Knowledge integration method and system based on multi-source exposure surface data

Abstract

The application relates to the technical field of data processing, and provides a knowledge integration method and system based on multi-source exposure surface data. The method comprises the following steps: collecting initial exposure surface data of different channels, performing conflict resolution processing, and obtaining target exposure surface data containing exposure surface entity attribute information and inter-entity correlation relationship description weighted by channel credibility; then, constructing an initial security posture knowledge graph according to the target exposure surface data, wherein a node set of the initial security posture knowledge graph contains vulnerable point and potential vulnerability exploitation path entities, and an edge set of the initial security posture knowledge graph contains inter-entity causal correlation relationship and impact degree descriptors; then, performing layer division and attribute updating operations on the initial security posture knowledge graph according to channel labels of the initial exposure surface data, and obtaining a multi-level security posture knowledge graph of multi-level channel subgraphs; finally, in response to security logs, performing reinforcement or hiding processing on a correlation target layer, and generating a real-time updated security posture knowledge graph.

Description

Technical Field

[0001] This application belongs to the field of data processing technology, specifically relating to a knowledge integration method and system based on multi-source exposure surface data. Background Technology

[0002] In today's digital age, cybersecurity faces increasingly severe challenges, with penetration methods becoming ever more sophisticated and sophisticated. To comprehensively understand the network security landscape and promptly detect and respond to potential security threats, collecting and integrating multi-source exposure surface data has become crucial. Currently, existing technologies primarily focus on collecting exposure surface data from various channels, such as network monitoring systems, vulnerability scanning tools, and threat intelligence platforms, to obtain information about vulnerabilities and potential exploitation paths. Some technologies perform simple organization and analysis of the collected data to construct basic security knowledge graphs, used to illustrate relationships between entities and potential security risks.

[0003] However, existing technologies have significant limitations. On the one hand, conflicts and inconsistencies often exist between multi-source data. Different channels may describe the attributes of the same entity and the relationships between entities differently, affecting the accuracy and reliability of the data and making it difficult to form a unified and accurate security posture view. On the other hand, existing technologies lack a dynamic update mechanism for knowledge graphs, making it impossible to respond promptly to new security events and protective measures. Consequently, the knowledge graph cannot reflect the latest security posture in real time, making it difficult to meet the needs of actual security protection. Summary of the Invention

[0004] This application provides a knowledge integration method and system based on multi-source exposure surface data.

[0005] In a first aspect, embodiments of this application provide a knowledge integration method based on multi-source exposure surface data, applied to a knowledge integration system based on multi-source exposure surface data, the method comprising: Initial exposure surface data from different channels is collected, and conflict resolution processing is performed on the initial exposure surface data to obtain target exposure surface data. The target exposure surface data includes entity attribute information weighted by channel credibility and description of the relationship between entities. An initial security posture knowledge graph is constructed based on the target exposure surface data. The node set of the initial security posture knowledge graph includes vulnerability entities and potential vulnerability exploitation path entities, and the edge set includes causal relationships and impact degree descriptors between entities. Based on the channel tags of the initial exposure surface data, perform layer division and attribute update operations on the initial security situation knowledge graph to obtain a multi-level security situation knowledge graph containing multi-level channel subgraphs. The layer attributes of the multi-level channel subgraphs include channel type identifiers and data collection timestamps. In response to security protection logs reported from different channels, layer enhancement or layer hiding processing is performed on the target layers associated with the security protection logs in the multi-level security situation knowledge graph to generate a real-time updated security situation knowledge graph.

[0006] Secondly, embodiments of this application provide a knowledge integration system based on multi-source exposure surface data, which includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the above-described method.

[0007] Thirdly, embodiments of this application provide a computer-readable storage medium including a computer program, which, when run on a knowledge integration system based on multi-source exposure surface data, causes the knowledge integration system based on multi-source exposure surface data to perform the steps of the above-described method.

[0008] This application first collects initial exposure surface data from different channels and performs conflict resolution processing. It comprehensively considers the credibility of each channel and weights the entity attribute information and the relationship between entities, effectively solving the conflict and inconsistency problem of multi-source data, making the target exposure surface data more accurate and reliable, and avoiding erroneous analysis and decision-making caused by data conflicts.

