Risk early warning method and device fusing knowledge graph, equipment and medium

Abstract

The application relates to the technical field of network security, and proposes a risk early warning method, device, equipment and medium fusing a knowledge graph, the method comprising: acquiring a multi-dimensional vulnerability knowledge graph; locating unknown node clusters of potential risks through subgraph mode matching, and performing associated path reasoning based on the unknown node clusters or entities to be analyzed, mining potential unknown vulnerabilities, and generating target vulnerability hypotheses; verifying the vulnerability hypotheses and performing context constraint analysis based on attack modes and asset information associated with the target vulnerability hypotheses in the multi-dimensional vulnerability knowledge graph, to obtain confirmed vulnerabilities; calculating corresponding target risk values according to the context environment of the confirmed vulnerabilities in the multi-dimensional vulnerability knowledge graph; and generating a risk early warning report with priority sorting and mitigation paths based on the target risk values. Through the scheme, graph association reasoning and dynamic quantification are fused, accurate vulnerability mining and active early warning are realized.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a risk warning method, apparatus, device, and medium that integrates knowledge graphs. Background Technology

[0002] In current cybersecurity defense practices, vulnerability management and risk warning primarily rely on discrete security tools (such as vulnerability scanners and SIEM systems) and static vulnerability databases (such as NVD and CNVD). Security operations personnel typically need to manually integrate fragmented information from scan reports, threat intelligence subscription sources, and asset management systems to assess the actual threat posed by vulnerabilities. However, existing technologies generally suffer from the following fundamental shortcomings: First, information silos and a lack of connections exist. Existing solutions lack the ability to uniformly model the complex topological relationships between vulnerabilities, assets, attack techniques, and protective measures. Various types of security data are fragmented, making it impossible to effectively identify cross-asset dependencies or multi-step attack chains. This results in security analysis remaining at a single-point perspective, making it difficult to cope with complex network attack scenarios.

[0003] Second, risk assessments are static and rigid. Mainstream vulnerability scoring systems (such as CVSS) provide generic, static severity scores, completely detached from the specific operating environment of an enterprise. They fail to consider the context of the network topology where the vulnerability resides, such as the shortest attack path from the vulnerability to core business assets, the effectiveness (mitigation effect) of existing protective measures along that path, and the criticality level of the asset itself. This often results in a "one-size-fits-all" assessment, unable to distinguish between truly high-risk threats and low-risk alerts, leaving security teams overwhelmed by a massive volume of alerts and unable to implement precise measures.

[0004] Third, vulnerability discovery methods are passive and lagging behind. Traditional vulnerability discovery techniques (such as static code analysis, fuzzing, and signature matching) are mostly based on matching signature databases of known vulnerabilities, lacking the ability to perform deep reasoning from the perspective of related security knowledge. They struggle to discover potential security weaknesses caused by complex system interactions, non-standard configurations, or unknown attack chain patterns, and are even less capable of predicting unknown vulnerabilities that have not yet been publicly disclosed based on existing knowledge. Therefore, existing security defenses have long been in a passive "post-event response" state, unable to achieve proactive risk warnings. Summary of the Invention

[0005] This application provides a risk warning method, apparatus, device, and medium that integrates knowledge graphs, aiming to solve the technical problems existing in related technologies, such as the lack of unified modeling and contextual reasoning capabilities for multi-dimensional semantic relationships between vulnerabilities, assets, attack patterns, and protection measures, which leads to vulnerability discovery passively relying on known feature matching and risk assessment only using static scoring detached from the actual operating environment, making it impossible to accurately discover potential unknown vulnerabilities or dynamically quantify the real threat level.

[0006] In a first aspect, embodiments of this application provide a risk warning method integrating knowledge graphs, the method comprising: A multidimensional vulnerability knowledge graph is obtained, which includes: global vulnerability entities, asset entities, attack mode entities, protection measure entities, and multidimensional semantic relationships between entities. The multidimensional semantic relationships include at least vulnerability exploitation relationships, asset dependency relationships, attack chain temporal relationships, and protection measure offset relationships. Based on the topological structure and semantic association of the multidimensional vulnerability knowledge graph, unknown node clusters with potential risks are located by subgraph pattern matching, and related path reasoning is performed based on the unknown node clusters or the entities to be analyzed to discover potential unknown vulnerabilities and generate target vulnerability hypotheses. Based on the attack patterns and asset information associated with the target vulnerability hypothesis in the multidimensional vulnerability knowledge graph, the exploitability verification and context constraint analysis of the target vulnerability hypothesis are performed to obtain the confirmed vulnerability. Based on the context of the confirmed vulnerabilities in the multidimensional vulnerability knowledge graph, the corresponding target risk value is calculated, wherein the context includes at least the criticality level of the affected asset, the shortest attack path length from the vulnerability node to the critical asset, and the weighted evaluation value of the protective measures on the path. A risk warning report with priority ranking and mitigation paths is generated based on the target risk value.

[0007] In one embodiment, optionally, obtaining the multidimensional vulnerability knowledge graph includes: Obtain an ontology model of the vulnerability knowledge domain and determine the concept types, entity attributes, and relationship types of the vulnerability knowledge domain, wherein the relationship types include exploitable, existent, dependent, causable, and protectable; Instance data is extracted from structured vulnerability databases, unstructured security bulletins, and network asset configuration data using named entity recognition and relation extraction models. Conflicting or redundant instances are then fused based on the authority weight of the data source and the freshness of the data. The fused knowledge is stored in a graph database in the form of triples, and vectorized representation learning is performed on entities and relations to generate low-dimensional embedding vectors.

[0008] In one embodiment, optionally, based on the topological structure and semantic associations of the multidimensional vulnerability knowledge graph, unknown node clusters with potential risks are located through subgraph pattern matching, and related path reasoning is performed based on the unknown node clusters or the entities to be analyzed to mine potential unknown vulnerabilities and generate target vulnerability hypotheses, including: Obtain the feature subgraph pattern of a preset high-risk vulnerability in the multidimensional vulnerability knowledge graph, wherein the feature subgraph pattern includes a preset combination of entity types and a sequence of relational connections; Perform isomorphic or approximate subgraph search in the multidimensional vulnerability knowledge graph to identify unknown node clusters that match the feature subgraph pattern; For any software component or configuration entity in the unknown node cluster, analyze its multi-hop association path formed by its dependence on or existence in the relationship and the preset vulnerability database. Calculate the probability score of the configuration entity becoming a potential unknown vulnerability based on the type, strength, and frequency of historical attack cases of the relationship in the multi-hop association path. In response to receiving an analysis command for the entity to be analyzed, a probability score for the entity to be analyzed is calculated; In response to the probability score being greater than a preset threshold, the corresponding target entity is marked as a suspected vulnerability node, and a target vulnerability hypothesis is generated.

[0009] In one embodiment, optionally, calculating a probability score for the configuration entity or the entity to be analyzed to be a potential unknown vulnerability includes: Input the entity and relation sequence on the multi-hop association path into the recurrent neural network, and output the hidden state corresponding to each position of the multi-hop association path; Differentiated importance weights are assigned to each node and relation edge in the multi-hop association path using an attention mechanism, and the overall semantic representation of the path is obtained by weighted summation of all hidden states. The overall semantic representation of the path is input into a fully connected layer, and after passing through a Sigmoid activation function, a scalar score representing the probability that the target entity has a potential vulnerability is output.

[0010] In one embodiment, optionally, the exploitability verification and context constraint analysis of the target vulnerability hypothesis based on the attack patterns and asset information associated with the target vulnerability hypothesis in the multidimensional vulnerability knowledge graph, to obtain a confirmed vulnerability, includes: In response to the assumption that the target vulnerability originates from a configuration entity in the unknown node cluster, the attack pattern entity associated with the configuration entity in the multidimensional vulnerability knowledge graph is extracted. Verify the executability of the attack mode in the corresponding asset operating environment, and check whether the suspected vulnerable nodes meet the preset context constraints. In response to being executable and meeting the aforementioned context constraints, the suspected vulnerability node is identified as a confirmed vulnerability; In response to the assumption that the target vulnerability originates from the entity to be analyzed, the asset-critical information and network topology constraints associated with the entity to be analyzed in the multidimensional vulnerability knowledge graph are extracted. Verify the connectivity of the attack link constructed based on the probability score in the actual network environment, and traverse the protection measure nodes on the attack link to determine whether there is any blocking protection. In response to the fact that the attack chain is connected and there is no blocking protection, the entity to be analyzed is identified as a confirmed vulnerability.

