads and then setting up GATConv2 with a single attention head, the hidden dimensions of the corresponding specifications are obtained. : ； in, Indicates the attention coefficient; Indicates the single-head attention coefficient; Represents the set of neighboring nodes of a node; This represents the weight matrix of the second-layer graph attention convolution.

8. The threat intelligence association method based on knowledge graphs according to claim 7, characterized in that, Step S34 specifically includes: S341. Select based on the gating coefficient. , These are the gating fusion weight coefficients for knowledge graph node V: ； in, This represents the set of core intelligence nodes in a knowledge graph. D342. Calculate the fusion vector. : 。 9. The threat intelligence association method based on knowledge graphs according to claim 1, characterized in that, Step S4 includes: S41, regarding the fusion vector Perform L2 normalization to obtain the entity embedding. : ； in, Indicates the spatial stretching factor; S42, via entity embedding Calculate the cosine degree of any two intelligence nodes. : ； in, This represents the entity embedding of the i-th node. This represents the entity embedding of the q-th node; S43. Exponentially sharpen the cosine similarity to obtain enhanced similarity. : ； in, γ Indicates the sharpness index; S44. Sort the nodes in descending order and select the K nodes with the highest similarity as the recommendation results: ； This represents the set of all intelligence nodes except for the query node.

10. A system for implementing the knowledge graph-based threat intelligence association method according to any one of claims 1-9, characterized in that, include: The data input module is used to acquire and initialize threat intelligence. The entity splitting and classification module is used to traverse each threat intelligence and extract features to obtain a knowledge graph and the nodes and edges corresponding to the threat intelligence. The node vector fusion module is used to vectorize the nodes of the knowledge graph to obtain embedding vectors. The graph neural network generates anchor vectors, and the embedding vectors are input into the graph neural network to obtain the hidden dimensions of the corresponding specifications. The specifications of the anchor vectors are corrected using the hidden dimensions to obtain the fused vector. The intelligence recommendation module and the similarity intelligence recommendation module are used to normalize the fused vector and calculate the cosine similarity. The nodes are sorted in descending order according to the cosine similarity, and the threat intelligence is output and visualized based on the nodes sorted in descending order.

Images