[0009] Secondly, an initial security posture knowledge graph is constructed based on the target exposure surface data. Its node set covers vulnerable entities and entities that may be exploited by potential vulnerabilities, and the edge set contains causal relationships and impact descriptors between entities. It comprehensively and meticulously presents the overall posture of the exposure surface, enabling security personnel to accurately and comprehensively understand the source, path, and potential impact of vulnerability exploitation.

[0010] Then, based on the channel labels of the initial exposure surface data, the initial security situation knowledge graph is divided into layers and its attributes are updated to obtain a multi-level security situation knowledge graph with multiple channel subgraphs. Each subgraph has a clear channel type identifier and data collection timestamp. This hierarchical structure not only facilitates the management and analysis of data from different channels, but also allows for the tracking of data changes based on the time dimension, improving the maintainability and scalability of the knowledge graph.

[0011] Finally, in response to security protection logs reported from different channels, layer enhancement or layer hiding processing is performed on the target layers associated in the multi-level security situation knowledge graph, realizing real-time updates of the knowledge graph. This enables timely reflection of the latest security situation and the effectiveness of protection measures, allowing security personnel to adjust protection strategies according to the real-time situation, thereby enhancing the system's emergency response capabilities and security. Attached Figure Description

[0012] Figure 1 This is a flowchart illustrating a knowledge integration method based on multi-source exposure surface data provided in an embodiment of this application.

[0013] Figure 2 This is a schematic diagram of the structure of a knowledge integration system based on multi-source exposure surface data provided in an embodiment of this application. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0015] See Figure 1 This is a knowledge integration method based on multi-source exposure surface data provided in the embodiments of this application. This method can be applied to a knowledge integration system based on multi-source exposure surface data, specifically steps 110-140.

[0016] Step 110: Collect initial exposure surface data from different channels, perform conflict resolution processing on the initial exposure surface data to obtain target exposure surface data, the target exposure surface data includes entity attribute information weighted by channel credibility and description of the relationship between entities.

[0017] In knowledge integration scenarios involving multi-source exposure surface data, the first step is to collect initial exposure surface data from various channels, including network monitoring systems, vulnerability scanning tools, and threat intelligence platforms. Since data from different channels may conflict—for example, the attribute information of the same entity might be described differently on different channels, or the descriptions of relationships between entities might be inconsistent—conflict resolution processing is necessary for the initial exposure surface data. By considering the credibility of each channel, the entity attribute information is weighted, and the descriptions of relationships between entities are clarified, ultimately resulting in more accurate and reliable target exposure surface data.

[0018] As one implementation, the process of collecting initial exposure surface data from different channels and performing conflict resolution processing on the initial exposure surface data to obtain target exposure surface data includes: Step 111: Receive initial exposure surface data from multiple channels through a preset data access interface. The initial exposure surface data includes scan data, vulnerability intelligence data, and threat intelligence data. The initial exposure surface data from each channel carries a channel type identifier and a data credibility score.

[0019] The pre-defined data access interface is specifically designed to receive initial exposure surface data from different channels. This data includes various types: scan data, obtained by scanning the network using scanning tools, reflects potential exposure surface assets; vulnerability intelligence data provides detailed information about system or software vulnerabilities to understand potential security risks; and threat intelligence data analyzes and predicts various threats. Each channel's initial exposure surface data is labeled with a channel type, such as network monitoring or vulnerability scanning, to easily distinguish the data source. It also includes a data credibility score, which is a comprehensive evaluation based on factors such as the channel's historical performance and data accuracy, serving as a weighted reference during conflict resolution.

[0020] Step 112: Perform entity normalization processing on the initial exposure surface data, and uniformly map the heterogeneous data describing the same entity from different channels to a preset entity attribute description framework to generate a standardized entity set. The entity attributes of the standardized entity set include the entity unique identifier, entity type and entity feature vector.