[0011] In one embodiment, optionally, calculating the corresponding target risk value based on the context of the confirmed vulnerability in the multidimensional vulnerability knowledge graph includes: Extract the base severity score of the confirmed vulnerability and obtain the criticality adjustment coefficient of the assets affected by the confirmed vulnerability; Query the shortest attack path from the node of the confirmed vulnerability to the critical asset node in the multidimensional vulnerability knowledge graph; The length of the shortest attack path and the historical success probability of each attack step on the path are statistically analyzed, and the reachability penalty factor of the attack path is calculated. The reachability penalty factor of the attack path is inversely proportional to the length of the shortest attack path and directly proportional to the product of the historical success probabilities of each attack step on the path. Obtain all protection measure nodes on the shortest attack path, query the countermeasure efficiency weight of each protection measure against attack techniques on the path based on the protectable relationship in the multidimensional vulnerability knowledge graph, and calculate the weighted effective protection strength by combining the current deployment health status coefficient of each protection measure. Based on the vulnerability's basic severity score, the criticality adjustment coefficient, the attack path reachability penalty factor, and the weighted effective protection strength, the target risk value is calculated using a preset dynamic risk formula.

[0012] In one embodiment, optionally, generating a risk warning report with priority ranking and mitigation paths based on the target risk value includes: The target risk value is matched with a preset risk level range to determine the warning priority of the confirmed vulnerability, wherein the warning priority is positively correlated with the target risk value; Extract the shortest attack path from the confirmed vulnerability node to the critical asset node in the multidimensional vulnerability knowledge graph, use the shortest attack path as the mitigation path, and identify the critical jump nodes and protection measure nodes on the mitigation path; For the key jump nodes on the mitigation path, a corresponding hardening strategy is matched, and for the protective measure nodes, optimization suggestions are generated by combining their offset efficiency weight and deployment health status coefficient. The risk warning report is generated by integrating the warning priority, the mitigation path, the identification information, and the optimization suggestions.

[0013] In one embodiment, optionally, the method further includes: The results of risk warning processing, newly discovered attack cases, and confirmed false alarms are used as feedback inputs to incrementally update the multidimensional vulnerability knowledge graph. The incremental updates include: adding new entities and relationships, adjusting the confidence weights of existing relationships, and correcting the attribute values ​​of entities.

[0014] Secondly, embodiments of this application provide a risk warning device that integrates knowledge graphs, the device comprising: The acquisition module is used to acquire a multi-dimensional vulnerability knowledge graph, which includes: global vulnerability entities, asset entities, attack mode entities, protection measure entities, and multi-dimensional semantic relationships between entities. The multi-dimensional semantic relationships include at least vulnerability exploitation relationships, asset dependency relationships, attack chain temporal relationships, and protection measure offset relationships. The vulnerability discovery module is used to locate unknown node clusters with potential risks by subgraph pattern matching based on the topological structure and semantic association of the multidimensional vulnerability knowledge graph, and to perform association path reasoning based on the unknown node clusters or the entities to be analyzed, to discover potential unknown vulnerabilities and generate target vulnerability hypotheses. The vulnerability confirmation module is used to perform exploitability verification and context constraint analysis on the target vulnerability hypothesis based on the attack patterns and asset information associated with the target vulnerability hypothesis in the multi-dimensional vulnerability knowledge graph, and to obtain the confirmed vulnerability. The calculation module is used to calculate the corresponding target risk value based on the context of the confirmed vulnerability in the multidimensional vulnerability knowledge graph, wherein the context includes at least the criticality level of the affected asset, the shortest attack path length from the vulnerability node to the critical asset, and the weighted evaluation value of the protection measures on the path. The generation module is used to generate a risk warning report with priority ranking and mitigation paths based on the target risk value.

[0015] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the aforementioned risk warning method for fused knowledge graphs.

[0016] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the aforementioned risk warning method for fused knowledge graphs.

[0017] In this invention, a multi-dimensional vulnerability knowledge graph is obtained, which includes: global vulnerability entities, asset entities, attack mode entities, protection measure entities, and multi-dimensional semantic relationships between entities. These multi-dimensional semantic relationships include at least vulnerability exploitation relationships, asset dependency relationships, attack chain temporal relationships, and protection measure offsetting relationships. Based on the topological structure and semantic associations of the multi-dimensional vulnerability knowledge graph, unknown node clusters with potential risks are located through subgraph pattern matching. Based on these unknown node clusters or the entities to be analyzed, association path reasoning is performed to uncover potential unknown vulnerabilities and generate target vulnerability hypotheses. Based on the attack modes and asset information associated with the target vulnerability hypotheses in the multi-dimensional vulnerability knowledge graph, the vulnerability hypotheses are subjected to exploitability verification and context constraint analysis to obtain confirmed vulnerabilities. According to the context of the confirmed vulnerabilities in the multi-dimensional vulnerability knowledge graph, the corresponding target risk value is calculated. The context includes at least the criticality level of the affected asset, the shortest attack path length from the vulnerability node to the critical asset, and the weighted evaluation value of the protection measures along the path. Based on the target risk value, a risk warning report with priority ranking and mitigation paths is generated. The aforementioned technical solution breaks down the silos of traditional security data by constructing a multi-dimensional knowledge graph that integrates vulnerabilities, assets, attack patterns, and protective measures. It upgrades vulnerability discovery from passively relying on matching known features to actively using associative reasoning based on the graph's topology, effectively enabling the discovery of potential unknown vulnerabilities. Simultaneously, by dynamically coupling static vulnerability scores with the criticality of assets, the reachability of attack paths, and the offsetting effects of protective measures in a specific network environment, it completely changes the current situation of one-size-fits-all risk assessment detached from the environment. This significantly improves the accuracy and targeting of risk warnings, providing security operations with decision support that includes clear priorities, traceable attack paths, and implementable mitigation strategies, thereby greatly enhancing the initiative and intelligence of network security defense. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A schematic flowchart of a risk warning method based on a fused knowledge graph according to an embodiment of this application is shown.

[0020] Figure 2 A schematic flowchart of step S101 in a risk warning method based on a fused knowledge graph according to an embodiment of this application is shown.

[0021] Figure 3A schematic flowchart of step S102 in a risk warning method based on a fused knowledge graph according to an embodiment of this application is shown.

[0022] Figure 4 A schematic flowchart of step S103 in a risk warning method based on a fused knowledge graph according to an embodiment of this application is shown.

[0023] Figure 5 A schematic flowchart of step S104 in a risk warning method based on a fused knowledge graph according to an embodiment of this application is shown.

[0024] Figure 6 A detailed flowchart of a risk warning method based on a fused knowledge graph according to an embodiment of this application is shown.

[0025] Figure 7 A schematic diagram illustrating the principle of an intelligent vulnerability discovery method based on associated path reasoning according to an embodiment of this application is shown.

[0026] Figure 8 A schematic diagram of a dynamic risk quantification calculation model according to an embodiment of this application is shown.

[0027] Figure 9 A schematic diagram illustrating a dynamic risk assessment of a known web server vulnerability according to an embodiment of this application is shown.

[0028] Figure 10 A schematic diagram illustrating a method for mining potential intrusions based on associations of abnormal behavior patterns according to an embodiment of this application is shown.

[0029] Figure 11 A block diagram of a risk warning device based on a fused knowledge graph according to an embodiment of this application is shown.

[0030] Figure 12 A schematic diagram of the structure of a computer device according to an embodiment of this application is shown.

[0031] Figure 13 Another structural schematic diagram of a computer device according to an embodiment of this application is shown. Detailed Implementation

[0032] To better understand the technical solution of this application, the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0033] It should be understood that the described embodiments are merely some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0034] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0035] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0036] Please see Figure 1 , Figure 1 A schematic flowchart of a risk warning method based on a fused knowledge graph according to an embodiment of this application is shown.

[0037] like Figure 1 As shown, a risk warning method for fused knowledge graphs according to an embodiment of this application includes: Step S101: Obtain a multi-dimensional vulnerability knowledge graph. The multi-dimensional vulnerability knowledge graph includes: global vulnerability entities, asset entities, attack mode entities, protection measure entities, and multi-dimensional semantic relationships between entities. The multi-dimensional semantic relationships include at least vulnerability exploitation relationships, asset dependency relationships, attack chain timing relationships, and protection measure offset relationships. Among them, the multidimensional vulnerability knowledge graph is a unified graph structure knowledge base that integrates the security elements of the entire network; global vulnerability entities refer to various security vulnerability nodes, asset entities represent network software and hardware business assets, attack mode entities record various attack methods, and protection measure entities correspond to security devices / policies such as firewalls and access control; multidimensional semantic relationships are used to depict the association logic between different entities, vulnerability exploitation relationships indicate that a vulnerability can be exploited by a certain attack method, asset dependency relationships represent the software and hardware dependencies between assets, attack chain temporal relationships reflect the sequential logic of multi-step attacks, and protection measure offset relationships characterize the inhibitory effect of protection measures on vulnerability attacks.