[0021] In this embodiment, due to the potential differences in data formats and description methods across different channels, heterogeneous data representations may exist for the same entity. To facilitate processing, entity normalization is performed on the initial exposure surface data. A pre-defined entity attribute description framework is a unified standard that maps data about the same entity from different channels according to this framework. For example, for a single entity, different channels may describe its IP address, port openness, etc., differently. Entity normalization unifies this heterogeneous data into a format conforming to the entity attribute description framework. This ultimately generates a standardized entity set, where each entity has a unique identifier for easy differentiation; the entity type clarifies whether the entity is a vulnerability or another type; and the entity feature vector contains various characteristic information of the entity.

[0022] Step 113: Construct a conflict detection rule base, and perform conflict identification operations on the entity attribute information and inter-entity relationships in the standardized entity set based on the entity attribute similarity threshold and the conflict level of the association relationship, to obtain a conflict data set, which includes attribute value conflict data and relationship type conflict data.

[0023] The conflict detection rule base serves as the basis for identifying conflicting data within the standardized entity set. The entity attribute similarity threshold is a pre-defined standard; when the attribute similarity between two entities falls below this threshold, an attribute value conflict is considered to exist. The association conflict level categorizes the degree of conflict in the associations between entities. For example, some association conflicts may be severe, affecting the judgment of potential vulnerability exploitation paths, while others are relatively minor. Based on these rules and standards, conflict identification operations are performed on the entity attribute information and inter-entity associations within the standardized entity set. If a certain attribute value of the same entity differs significantly across data from different channels, it will be identified as attribute value conflict data; if the type of association between entities is described differently in different channels, it will be identified as relationship type conflict data. In this way, a conflict data set is obtained, providing specific objects for conflict resolution processing.

[0024] Step 114: Perform weighted voting fusion processing on the conflict data set according to the data credibility scores of each channel, retain the entity attribute values ​​and association types corresponding to the channel with the highest credibility score, and generate intermediate exposure surface data after conflict resolution.

[0025] After obtaining the conflict dataset, conflict resolution processing is required. The data credibility scores from each channel are a crucial basis for the weighted voting fusion process. For each conflicting data point in the dataset, weighted voting is performed based on the credibility scores from each channel. For example, if a certain attribute value of an entity is described differently across different channels, the attribute value from the channel with the higher credibility score will have a higher weight in the vote. Finally, the entity attribute value and relationship type corresponding to the channel with the highest credibility score are retained as the final result for that conflicting data. Through this weighted voting fusion process, inconsistencies in the conflicting data are eliminated, generating intermediate exposure surface data after conflict resolution, making the data more accurate and reliable.

[0026] Step 115: Perform redundant data filtering on the intermediate exposure surface data to remove duplicate entity attribute records and association descriptions with confidence levels lower than preset values, thereby obtaining target exposure surface data containing entity attribute verification identifiers.

[0027] It is understandable that intermediate exposure surface data may contain some redundant data, such as duplicate entity attribute records and association descriptions with low confidence levels. Duplicate entity attribute records increase the complexity of data processing, while association descriptions with confidence levels below a preset value may be inaccurate, affecting the accuracy of the analysis. Therefore, redundant data filtering processing needs to be performed on the intermediate exposure surface data. By comparing entity attribute records, duplicate records are identified and removed; for association descriptions, their confidence levels are compared with preset values, and descriptions with confidence levels below the preset values ​​are removed. After the above processing, the target exposure surface data is obtained, and a validation flag is added to each entity attribute for data verification and management, ensuring the quality and validity of the target exposure surface data.

[0028] Step 120: Construct an initial security posture knowledge graph based on the target exposure surface data. The node set of the initial security posture knowledge graph includes vulnerability entities and potential vulnerability exploitation path entities, and the edge set includes causal relationships and impact degree descriptors between entities.

[0029] In this step, after obtaining the target exposure surface data, an initial security posture knowledge graph is constructed based on it. Vulnerability entities are vulnerabilities or weaknesses existing in the system or network, easily exploitable; potential vulnerability exploitation path entities describe the specific path taken by external penetration tests to reach the target through the vulnerability. The node set comprehensively covers the key elements in the vulnerability exploitation process. The edge set represents the causal relationships between entities, such as how unauthorized external personnel exploit vulnerabilities to launch vulnerability exploits against the target, and the descriptors of the impact of these relationships, such as the severity and scope of the vulnerability exploitation. By constructing the aforementioned initial security posture knowledge graph, the overall situation of the exposure surface can be visually displayed.