[0038] This step unifies and integrates multi-source heterogeneous security data, using a standardized graph model of entities and relationships to achieve structured storage of all security information. It also builds a unified underlying knowledge base to support subsequent vulnerability reasoning and risk calculation, distinguishing it from traditional, fragmented vulnerability databases. This breaks down security data silos, fully depicting the complex relationships between vulnerabilities, assets, attacks, and protections. It provides a global, quantifiable semantic foundation for relational reasoning and dynamic risk assessment, addressing the shortcomings of traditional solutions such as data fragmentation and the inability to perform cross-dimensional collaborative analysis.

[0039] Step S102: Based on the topological structure and semantic association of the multidimensional vulnerability knowledge graph, locate the unknown node clusters of potential risks through subgraph pattern matching, and perform association path reasoning based on the unknown node clusters or the entities to be analyzed to mine potential unknown vulnerabilities and generate target vulnerability hypotheses. Topology refers to the connection structure formed by entity nodes and relation edges in a graph; subgraph pattern matching uses the node connection structure of known high-risk vulnerabilities as a template to search for similar local subgraphs in the whole graph; association path reasoning uses the target entity as the starting point to traverse multi-hop connected links along dependencies and existing relationships; the target entity is the software component or business asset to be detected for risk; vulnerability hypothesis is the node marking result that has not been verified and is suspected of having security defects.

[0040] In this step, subgraph pattern matching is first performed. By comparing the fixed topology of known high-risk vulnerabilities, clusters of unknown nodes with similar characteristics are discovered in batches across the entire graph, completing a global coarse screening of potential risks. Subsequently, specific software components or configuration entities within these unknown node clusters are used as the core analysis objects. Multi-hop association path reasoning is performed along asset dependencies, existence, and other relationships. Combined with historical attack data, the probability score of becoming a potential vulnerability carrier is quantitatively calculated. Furthermore, this association path reasoning mechanism can also respond to analysis instructions targeting specific entities and independently perform targeted in-depth analysis. The above mechanism achieves the organic complementarity of global batch vulnerability scanning and single-point asset in-depth verification. By combining the high recall rate of subgraph matching with the high accuracy rate of path reasoning, the detection coverage of unknown vulnerabilities and covertly transmitted risks is significantly improved. This breaks through the limitations of traditional technologies that rely solely on feature matching to identify known vulnerabilities, achieving a technological leap from passive response to proactive prediction of potential attack risks.

[0041] Step S103: Based on the attack patterns and asset information associated with the target vulnerability hypothesis in the multidimensional vulnerability knowledge graph, the exploitability of the target vulnerability hypothesis and context constraint analysis are performed to obtain the confirmed vulnerability. Exploitability verification refers to verifying whether the attack methods corresponding to the vulnerability assumptions can be implemented in the current network environment; context constraint analysis combines asset configuration, network isolation, and existing protection strategies to determine whether there are objective limitations on attack implementation; confirmed vulnerabilities are valid vulnerability nodes that truly have the conditions for attack after eliminating invalid assumptions that cannot be exploited.

[0042] In this step, information on attack patterns, asset configurations, network connectivity, and protection deployments associated with the vulnerability assumptions is retrieved. It verifies whether all preconditions for attack execution are met, filters out invalid suspected nodes that are isolated or whose protection is completely negated, and retains only vulnerabilities with actual exploitability as valid vulnerabilities. This reduces the workload of security personnel by filtering out a large number of false alerts, eliminates theoretical risks detached from the actual network environment, and ensures that subsequent risk assessments are based solely on truly exploitable vulnerabilities, thereby improving the overall accuracy of the assessment.

[0043] Step S104: Calculate the corresponding target risk value based on the context of the confirmed vulnerability in the multidimensional vulnerability knowledge graph. The context includes at least the criticality level of the affected asset, the shortest attack path length from the vulnerability node to the critical asset, and the weighted evaluation value of the protection measures on the path. The context refers to the complete network topology, asset value, and protection deployment information of the vulnerability; the asset criticality level is used to distinguish core business assets from ordinary assets; the shortest attack path length is the minimum number of hops required for the vulnerability to reach a high-value target asset; the weighted evaluation value of protection measures is a quantitative value of the combined ability of all protection devices and strategies on the path to offset the attack; the target risk value is a dynamic real threat quantification score after considering the overall network environment.

[0044] In this step, instead of using a fixed static vulnerability score, a dynamic risk score is calculated by combining multiple dimensions such as asset importance, attack chain length, and comprehensive mitigation capabilities along the path. This objectively quantifies the true threat level of vulnerabilities in the current dedicated network. This addresses the shortcomings of traditional CVSS static scoring, which is detached from the actual operating environment, enabling dynamic and personalized quantitative differentiation of vulnerability risks. It accurately identifies urgent and high-risk vulnerabilities related to high-value assets, providing a quantitative basis for the allocation and handling of security resources.

[0045] Step S105: Generate a risk warning report with priority ranking and mitigation path based on the target risk value.

[0046] Prioritization sorting classifies multiple vulnerability alerts based on the target risk value; mitigation paths are targeted protection and remediation solutions generated based on knowledge graph relationships; and risk warning reports are standardized and visualized analysis results output to security operations personnel.

[0047] In this step, all confirmed vulnerabilities are classified and ranked according to the calculated dynamic risk values. Simultaneously, based on the entity relationships in the vulnerability graph, corresponding remediation, isolation, and hardening measures are matched, and a complete early warning report is generated and output externally. This enables tiered alert handling, prioritizing high-risk vulnerabilities and providing actionable and precise mitigation solutions. This guides security personnel in accurately allocating operational resources, shortening the vulnerability closed-loop handling cycle, and improving the overall network security defense response efficiency.

[0048] In the above solution, by constructing a multi-dimensional knowledge graph that integrates vulnerabilities, assets, attack patterns, and protective measures, the silo barriers of traditional security data are broken down. Vulnerability discovery is upgraded from passively relying on matching known features to actively using associative reasoning based on the graph topology, effectively realizing the discovery of potential unknown vulnerabilities. At the same time, by dynamically coupling static vulnerability scores with the criticality of assets, the reachability of attack paths, and the offsetting effect of protective measures in specific network environments, the current situation of one-size-fits-all risk assessment detached from the environment is completely changed. This significantly improves the accuracy and pertinence of risk warnings, and can provide decision support for security operations with clear priorities, traceable attack paths, and implementable mitigation strategies, greatly improving the initiative and intelligence level of network security defense.

[0049] like Figure 2 As shown, in one embodiment, optionally, step S101 includes: Step S201: Obtain the vulnerability knowledge domain ontology model and determine the concept type, entity attribute and relationship type of the vulnerability knowledge domain, wherein the relationship type includes exploitable, exists, depends on, can cause and can be protected; The vulnerability knowledge domain ontology model is a standardized schema skeleton that defines the knowledge structure of the security domain. Concept types define all major categories of entities within the graph, entity attributes represent the entity's own characteristic parameters, and relationship types uniformly specify the logical associations between different entities. Vulnerability can be triggered by representative attack methods, exists on a representative vulnerability / protection deployed on a certain asset, depends on the representative asset's software and hardware layer dependency, can lead to attack consequences after the representative vulnerability is triggered, and can be protected by representative protection measures that can offset the corresponding vulnerability attack.

[0050] This unifies the semantic standards of multi-source security data, avoids graph logic conflicts caused by confusing entity and relation definitions, ensures the consistency of rules for subsequent subgraph matching, path reasoning, and risk calculation, and improves the overall standardization and scalability of the knowledge graph.

[0051] Step S202: Extract instance data from the structured vulnerability database, unstructured security announcements, and network asset configuration data using named entity recognition and relation extraction models, and perform confidence fusion on conflicting or redundant instances based on the authority weight of the data source and the freshness of the data time. Structured vulnerability databases refer to standardized CVE vulnerability databases; unstructured security bulletins refer to vendor vulnerability text announcements; network asset configuration data refers to enterprise software and hardware asset ledgers; named entity recognition is used to automatically identify entities such as vulnerabilities, assets, and protections in text; relation extraction models are used to extract relationships between entities; data source authority weights distinguish the credibility of different data sources; time freshness is used to weaken outdated and old data; confidence fusion is a weighted and unified calculation of conflicting attributes of the same entity.