[0030] Step 130: Perform layer division and attribute update operations on the initial security situation knowledge graph based on the channel labels of the initial exposure surface data to obtain a multi-level security situation knowledge graph containing multi-level channel subgraphs. The layer attributes of the multi-level channel subgraphs include channel type identifiers and data collection timestamps.

[0031] In this embodiment, the channel tags of the initial exposure surface data contain important information, such as channel type and data collection time. Based on these channel tags, the initial security posture knowledge graph is layered, dividing the graph into multiple channel subgraphs according to different channels. Each subgraph corresponds to a data source channel, thus accurately and comprehensively displaying the distribution of data from different channels within the knowledge graph. Simultaneously, attribute updates are performed on each channel subgraph, adding layer attributes such as channel type identifiers and data collection timestamps. Channel type identifiers facilitate the differentiation of data sources from different channels, while data collection timestamps reflect the timeliness of the data. Through the above layer division and attribute update operations, a multi-level security posture knowledge graph is obtained, making the knowledge graph richer and more detailed, facilitating the analysis and comparison of data from different channels.

[0032] In a preferred embodiment, the step of performing layer partitioning and attribute update operations on the initial security posture knowledge graph based on the channel labels of the initial exposure surface data to obtain a multi-level security posture knowledge graph containing multi-level channel subgraphs includes: Step 131: Parse the channel tags of the initial exposure surface data, extract channel type information and data collection timestamp, and divide the initial security situation knowledge graph into multiple channel subgraphs based on the channel type information. Each channel subgraph corresponds to a data source channel.

[0033] The channel type information clearly identifies the specific channel from which the data originates, such as a network monitoring channel or a vulnerability scanning channel. The data collection timestamp records the exact time the data was collected, reflecting its timeliness. Based on the channel type information, the initial security posture knowledge graph is divided into multiple channel subgraphs, each corresponding to a data source channel. This division method makes the knowledge graph structure more accurate and comprehensive, facilitating independent analysis and management of data from different channels. For example, when analyzing data from a specific channel, one can directly view the corresponding channel subgraph without being influenced by data from other channels.

[0034] Step 132: Add layer attributes to each of the channel subgraphs. The layer attributes include channel type identifier, data collection timestamp, and data integrity index. The data integrity index is calculated by the proportion of non-empty fields of entity attributes in the channel subgraph.

[0035] In this process, layer attributes are added to each channel sub-graph. Besides the channel type identifier and data collection timestamp mentioned above, a data integrity metric is also added. The data integrity metric is a crucial parameter for measuring the data integrity of a channel sub-graph. It is calculated by determining the percentage of non-empty fields in the entity attributes of that channel sub-graph. For example, if an entity in a channel sub-graph has 10 attributes, and 8 of them are non-empty, then the percentage of non-empty fields for that entity is 80%. The data integrity metric for that channel sub-graph is calculated by combining the percentages of non-empty fields for all entities. This metric helps assess the data quality of the channel sub-graph; a higher data integrity metric indicates more complete data in the channel sub-graph, which is more beneficial for analysis and decision-making.

[0036] Step 133: Perform attribute enhancement processing on the entity nodes in each channel subgraph, embedding the entity feature vector in the target exposure surface data of the corresponding channel into the attribute field of the entity node, and generating an enhanced entity node set containing multi-dimensional feature descriptions.

[0037] To enrich the information of entity nodes in the channel subgraph, attribute enhancement processing is required. This involves embedding entity feature vectors from the target exposure surface data of the corresponding channel into the attribute fields of the entity nodes. These entity feature vectors contain various characteristic information about the entity, such as the IP address and open port characteristics of unauthorized access entities, and the vulnerability number and risk level characteristics of vulnerable entities. By embedding these feature vectors into the attribute fields of the entity nodes, each entity node possesses a multi-dimensional feature description. The final result is an enhanced set of entity nodes containing multi-dimensional feature descriptions. These enhanced entity nodes provide richer data support for analysis and mining, enabling a more accurate understanding of the exposure surface.