[0052] This step covers multiple heterogeneous security data sources, including structured data, text-based data, and asset ledgers. It uses a deep learning model to automatically extract triple instances. For multiple conflicting data points on the same entity, a weighted fusion is performed based on source reliability and data freshness to output a unique, trustworthy entity attribute. This breaks down data silos across different security categories, enabling automated knowledge extraction while resolving issues of data duplication and attribute contradictions from multiple sources. It significantly reduces manual processing costs and ensures that the knowledge within the knowledge graph is authentic, reliable, and timely.

[0053] Step S203: The fused knowledge is stored in the graph database in the form of triples, and vectorized representation learning is performed on entities and relations to generate low-dimensional embedding vectors.

[0054] Triples, namely <head entity, relation, tail entity>, are the standard storage unit for knowledge graphs; graph databases are dedicated storage engines adapted for node association queries; vectorized representation learning maps discrete symbolic entities and relations into low-dimensional dense numerical vectors, and low-dimensional embedded vectors preserve entity semantics and topological similarity.

[0055] In this step, the fused standardized knowledge is persistently stored as triples, and then entity and relation vectors are trained using a graph embedding model. Entities with similar semantics and topological structures are closer in the vector space. In this way, multi-hop association paths and fast subgraph retrieval are achieved based on the graph database, and the embedded vectors provide a computable numerical basis for subsequent RNN path reasoning and similarity matching, significantly improving the computational efficiency and recognition accuracy of vulnerability discovery and association reasoning.

[0056] like Figure 3 As shown, in one embodiment, optionally, step S102 includes: Step S301: Obtain the feature subgraph pattern of the preset high-risk vulnerability in the multidimensional vulnerability knowledge graph. The feature subgraph pattern includes a preset combination of entity types and a sequence of relational connections. The feature subgraph pattern is a standard local topology template abstracted from confirmed high-risk vulnerabilities. The entity type combination limits the entity categories such as vulnerabilities, assets, and attacks contained in the subgraph, and the relation connection sequence specifies the semantic order of the sequential connections between entities.

[0057] In this step, the entity pairings and associated link structures corresponding to historical high-risk vulnerabilities are analyzed and standardized into subgraph templates, serving as the retrieval basis for batch scanning of similar risks across the entire network. This establishes standardized vulnerability topology identification templates, enabling unified batch retrieval of similar vulnerabilities, providing reusable matching rules for global batch mining of unknown risks, and improving the batch processing capabilities of vulnerability discovery.

[0058] Step S302: Perform isomorphic or approximate subgraph search in the multidimensional vulnerability knowledge graph to identify unknown node clusters that match the feature subgraph pattern; Homogeneous search refers to strictly matching subgraphs with completely identical entities and relationships, while approximate subgraph search allows for a small number of entities and relationships with local differences; unknown node clusters are a group of related entities in the graph that are not marked with vulnerabilities but have a topological structure similar to the template of high-risk vulnerabilities; In this step, a high-risk vulnerability feature subgraph is used as a retrieval template to traverse and match across the entire knowledge graph, filtering for entity clusters with similar structures. This approach goes beyond single target entities, enabling the global discovery of hidden vulnerabilities with similar attack chain characteristics in batches. It overcomes the limitation of single-point analysis in covering a wide range of network risks, thus broadening the scope of vulnerability discovery.

[0059] Step S303: For any software component or configuration entity in the unknown node cluster, analyze its multi-hop association path formed by its dependence on or existence in the relationship and the preset vulnerability database, and calculate the probability score of the configuration entity becoming a potential unknown vulnerability based on the type, strength and frequency of historical attack cases of the relationship in the multi-hop association path. A multi-hop association path is a link that starts from the target entity and connects to a known vulnerability through multiple nodes along two types of associations; the relationship strength represents the degree of closeness between entities; the frequency of historical attack cases refers to the number of times this type of association link has been successfully exploited in history; the probability score is a numerical value that quantifies the likelihood that the target entity carries a potential vulnerability.

[0060] In this step, for any software component or configuration entity in the unknown node cluster, multi-hop tracing is performed along asset dependencies and deployment associations. The risk probability score is quantified by comprehensively considering link characteristics and historical attack data. This enables targeted and in-depth risk transmission analysis of specified business assets, accurately quantifying the probability of assets being indirectly threatened due to vulnerabilities in upstream and downstream components, and capturing hidden risks that lack a complete high-risk subgraph and rely solely on dependency links for transmission.

[0061] Step S304: In response to receiving an analysis instruction for the entity to be analyzed, calculate the probability score of the entity to be analyzed; In this step, after receiving the single-entity targeted analysis instruction issued by the outside, the multi-hop association path is reconstructed starting from the specified entity to be analyzed. The same path feature calculation logic is used to independently solve the vulnerability risk probability of the single target entity, realizing dual-mode compatibility of batch node scanning and single-point targeted analysis.

[0062] Step S305: In response to the probability score being greater than a preset threshold, the corresponding target entity is marked as a suspected vulnerability node, and a target vulnerability hypothesis is generated.

[0063] The target vulnerability hypothesis is a complete set of potential vulnerabilities to be verified, integrating all suspected risk nodes from two mining chains. This combines batches of suspected nodes generated by global subgraph matching and high-risk target entities generated by single-point path reasoning, unifying them into a complete set of vulnerability hypotheses, which are then uniformly submitted to the subsequent exploitability verification stage. This approach balances global batch vulnerabilities with single-point targeted propagation risks, avoiding missed vulnerabilities due to a single mining method, comprehensively covering all potential unknown vulnerabilities within the graph, and improving the completeness of vulnerability discovery.

[0064] In one embodiment, optionally, calculating a probability score for the configuration entity or the entity to be analyzed to be a potential unknown vulnerability includes: Input the entity and relation sequence on the multi-hop association path into the recurrent neural network, and output the hidden state corresponding to each position of the multi-hop association path; The entity and relation sequence on a multi-hop association path is a sequence of data formed by splicing entity embedding vectors and relation embedding vectors within the path in the order of the links; the recurrent neural network is a deep learning model with the ability to extract temporal features; the hidden state is the intermediate feature vector output by the recurrent neural network after calculating the sequence segment by segment, which carries the local semantic information of single-step entities and relations.

[0065] In this step, the entire path from the target entity to the known vulnerability is transformed into an ordered vector sequence, which is then fed into a recurrent neural network to extract local features corresponding to each hop node and relationship layer by layer, generating independent hidden states for each location, thus completing the initial extraction of the path's temporal features. This allows for the orderly capture of the temporal dependency features of entities and relationships in a multi-hop link, distinguishing the sequential association logic between different upstream and downstream nodes, and providing a hierarchical feature foundation for subsequent accurate weighted inference.

[0066] Differentiated importance weights are assigned to each node and relation edge in the multi-hop association path using an attention mechanism, and the overall semantic representation of the path is obtained by weighted summation of all hidden states. The attention mechanism is a deep learning weight allocation module that can autonomously identify key nodes and key related edges in the path; the differential importance weight is a weight value in the range of 0 to 1 learned by the model, representing the degree of influence of the corresponding entity and relationship on the vulnerability risk; the overall semantic representation of the path is a unified comprehensive vector after fusing all local features of the entire multi-hop path.

[0067] In this step, for each hidden state along the path, an attention module calculates a unique weight, assigning higher weights to high-risk associated nodes and attack propagation relationships, and lower weights to low-impact nodes. Then, all hidden states are weighted and merged to obtain a comprehensive semantic vector for the entire path. This automatically amplifies the impact of high-risk associated nodes and key dependencies on risk scoring, weakens the interference of irrelevant secondary paths, accurately highlights the core attack propagation path, and improves the discriminativeness and accuracy of vulnerability probability calculation.

[0068] The overall semantic representation of the path is input into a fully connected layer, and after passing through a Sigmoid activation function, a scalar score representing the probability that the target entity has a potential vulnerability is output.

[0069] Fully connected layers are neural network layers used for feature mapping and dimension transformation; the sigmoid activation function can map any real number to the range of 0 to 1; scalar scores are single numerical values ​​between 0 and 1, and the higher the value, the greater the possibility that the target entity has potential vulnerabilities.

[0070] In this step, the fused path semantic vector is fed into a fully connected layer for feature compression mapping, and then normalized using the Sigmoid function. The final output is a probability scalar within the range of 0 to 1, intuitively quantifying the risk of the target entity carrying an unknown vulnerability. This provides a standardized and comparable probability value, facilitating comparison with preset risk thresholds and achieving standardized quantification of risk levels. This provides a clear quantitative basis for selecting hypotheses about second-type vulnerabilities.

[0071] like Figure 4 As shown, in one embodiment, optionally, step S103 includes: Step S401: In response to the assumption that the target vulnerability originates from a configuration entity in the unknown node cluster, extract the attack pattern entity associated with the configuration entity in the multidimensional vulnerability knowledge graph; Step S402: Verify the executability of the attack mode in the corresponding asset operating environment, and verify whether the suspected vulnerable node meets the preset context constraints. Step S403: In response to being executable and meeting the context constraints, the suspected vulnerability node is identified as a confirmed vulnerability. Step S404: In response to the assumption that the target vulnerability originates from the entity to be analyzed, extract the asset-critical information and network topology constraints associated with the entity to be analyzed in the multidimensional vulnerability knowledge graph. Key asset information represents the asset's business value level; network topology constraints refer to topology-related graph attributes such as the network segment where the asset is located, access connectivity, and isolation strategies.

[0072] Step S405: Verify the connectivity of the attack link constructed based on the probability score in the actual network environment, and traverse the protection measure nodes on the attack link to determine whether there is any blocking protection. An attack chain is a multi-hop connected path extending from the target entity to core assets; connectivity represents network reachability between nodes in the chain; blocking protection refers to security measures such as firewalls, access control, and intrusion prevention that can completely block the entire attack chain.

[0073] Step S406: In response to the fact that the attack link is connected and there is no blocking protection, the entity to be analyzed is identified as a confirmed vulnerability.

[0074] In the above solution, a divide-and-conquer verification logic is designed for two types of differentiated vulnerability hypotheses: subgraph matching and path reasoning. The generation mechanism of each type of vulnerability hypothesis is matched to conduct targeted exploitability and environmental constraint verification. The solution fully utilizes the comprehensive association information of attack, asset, topology, and protection built into the multi-dimensional vulnerability knowledge graph without the need to retrieve external data. It can filter out false vulnerability hypotheses that cannot be exploited due to environmental isolation, protection strategies, and permission configuration restrictions, significantly reducing the number of invalid alerts. Only valid vulnerabilities that can be exploited by attackers are retained in the risk quantification stage. This solves the pain points of traditional vulnerability mining methods, such as the proliferation of alerts and the inability to distinguish between theoretical risks and actual threats, and significantly improves the authenticity of vulnerability assessment and its practical guidance value.

[0075] like Figure 5 As shown, in one embodiment, optionally, step S104 includes: Step S501: Extract the basic severity score of the confirmed vulnerability and obtain the criticality adjustment coefficient of the assets affected by the confirmed vulnerability. The vulnerability base severity score is used to rate the inherent risk level of the vulnerability; the asset criticality adjustment factor is used to quantify the business importance of the affected assets.

[0076] The basic severity score of a vulnerability can be directly read from the entity attributes of the multidimensional vulnerability knowledge graph, and the criticality level parameter corresponding to the asset entity associated with the vulnerability can be retrieved as an adjustment coefficient.

[0077] Step S502: Query the shortest attack path from the node of the confirmed vulnerability to the critical asset node in the multidimensional vulnerability knowledge graph; The shortest attack path refers to the link within the graph that requires the fewest steps to reach a core high-value asset node from a vulnerable node.

[0078] In this step, leveraging the multi-hop retrieval capabilities of the graph database, the connected links from the vulnerability to all critical assets are traversed, and the attack link with the shortest jump length is selected as the baseline path for risk calculation. This approach selects the link with the lowest attack difficulty as the evaluation criterion, aligning with the actual behavioral logic of attackers prioritizing the simplest attack path and avoiding underestimation of the actual threat.

[0079] Step S503: Query the shortest attack path from the node of the confirmed vulnerability to the critical asset node in the multidimensional vulnerability knowledge graph; Historical success attack probability is the statistical probability that a corresponding attack step in historical threat intelligence is successfully utilized; attack path reachability penalty factor is used to quantify the difficulty for an attacker to successfully execute the entire attack chain.

[0080] This step counts the number of nodes hopping along the shortest path, retrieves the historical attack success rates corresponding to each attack segment of the path, multiplies them, and calculates the reachability penalty factor by combining this with the inverse proportional relationship of path length. In this way, the difficulty of implementing an attack chain is quantified: the shorter the path and the higher the historical attack success rate, the larger the penalty factor, corresponding to a higher vulnerability risk, accurately reflecting the actual exploitability differences of the attack chain.

[0081] Step S504: Obtain all protection measure nodes on the shortest attack path; based on the protectable relationships in the multidimensional vulnerability knowledge graph, query the offset efficiency weight of each protection measure against attack techniques on the path; and combine the current deployment health status coefficient of each protection measure to calculate the weighted effective protection strength. The offset efficiency weight represents the ability of protective measures to intercept and suppress corresponding attack methods; the deployment health status coefficient represents whether the protective equipment and strategies are currently effective.

[0082] This step iterates through all protected entities along the shortest attack path, queries the offset weight of the protection against the current attack based on the semantic relationships in the graph, and then sums them together with the protection's operational health coefficient to obtain the overall protection strength. This quantifies the comprehensive interception capability of security protection along the entire attack path, fully considers whether the protection equipment is operating normally, avoids overestimating the actual protection effect, and ensures that the risk calculation closely reflects the actual on-site protection deployment status.

[0083] Step S505: Based on the vulnerability severity score, the criticality adjustment coefficient, the attack path reachability penalty factor, and the weighted effective protection strength, the target risk value is calculated using a preset dynamic risk formula.

[0084] The dynamic risk formula is a comprehensive quantitative calculation formula that integrates multi-dimensional environmental parameters; the target risk value is the actual comprehensive threat score of the vulnerability in the current complete network environment.

[0085] The vulnerability baseline score, asset weight, protection strength, and attack path penalty factor obtained in the previous steps are uniformly substituted into a preset dynamic risk calculation formula to output a quantified target risk value. In this way, by integrating multi-dimensional contextual information such as the vulnerability itself, asset value, attack chain, and security protection, dynamic and personalized quantification of vulnerability risk is achieved, solving the problems of traditional vulnerability scoring being divorced from the real network environment and the judgment results being vague and general.

[0086] In one embodiment, optionally, generating a risk warning report with priority ranking and mitigation paths based on the target risk value includes: The target risk value is matched with a preset risk level range to determine the warning priority of the confirmed vulnerability, wherein the warning priority is positively correlated with the target risk value; Extract the shortest attack path from the confirmed vulnerability node to the critical asset node in the multidimensional vulnerability knowledge graph, use the shortest attack path as the mitigation path, and identify the critical jump nodes and protection measure nodes on the mitigation path; For the key jump nodes on the mitigation path, a corresponding hardening strategy is matched, and for the protective measure nodes, optimization suggestions are generated by combining their offset efficiency weight and deployment health status coefficient. The risk warning report is generated by integrating the warning priority, the mitigation path, the identification information, and the optimization suggestions.

[0087] The above describes the entire process of generating a warning report after dynamic risk quantification. Based on the target risk value of confirmed vulnerabilities, the attack chain stored in the vulnerability graph, and security handling knowledge, the warning output is completed in four steps: First, the dynamically calculated target risk value is compared with the pre-divided risk level ranges to complete the classification and judgment. The higher the risk value, the higher the handling priority, realizing automatic sorting of vulnerability alarms; the shortest attack path from the vulnerability to the core asset retrieved in the risk assessment stage is reused as the attack blocking and mitigation path, and the key asset jump nodes that play a relay role on the link and all protection measure nodes along the way are marked to completely reconstruct the entire attack transmission link; according to the entity association relationship in the multi-dimensional vulnerability knowledge graph, standardized security hardening strategies are automatically matched for the asset nodes in the link. At the same time, the attack offset efficiency weight of the protection measures and the current deployment health operation coefficient are combined to locate the protection shortcomings and generate targeted upgrade, repair, expansion and optimization suggestions; finally, the warning handling priority, visualized attack mitigation path, link node identification, asset hardening scheme, and protection optimization suggestions are all structured and integrated to output a complete standardized risk warning report, providing security operation and maintenance personnel with an integrated basis for analysis and handling. The entire process reuses existing knowledge graph data and previous calculation results, eliminating the need for repeated retrieval and calculation. The hierarchical structure, link display, and rectification plan generation are all completed automatically.

[0088] In one embodiment, optionally, the method further includes: The results of risk warning processing, newly discovered attack cases, and confirmed false alarms are used as feedback inputs to incrementally update the multidimensional vulnerability knowledge graph. The incremental updates include: adding new entities and relationships, adjusting the confidence weights of existing relationships, and correcting the attribute values ​​of entities.