[0038] As one embodiment, step 133 includes: Step 1331: Extract the entity feature vectors corresponding to each channel from the target exposure surface data. The entity feature vectors include the vulnerability number feature, risk level feature, and impact range feature of the vulnerable entity.

[0039] For vulnerable entities, the vulnerability number is a unique identifier for that vulnerability, making it easy to distinguish between different vulnerabilities; the risk level indicates the degree of danger of the vulnerability; and the impact range indicates the scope of impact that the vulnerability may have after it is exploited.

[0040] Step 1332: Perform dimension normalization processing on the entity feature vector using a feature scaling algorithm to map feature values ​​of different dimensions to a preset numerical range, generating a standardized entity feature vector. The feature value range of each dimension of the standardized entity feature vector remains consistent.

[0041] It is understandable that different features in an entity feature vector may have different dimensions; for example, IP address features and port open features have different dimensions, which can affect analysis and processing. Therefore, feature scaling algorithms are needed to perform dimensionality normalization on entity feature vectors. Feature scaling algorithms map feature values ​​with different dimensions to a preset numerical range, ensuring that the range of feature values ​​for each dimension of the standardized entity feature vector remains consistent. This eliminates the influence of dimensions, making different features equally important in the analysis. For example, when performing similarity calculations or model training, standardized entity feature vectors can improve the accuracy of calculations and the performance of the model.

[0042] Step 1333: Create a feature attribute field for each entity node in the channel subgraph, write the standardized entity feature vector into the feature attribute field in dimensional order, and generate a feature attribute record containing vector dimension identifier and feature value description.

[0043] Specifically, a feature attribute field is created for each entity node in the channel subgraph to store standardized entity feature vectors. These standardized entity feature vectors are written into the feature attribute field in dimensional order, with each dimension having a corresponding vector dimension identifier and feature value description. This method generates feature attribute records containing vector dimension identifiers and feature value descriptions, making the feature information of entity nodes more accurate, comprehensive, and organized, facilitating querying and analysis.

[0044] Step 1334: Perform hash index construction processing on the feature attribute records of entity nodes, and generate a feature retrieval index based on the entity's unique identifier and feature dimension identifier.

[0045] To improve the retrieval efficiency of entity node feature attribute records, a hash index is constructed. A feature retrieval index is generated based on the entity's unique identifier and feature dimension identifier. The entity's unique identifier ensures accurate location of the corresponding entity node, while the feature dimension identifier pinpoints the specific feature attribute of that entity node. For example, when querying a specific feature of an entity, the entity node can be quickly located using the entity's unique identifier, and the corresponding feature attribute record can be found using the feature dimension identifier. The hash index construction process significantly accelerates retrieval speed, reduces query time, and improves system response performance.

[0046] Step 1335: Perform feature attribute record removal processing on the written standardized entity feature vector with missing dimensions or outliers using the feature cross-validation algorithm, and form an enhanced entity node set based on the enhanced entity nodes that have not been removed.

[0047] To ensure the data quality of the augmented entity node set, a feature cross-validation algorithm is used to check the written standardized entity feature vectors. If a feature attribute record has missing dimensions (i.e., some feature dimensions do not have corresponding feature values) or contains outliers (e.g., feature values ​​exceeding a reasonable range), the feature attribute record is removed. In this way, unreliable data is removed, and high-quality feature attribute records are retained. The augmented entity nodes that were not removed are used to form an augmented entity node set, which contains entity nodes with complete and accurate feature information.

[0048] Step 134: Construct entity association rules across channel subgraphs, and match the same entity nodes in different channel subgraphs based on the entity's unique identifier to establish entity mapping relationships between channel subgraphs and generate a cross-layer entity association index table.