[0089] Feedback input refers to three types of iterative data: closed-loop vulnerability handling data, newly added attack samples, and manually confirmed false alarm records. Incremental updates involve locally modifying the graph content without reconstructing the global graph. Adding entities and relationships involves supplementing the graph with previously uncollected vulnerability, asset, attack, and protection nodes, along with their corresponding semantic associations. Relationship confidence weights are used to characterize the credibility of relationships between entities. Entity attribute values ​​refer to parameters such as severity, criticality, and operational status inherent in entities like vulnerabilities, assets, and protections.

[0090] The aforementioned solution, after completing one round of vulnerability discovery and risk warning handling, collects vulnerability handling records from operations and maintenance personnel, novel attack cases captured on-site, and false alarm information verified manually as iterative data sources to continuously update the multi-dimensional vulnerability knowledge graph locally and dynamically. The update operation does not require rebuilding the entire graph; it only adds new security entities and relationships as needed, adjusts the credibility of existing relationships based on real-world handling feedback, and corrects outdated or incorrect entity attributes, achieving continuous iterative optimization of the graph's knowledge. In this way, by continuously absorbing real-world security events to optimize the underlying knowledge base, constantly enriching the graph's entities and relationships, correcting knowledge biases, and gradually improving the accuracy of subsequent vulnerability discovery reasoning and the relevance of risk assessment, it addresses the shortcomings of traditional static vulnerability databases that cannot adapt to new network attacks and suffer from long-term knowledge lag. This gives the entire vulnerability discovery and warning solution the ability to continuously learn and optimize autonomously.

[0091] The technical solutions of the present invention will be described in detail below with reference to specific embodiments.

[0092] Example 1: Reference Appendix Figure 6 This embodiment systematically illustrates the overall architecture and core processing flow of the method described in this invention. The core of this method is to construct a unified multi-dimensional vulnerability knowledge graph and, based on this, achieve intelligent reasoning and dynamic evaluation. The entire process includes three closely interconnected stages: knowledge construction, intelligent mining, and risk warning.

[0093] The first stage is the construction and representation of a multi-dimensional vulnerability knowledge graph. For example... Figure 7 As shown, this stage extracts security knowledge entities and relationships from multiple heterogeneous data sources. For cases where the same entity exhibits attribute conflicts across different data sources, a confidence fusion algorithm based on authority and time is employed. This fusion algorithm assigns an authority weight to each data source, and each data item has a time decay factor. The final attribute value V of entity e is calculated using the following formula:

[0094] in, It is the authority weight of data source i, v i It is the attribute value provided by data source i, t i It is the timestamp of the data item. It is a time decay function, usually defined as λ is the decay coefficient. All fused knowledge is stored in the form of triples. To support semantic computation, graph embedding is used to map entities and relations to low-dimensional continuous vectors. The training objective is to make the score function of real triples higher than that of negative triples constructed by random replacement. For a triple, its score function is expressed as:

[0095] Where h, ×r, and ×t represent the vectors of the head entity, relation, and tail entity, respectively. The goal of model training is to minimize the margin-based ranking loss function:

[0096] Where γ is the marginal hyperparameter, t is the true positive triplet, and h is the negative triplet constructed by randomly replacing h or t.

[0097] The second stage is graph-based intelligent vulnerability discovery. When performing potential risk analysis on a target entity q, the system searches for all multi-hop association paths from q to the known vulnerable entity v. Each path P is defined as a sequence of entities and relationships. To quantify the strength of the path as evidence, a path reasoning model based on recurrent neural networks and attention mechanisms is employed. This model first inputs the embedding vectors of the path sequences into the RNN to obtain the hidden state h at each position. i Attention weight α i Calculated using the following formula:

[0098] Where u, W, and b are trainable parameters, and the softmax function ensures that the sum of all weights is 1. The overall semantic representation c of the path is the weighted sum of all hidden states:

[0099] Ultimately, the confidence score s supporting the hypothesis that "q has a vulnerability" is output through a fully connected layer and a sigmoid activation function:

[0100] Where w and b are parameters, and σ is the sigmoid function. The overall potential risk score of entity q is obtained by combining the scores of multiple paths.

[0101] The third stage is dynamic risk warning based on integrated context. For example... Figure 8 As shown, for a confirmed vulnerability, its dynamic risk value R for a specific asset A is calculated using the following comprehensive formula:

[0102] In this formula: S represents the basic severity score of the vulnerability, derived from standard scoring systems such as CVSS.

[0103] C is the asset key adjustment factor, which is set according to the asset value.

[0104] P represents the weighted effective protection strength. Its calculation depends on the evaluation of all protective measures along the attack path. Suppose there are M protective measures along the attack path, and the original protection effectiveness weight of the m-th protective measure is... Its current deployment health status coefficient is ,but:

[0105] F is the attack path reachability penalty factor, used to quantify the feasibility of an attack chain. Its calculation formula is:

[0106] Where K is the product of the success rates of each attack step on the path based on historical data statistics, and L is the length of the shortest attack path from the vulnerability to the asset.

[0107] Based on the R value calculated above, the system can achieve accurate risk classification and priority ranking, and automatically generate early warning reports containing key attack path maps and targeted mitigation suggestions.

[0108] Example 2: Dynamic Contextual Risk Assessment for Web Server Vulnerabilities Reference Appendix Figure 9 This example demonstrates the specific application of the dynamic risk assessment formula. Assume that a web server is found to have a vulnerability CVE-2024-1234 during a scan, with a CVSS baseline score S of 9.0. The criticality coefficient C of this server asset is set to 0.9. The graph shows that a database server with a criticality of 1.5 is dependent on this web server and is the ultimate target of the attack.

[0109] Analyzing the attack path from the vulnerability to the database server, the shortest path length L is 2. Based on historical threat intelligence, the success rate product K of this type of attack path is estimated to be 0.8. A web application firewall is deployed on this path, and its protection effectiveness weight e against the corresponding attack is recorded in the knowledge graph as 0.6, and its current operational health coefficient h is 1.0.

[0110] Calculate according to the formula: The weighted effective protection strength P = e•h = 0.6 × 1.0 = 0.6.

[0111] The attack path reachability penalty factor F = K / L = 0.8 / 2 = 0.4.

[0112] The dynamic risk value R = S•C / (1+P)+F = 9.0×1.5 / (1+0.6)+0.4 = 13.5 / 1.6+0.4≈ 8.44 + 0.4 = 8.84.

[0113] The assessment results show that although the inherent score of the vulnerability is as high as 9.0, its true contextual risk value reaches 8.84 due to the high criticality of the asset and the limited existing protection, clearly indicating that immediate action is required. This verifies the superiority of the dynamic formula over the static scoring.

[0114] Example 3: Potential Intrusion Detection Based on Correlation of Abnormal Login Behavior Reference Appendix Figure 10 This embodiment demonstrates the use of knowledge graphs to uncover potential intrusion behaviors. The intelligent mining module detected three new abnormal login event records in the knowledge graph within a time window, involving three different workstations in the marketing and R&D departments.

[0115] The association analysis was initiated automatically. First, it used a path reasoning model to calculate the association strength between the three events. The model found that although the three workstations belonged to different departments, they were all connected to an internal code repository server through a "visited" relationship in the network graph, and the login times were concentrated outside of working hours. The path reasoning model gave a confidence score s of 0.87 for this "abnormal login -> server access" association pattern.

[0116] Next, this pattern was matched with subgraphs of historical attack cases in the attack graph. The matching results showed that the pattern had a 78% structural similarity to a known "lateral movement -> information theft" attack script. A preliminary assessment was conducted based on the risk warning formula: assuming this anomalous pattern represents a potential threat, its base severity S can be analogously set to 7.0; the criticality C of the target code repository assets is 1.8; no effective protective measures were identified on the path, so P=0; the attack path length L is short, and the penalty factor F is high.

[0117] Based on the above analysis, although no traditional vulnerabilities were found, the system still generated a high-risk warning: Lateral movement suspected of coordinated intrusion was detected, with a potential risk value exceeding 8.0. Immediate security checks and source tracing of the relevant accounts, workstations, and code repositories are recommended. This example demonstrates the invention's ability to discern complex attack chains from discrete events.