[0049] To establish connections between different channel subgraphs, it is necessary to construct entity association rules across channel subgraphs. These rules are based on unique entity identifiers, which accurately match identical entity nodes in different channel subgraphs. For example, if an entity exists in one channel subgraph and another entity exists in another channel subgraph, and both entities share the same unique identifier, then these two entity nodes can be considered identical. Based on this matching method, entity mapping relationships between channel subgraphs are established. These mapping relationships are then organized into a cross-layer entity association index table. This table records the correspondence between identical entity nodes in different channel subgraphs, facilitating rapid association queries and data integration across different channel subgraphs during data analysis and processing.

[0050] Step 135: Perform layer fusion verification on each channel subgraph according to the cross-layer entity association index table, calculate the attribute similarity and association consistency of the same entity node in different channel subgraphs, mark the channel subgraphs with attribute similarity higher than the preset similarity as strongly associated layers, and obtain a multi-level security situation knowledge graph containing the layer association strength matrix.

[0051] After obtaining the cross-layer entity association index table, layer fusion verification is performed on each channel subgraph based on it. The degree of association between these channel subgraphs is assessed by comparing the attribute similarity and association consistency of the same entity node across different channel subgraphs. Attribute similarity refers to the similarity of attribute values ​​for the same entity node across different channel subgraphs, while association consistency refers to whether the description of the association between entities is consistent across different channel subgraphs. Channel subgraphs with attribute similarity higher than a preset similarity are marked as strongly associated layers. The preset similarity is a pre-defined standard; when the attribute similarity is higher than this standard, it indicates a relatively close association between the two channel subgraphs. Through the above marking and calculation, a multi-level security posture knowledge graph containing a layer association strength matrix is ​​obtained, which can intuitively display the association strength between each channel subgraph.

[0052] In one implementation, step 135 includes: Step 1351: Extract entity node pairs with mapping relationships from the cross-layer entity association index table. The entity node pairs contain entity nodes with the same unique entity identifier in different channel subgraphs.

[0053] The entity node pairs with mapping relationships are extracted from the cross-layer entity association index table. These entity node pairs consist of entity nodes with the same unique entity identifier in different channel subgraphs. For example, if there is an entity node in one channel subgraph and another entity node in another channel subgraph, and these two entity nodes have the same unique entity identifier, then these two entity nodes constitute an entity node pair. By extracting these entity node pairs, the correspondence between identical entity nodes in different channel subgraphs can be clearly defined, providing concrete objects for calculating attribute similarity and association consistency.

[0054] Step 1352: Perform a dimension-by-dimensional comparison of the attribute fields of the entity node pairs, calculate the similarity of the attribute values ​​of numerical attributes and the matching degree of categorical attributes, and fuse the comparison results of each dimension through a weighted average algorithm to obtain the entity attribute similarity score.

[0055] For numerical attributes, the similarity of their attribute values ​​is calculated. For example, if two entity nodes have numerical attribute values ​​X and Y, their similarity can be obtained using a certain similarity calculation method. For categorical attributes, their matching degree is calculated. If two entity nodes have categorical attribute values ​​A and A, their matching degree is 100%. The comparison results from each dimension are then fused using a weighted average algorithm, with the weight of each dimension pre-set according to its importance. The final result is an entity attribute similarity score, which comprehensively reflects the degree of similarity between two entity nodes in terms of attributes.

[0056] Step 1353: Extract the set of relationships between entity nodes in their respective channel subgraphs, compare the relationship type identifiers and influence degree descriptors of the set of relationships, and count the proportion of edges with the same relationship type as the consistency index of relationships.

[0057] This process involves extracting the relationship edge sets of entity node pairs within their respective channel subgraphs. These edge sets contain information about the relationships between entities, such as relationship type identifiers and influence level descriptors. The relationship type identifiers of the edge sets are compared to see if they are the same; simultaneously, the influence level descriptors are compared to assess their consistency. The percentage of edges with the same relationship type is then used as a relationship consistency index. For example, if an entity node pair has 10 edges in its relationship edge sets across two channel subgraphs, and 6 of these edges share the same relationship type, then the relationship consistency index is 60%. This index measures the degree of consistency between the two entity nodes in terms of their relationship.

[0058] Step 1354: Input the entity attribute similarity score and the consistency index of the association relationship into the layer association strength calculation model to generate a comprehensive layer association strength value. The value range of the comprehensive layer association strength value corresponds to the preset similarity threshold range.

[0059] The entity attribute similarity score and the association consistency index are input into the layer association strength calculation model. This model is pre-trained and can generate a comprehensive layer association strength value based on the input entity attribute similarity score and association consistency index. The range of the comprehensive layer association strength value corresponds to a preset similarity threshold range. For example, if the preset similarity threshold range is 0 to 100, the comprehensive layer association strength value will also fall within this range. Through this model, entity attribute similarity and association consistency can be comprehensively evaluated to obtain a comprehensive association strength value, which more comprehensively reflects the degree of association between two channel subgraphs.

[0060] Step 1355: Mark the channel sub-graphs with a composite layer association strength value higher than the preset strength value as strongly associated layers. Add a strong association identifier and association strength value to the layer attributes of the multi-level security situation knowledge graph. The strong association identifier and the association strength value are used for the selection of associated layers during layer enhancement processing.

[0061] The overall layer association strength value is compared with a preset strength value. If the overall layer association strength value is higher than the preset strength value, the corresponding channel subgraph pair is marked as a strongly associated layer. Strong association identifiers and association strength values ​​are added to the layer attributes of the multi-level security situation knowledge graph. The strong association identifier clearly indicates the degree of association between the two channel subgraphs, while the association strength value quantifies this degree of association. During layer enhancement processing, associated layers can be selected based on the strong association identifier and association strength value, prioritizing the processing of closely associated layers to improve processing efficiency and effectiveness.

[0062] Step 140: In response to security protection logs reported from different channels, perform layer enhancement or layer hiding processing on the target layer associated with the security protection logs in the multi-level security situation knowledge graph to generate a real-time updated security situation knowledge graph.

[0063] When receiving security protection logs from different channels, the multi-level security posture knowledge graph needs to be processed accordingly. Security protection logs record relevant information about security events, such as event type and protective measure type. Based on this information, the target layer associated with the security protection log is located in the multi-level security posture knowledge graph. If the protective measures are proactive and effective, layer enhancement processing is performed on the target layer to highlight relevant information and increase its importance in the knowledge graph; if the protective measures are outdated and ineffective, layer hiding processing is performed on the target layer to reduce its visibility in the knowledge graph. Through the above processing, a real-time updated security posture knowledge graph is generated, enabling it to promptly reflect the latest security situation and the effectiveness of protective measures.

[0064] In a preferred embodiment, step 140 includes: Step 141: Receive security protection logs reported from different channels, parse the log fields of the security protection logs, and extract the security event type, protection measure type and associated channel type identifier. The security event type includes vulnerability exploitation events, port scanning events and malicious code propagation events.

[0065] Receive security protection logs reported from different channels. These logs are detailed records of security events and protective measures. Parse the log fields of the security protection logs to extract the security event type, protective measure type, and associated channel type identifier.

[0066] Step 142: Based on the channel type identifier, locate the corresponding target channel subgraph from the multi-level security situation knowledge graph, match the security event type with the entity node attributes in the target channel subgraph, and determine the set of target entity nodes associated with the security event.

[0067] Based on the channel type identifier in the security protection logs, the corresponding target channel subgraph is located in the multi-level security posture knowledge graph. Since each channel subgraph corresponds to a data source channel, the channel type identifier allows for accurate identification of the relevant channel subgraph. The security event type is then matched with the attributes of entity nodes in the target channel subgraph. For example, if the security event type is a vulnerability exploitation event, the attributes of entity nodes in the target channel subgraph are checked to see if they contain relevant vulnerability information. This matching method identifies the set of target entity nodes associated with the security event; these entity nodes have a direct or indirect connection to the security event.

[0068] In one embodiment, step 142 includes: Step 1421: Parse the channel type identifier of the security protection log, obtain the channel type code and data source identifier, and perform a matching search in the layer attributes of the multi-level security situation knowledge graph based on the channel type code to locate the corresponding target channel subgraph.