[0118] The above-mentioned solution of the present invention effectively overcomes the defects of information isolation and static evaluation in traditional solutions by constructing and utilizing a multi-dimensional vulnerability knowledge graph that deeply integrates multi-source security knowledge. Its core beneficial effect is that it can perform intelligent reasoning based on the semantic association and topological structure of the graph, realizing a leap from passive feature matching to proactive association prediction in vulnerability mining. Furthermore, it dynamically calculates the risk based on the context of the vulnerability in a specific network environment, transforming the evaluation result from a static score detached from the environment to a dynamic judgment that fits the actual threat. Finally, it outputs accurate early warnings with clear attack paths and mitigation measures, thereby systematically improving the initiative of security defense, the accuracy of risk assessment, and the level of intelligence in response decision-making.

[0119] like Figure 11 As shown, in a second aspect, embodiments of this application provide a risk warning device 1100 that integrates knowledge graphs, the device comprising: The acquisition module 1101 is used to acquire a multi-dimensional vulnerability knowledge graph, which includes: global vulnerability entities, asset entities, attack mode entities, protection measure entities, and multi-dimensional semantic relationships between entities. The multi-dimensional semantic relationships include at least vulnerability exploitation relationships, asset dependency relationships, attack chain timing relationships, and protection measure offset relationships. The vulnerability mining module 1102 is used to locate unknown node clusters with potential risks by subgraph pattern matching based on the topological structure and semantic association of the multidimensional vulnerability knowledge graph, and to perform association path reasoning based on the unknown node clusters or entities to be analyzed, to mine potential unknown vulnerabilities and generate target vulnerability hypotheses. The vulnerability confirmation module 1103 is used to perform exploitability verification and context constraint analysis on the target vulnerability hypothesis based on the attack patterns and asset information associated with the target vulnerability hypothesis in the multidimensional vulnerability knowledge graph, and to obtain the confirmed vulnerability. The calculation module 1104 is used to calculate the corresponding target risk value based on the context of the confirmed vulnerability in the multidimensional vulnerability knowledge graph, wherein the context includes at least the criticality level of the affected asset, the shortest attack path length from the vulnerability node to the critical asset, and the weighted evaluation value of the protection measures on the path. The generation module 1105 is used to generate a risk warning report with priority sorting and mitigation paths based on the target risk value.

[0120] In one embodiment, optionally, the acquisition module includes: The model acquisition unit is used to acquire the vulnerability knowledge domain ontology model and determine the concept type, entity attribute and relationship type of the vulnerability knowledge domain, wherein the relationship type includes exploitable, exists, depends on, can cause and can be protected; The fusion unit is used to extract instance data from structured vulnerability databases, unstructured security announcements, and network asset configuration data using named entity recognition and relation extraction models, and to fuse conflicting or redundant instances based on the authority weight of the data source and the freshness of the data time. The learning unit is used to store the fused knowledge into the graph database in the form of triples, and to perform vectorized representation learning on entities and relations to generate low-dimensional embedding vectors.

[0121] In one embodiment, optionally, the vulnerability discovery module includes: The subgraph acquisition unit is used to acquire the feature subgraph patterns exhibited by the preset high-risk vulnerabilities in the multidimensional vulnerability knowledge graph. The feature subgraph patterns include preset combinations of entity types and relation connection sequences. The identification unit is used to perform isomorphic or approximate subgraph search in the multidimensional vulnerability knowledge graph to identify unknown node clusters that match the feature subgraph pattern; The calculation unit is used to analyze any software component or configuration entity in the unknown node cluster, and to calculate the probability score of the configuration entity becoming a potential unknown vulnerability based on the type, strength and frequency of historical attack cases of the relationships in the multi-hop association path. A tagging unit is used to calculate a probability score of the entity to be analyzed in response to receiving an analysis instruction for the entity to be analyzed. The merging unit is used to mark the corresponding target entity as a suspected vulnerability node and generate a target vulnerability hypothesis in response to the probability score being greater than a preset threshold.

[0122] In one embodiment, optionally, the computing unit is used for: Input the entity and relation sequence on the multi-hop association path into the recurrent neural network, and output the hidden state corresponding to each position of the multi-hop association path; Differentiated importance weights are assigned to each node and relation edge in the multi-hop association path using an attention mechanism, and the overall semantic representation of the path is obtained by weighted summation of all hidden states. The overall semantic representation of the path is input into a fully connected layer, and after passing through a Sigmoid activation function, a scalar score representing the probability that the target entity has a potential vulnerability is output.

[0123] In one embodiment, optionally, the vulnerability verification module includes: The first extraction unit is used to extract the attack pattern entity associated with the configuration entity in the multidimensional vulnerability knowledge graph in response to the assumption that the target vulnerability originates from the configuration entity in the unknown node cluster. The verification unit is used to verify the executability of the attack mode in the corresponding asset operating environment and to verify whether the suspected vulnerable node meets the preset context constraints. The first determining unit is configured to determine the suspected vulnerability node as a confirmed vulnerability in response to the fact that it is executable and meets the context constraints. The second extraction unit is used to extract the asset-critical information and network topology constraints associated with the entity to be analyzed in the multidimensional vulnerability knowledge graph in response to the assumption that the target vulnerability originates from the entity to be analyzed. The verification unit is used to verify the connectivity of the attack link constructed based on the probability score in the actual network environment, and to traverse the protection measure nodes on the attack link to determine whether there is any blocking protection. The second determining unit is used to determine the entity to be analyzed as a confirmed vulnerability in response to the fact that the attack link is connected and there is no blocking protection.

[0124] In one embodiment, optionally, the computing module includes: The third extraction unit is used to extract the basic severity score of the confirmed vulnerability and obtain the criticality adjustment coefficient of the assets affected by the confirmed vulnerability. The first query unit is used to query the shortest attack path from the node of the confirmed vulnerability to the critical asset node in the multidimensional vulnerability knowledge graph. The statistics unit is used to count the length of the shortest attack path and the historical success probability of each attack step on the path, and to calculate the attack path reachability penalty factor, wherein the attack path reachability penalty factor is inversely proportional to the length of the shortest attack path and directly proportional to the product of the historical success probability of each attack step on the path. Obtain all protection measure nodes on the shortest attack path, query the countermeasure efficiency weight of each protection measure against attack techniques on the path based on the protectable relationship in the multidimensional vulnerability knowledge graph, and calculate the weighted effective protection strength by combining the current deployment health status coefficient of each protection measure. The second query unit is used to calculate the target risk value based on the vulnerability's basic severity score, the criticality adjustment coefficient, the attack path reachability penalty factor, and the weighted effective protection strength using a preset dynamic risk formula.

[0125] In one embodiment, optionally, the generation module includes: A priority determination unit is used to match the target risk value with a preset risk level range to determine the warning priority of the confirmed vulnerability, wherein the warning priority is positively correlated with the target risk value; The fourth extraction unit is used to extract the shortest attack path from the confirmed vulnerability node to the critical asset node in the multidimensional vulnerability knowledge graph, use the shortest attack path as the mitigation path, and identify the critical jump node and protection measure node on the mitigation path. The suggestion generation unit is used to match the corresponding hardening strategy for the key jump nodes on the mitigation path, and to generate optimization suggestions for the protection measure nodes by combining their offset efficiency weight and deployment health status coefficient. An integration unit is used to integrate the warning priority, the mitigation path, the identification information, and the optimization suggestions to generate the risk warning report.

[0126] In one embodiment, optionally, the apparatus further includes: The update module is used to incrementally update the multidimensional vulnerability knowledge graph by taking the processing results of risk warnings, newly discovered attack cases, and confirmed false alarm information as feedback inputs. The incremental updates include: adding new entities and relationships, adjusting the confidence weights of existing relationships, and correcting the attribute values ​​of entities.

[0127] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the aforementioned risk warning method for fused knowledge graphs.

[0128] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the aforementioned risk warning method for fused knowledge graphs.

[0129] Specific limitations regarding the risk warning device for integrated knowledge graphs can be found in the limitations of the risk warning method for integrated knowledge graphs mentioned above, and will not be repeated here. Each module in the aforementioned risk warning device for integrated knowledge graphs can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0130] The software tools or components not belonging to our company that appear in the embodiments of this application are merely examples and do not represent actual use.

[0131] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 12 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the server-side functions or steps of a risk warning method integrating knowledge graphs.

[0132] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 13 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements client-side functions or steps of a risk warning method integrating knowledge graphs.

[0133] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in any one of the first aspect embodiments.

[0134] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or electronic device described above can be referred to the relevant descriptions in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0135] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0136] It should be understood that although the terms "first," "second," etc., may be used to describe the setting units in the embodiments of this application, these setting units should not be limited to these terms. These terms are only used to distinguish the setting units from each other. For example, without departing from the scope of the embodiments of this application, the first setting unit may also be referred to as the second setting unit, and similarly, the second setting unit may also be referred to as the first setting unit.

[0137] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0138] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.

[0139] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0140] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A risk warning method integrating knowledge graphs, characterized in that, The method includes: A multidimensional vulnerability knowledge graph is obtained, which includes: global vulnerability entities, asset entities, attack mode entities, protection measure entities, and multidimensional semantic relationships between entities. The multidimensional semantic relationships include at least vulnerability exploitation relationships, asset dependency relationships, attack chain temporal relationships, and protection measure offset relationships. Based on the topological structure and semantic association of the multidimensional vulnerability knowledge graph, unknown node clusters with potential risks are located by subgraph pattern matching, and related path reasoning is performed based on the unknown node clusters or the entities to be analyzed to discover potential unknown vulnerabilities and generate target vulnerability hypotheses. Based on the attack patterns and asset information associated with the target vulnerability hypothesis in the multidimensional vulnerability knowledge graph, the exploitability verification and context constraint analysis of the target vulnerability hypothesis are performed to obtain the confirmed vulnerability. Based on the context of the confirmed vulnerabilities in the multidimensional vulnerability knowledge graph, the corresponding target risk value is calculated, wherein the context includes at least the criticality level of the affected asset, the shortest attack path length from the vulnerability node to the critical asset, and the weighted evaluation value of the protective measures on the path. A risk warning report with priority ranking and mitigation paths is generated based on the target risk value.

2. The method according to claim 1, characterized in that, The acquisition of the multi-dimensional vulnerability knowledge graph includes: Obtain an ontology model of the vulnerability knowledge domain and determine the concept types, entity attributes, and relationship types of the vulnerability knowledge domain, wherein the relationship types include exploitable, existent, dependent, causable, and protectable; Instance data is extracted from structured vulnerability databases, unstructured security bulletins, and network asset configuration data using named entity recognition and relation extraction models. Conflicting or redundant instances are then fused based on the authority weight of the data source and the freshness of the data. The fused knowledge is stored in a graph database in the form of triples, and vectorized representation learning is performed on entities and relations to generate low-dimensional embedding vectors.

3. The method according to claim 1, characterized in that, Based on the topological structure and semantic relationships of the multidimensional vulnerability knowledge graph, unknown node clusters with potential risks are located through subgraph pattern matching. Then, based on these unknown node clusters or the entities to be analyzed, association path reasoning is performed to uncover potential unknown vulnerabilities and generate target vulnerability hypotheses, including: Obtain the feature subgraph pattern of a preset high-risk vulnerability in the multidimensional vulnerability knowledge graph, wherein the feature subgraph pattern includes a preset combination of entity types and a sequence of relational connections; Perform isomorphic or approximate subgraph search in the multidimensional vulnerability knowledge graph to identify unknown node clusters that match the feature subgraph pattern; For any software component or configuration entity in the unknown node cluster, analyze its multi-hop association path formed by its dependence on or existence in the relationship and the preset vulnerability database. Calculate the probability score of the configuration entity becoming a potential unknown vulnerability based on the type, strength, and frequency of historical attack cases of the relationship in the multi-hop association path. In response to receiving an analysis command for the entity to be analyzed, a probability score for the entity to be analyzed is calculated; In response to the probability score being greater than a preset threshold, the corresponding target entity is marked as a suspected vulnerability node, and a target vulnerability hypothesis is generated.

4. The method according to claim 3, characterized in that, Calculate the probability score of the configured entity or the entity to be analyzed becoming a potential unknown vulnerability, including: Input the entity and relation sequence on the multi-hop association path into the recurrent neural network, and output the hidden state corresponding to each position of the multi-hop association path; Differentiated importance weights are assigned to each node and relation edge in the multi-hop association path using an attention mechanism, and the overall semantic representation of the path is obtained by weighted summation of all hidden states. The overall semantic representation of the path is input into a fully connected layer, and after passing through a Sigmoid activation function, a scalar score representing the probability that the target entity has a potential vulnerability is output.

5. The method according to claim 1, characterized in that, Based on the attack patterns and asset information associated with the target vulnerability hypothesis in the multi-dimensional vulnerability knowledge graph, the exploitability of the vulnerability hypothesis is verified and contextual constraint analysis is performed to obtain confirmed vulnerabilities, including: In response to the assumption that the target vulnerability originates from a configuration entity in the unknown node cluster, the attack pattern entity associated with the configuration entity in the multidimensional vulnerability knowledge graph is extracted. Verify the executability of the attack mode in the corresponding asset operating environment, and check whether the suspected vulnerable nodes meet the preset context constraints. In response to being executable and meeting the aforementioned context constraints, the suspected vulnerability node is identified as a confirmed vulnerability; In response to the assumption that the target vulnerability originates from the entity to be analyzed, the asset-critical information and network topology constraints associated with the entity to be analyzed in the multidimensional vulnerability knowledge graph are extracted. Verify the connectivity of the attack link constructed based on the probability score in the actual network environment, and traverse the protection measure nodes on the attack link to determine whether there is any blocking protection. In response to the fact that the attack chain is connected and there is no blocking protection, the entity to be analyzed is identified as a confirmed vulnerability.

6. The method according to claim 1, characterized in that, The step of calculating the corresponding target risk value based on the context of the confirmed vulnerability in the multidimensional vulnerability knowledge graph includes: Extract the base severity score of the confirmed vulnerability and obtain the criticality adjustment coefficient of the assets affected by the confirmed vulnerability; Query the shortest attack path from the node of the confirmed vulnerability to the critical asset node in the multidimensional vulnerability knowledge graph; The length of the shortest attack path and the historical success probability of each attack step on the path are statistically analyzed, and the reachability penalty factor of the attack path is calculated. The reachability penalty factor of the attack path is inversely proportional to the length of the shortest attack path and directly proportional to the product of the historical success probabilities of each attack step on the path. Obtain all protection measure nodes on the shortest attack path, query the countermeasure efficiency weight of each protection measure against attack techniques on the path based on the protectable relationship in the multidimensional vulnerability knowledge graph, and calculate the weighted effective protection strength by combining the current deployment health status coefficient of each protection measure. Based on the vulnerability's basic severity score, the criticality adjustment coefficient, the attack path reachability penalty factor, and the weighted effective protection strength, the target risk value is calculated using a preset dynamic risk formula.

7. The method according to claim 1, characterized in that, The generation of a risk warning report with priority ranking and mitigation paths based on the target risk value includes: The target risk value is matched with a preset risk level range to determine the warning priority of the confirmed vulnerability, wherein the warning priority is positively correlated with the target risk value; Extract the shortest attack path from the confirmed vulnerability node to the critical asset node in the multidimensional vulnerability knowledge graph, use the shortest attack path as the mitigation path, and identify the critical jump nodes and protection measure nodes on the mitigation path; For the key jump nodes on the mitigation path, a corresponding hardening strategy is matched, and for the protective measure nodes, optimization suggestions are generated by combining their offset efficiency weight and deployment health status coefficient. The risk warning report is generated by integrating the warning priority, the mitigation path, the identification information, and the optimization suggestions.

8. A risk warning device integrating knowledge graphs, characterized in that, The device includes: The acquisition module is used to acquire a multi-dimensional vulnerability knowledge graph, which includes: global vulnerability entities, asset entities, attack mode entities, protection measure entities, and multi-dimensional semantic relationships between entities. The multi-dimensional semantic relationships include at least vulnerability exploitation relationships, asset dependency relationships, attack chain temporal relationships, and protection measure offset relationships. The vulnerability discovery module is used to locate unknown node clusters with potential risks by subgraph pattern matching based on the topological structure and semantic association of the multidimensional vulnerability knowledge graph, and to perform association path reasoning based on the unknown node clusters or the entities to be analyzed, to discover potential unknown vulnerabilities and generate target vulnerability hypotheses. The vulnerability confirmation module is used to perform exploitability verification and context constraint analysis on the target vulnerability hypothesis based on the attack patterns and asset information associated with the target vulnerability hypothesis in the multi-dimensional vulnerability knowledge graph, and to obtain the confirmed vulnerability. The calculation module is used to calculate the corresponding target risk value based on the context of the confirmed vulnerability in the multidimensional vulnerability knowledge graph, wherein the context includes at least the criticality level of the affected asset, the shortest attack path length from the vulnerability node to the critical asset, and the weighted evaluation value of the protection measures on the path. The generation module is used to generate a risk warning report with priority ranking and mitigation paths based on the target risk value.

9. A computer device, characterized in that, include: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor; The instructions are configured to perform the method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The device stores computer-executable instructions for performing the method as described in any one of claims 1 to 7.

Images