[0069] The channel type identifiers in the security protection logs are parsed to obtain the channel type code and data source identifier. The channel type code is a digital representation of different channel types, and each channel type has a unique code. The data source identifier further clarifies the specific source of the channel. Based on the channel type code, a matching search is performed in the layer attributes of the multi-level security posture knowledge graph. Because each channel subgraph's layer attributes contain a channel type identifier, the corresponding target channel subgraph can be quickly located using the channel type code. For example, if the channel type code is 1, indicating a specific channel, searching for the channel subgraph with a channel type identifier of 1 in the layer attributes of the multi-level security posture knowledge graph will yield the target channel subgraph.

[0070] Step 1422: Extract the set of entity nodes of the target channel subgraph, traverse the attribute fields of the entity nodes, and filter out candidate entity nodes that contain security event-related features, including vulnerability number, unauthorized access entity IP, and malicious code hash value.

[0071] The entity node set of the target channel subgraph is extracted, and the attribute fields of each entity node are traversed. Based on security event-related characteristics, such as vulnerability ID, unauthorized access entity IP, and malicious code hash value, candidate entity nodes containing these characteristics are filtered out. For example, if the security event is a vulnerability exploitation event, the entity node's attribute fields are checked to see if they contain a related vulnerability ID. This filtering method narrows the search scope and identifies candidate entity nodes that may be associated with the security event.

[0072] Step 1423: Perform semantic similarity calculation on the security event type and the event type attribute of the candidate entity node using a text matching algorithm to generate an event type matching score. The event type matching score is used to measure the degree of association between the candidate entity node and the security event.

[0073] Text matching algorithms are used to calculate the semantic similarity between security event types and the event type attributes of candidate entity nodes. Semantic similarity calculation can more accurately determine the degree of similarity between two texts, going beyond simple character matching. For example, if the security event type is "vulnerability exploitation event," and the event type attribute of a candidate entity node might be described as "exploitation testing using system vulnerabilities," the semantic similarity between them can be calculated using text matching algorithms. The generated event type matching score measures the degree of association between the candidate entity node and the security event; a higher score indicates a stronger association between the candidate entity node and the security event.

[0074] Step 1424: Set an event type matching threshold, filter candidate entity nodes with matching scores higher than the event type matching threshold as preliminary associated entity nodes, traverse the association relationship edge set of the preliminary associated entity nodes, and identify indirect associated entity nodes that have a causal relationship with the security event.

[0075] A threshold for event type matching is set, and the event type matching scores of candidate entity nodes are compared with this threshold. Candidate entity nodes with matching scores higher than the event type matching threshold are selected and designated as initially associated entity nodes. The set of association edges of the initially associated entity nodes is traversed. Since entity nodes are interconnected through association edges, some entity nodes may not be directly associated with the security event but are indirectly associated with the initially associated entity nodes through association edges. Identifying these indirectly associated entity nodes with causal relationships to the security event expands the range of entity nodes associated with the security event and more comprehensively reflects the impact of the security event.

[0076] Step 1425: Merge the initially associated entity nodes with the indirectly associated entity nodes, remove duplicate nodes to generate a target entity node set, and add an association strength label to each entity node in the set. The association strength label is determined based on the matching degree score and the association strength factor after the relationship path length is converted. The shorter the relationship path length, the higher the association strength factor.

[0077] The initially associated entity nodes and indirectly associated entity nodes are merged, and duplicate nodes are removed to generate a target entity node set. An association strength label is added to each entity node in the set. The association strength label is determined based on a combination of the matching score and the association strength factor converted from the relationship path length. A higher matching score indicates a stronger association between the entity node and the security event; a shorter relationship path length indicates a more direct causal relationship between the entity node and the security event, and a higher association strength factor. The association strength label provides a more intuitive understanding of the degree of association between each entity node and the security event.

[0078] Step 143: Determine the processing method for the target channel sub-graph based on the type of protection measure. When the type of protection measure is an active defense measure, perform layer enhancement processing; when the type of protection measure is an outdated defense measure, perform layer hiding processing.

[0079] Based on the type of protection measures in the security protection log, determine the processing method for the target channel subgraph. If the protection measures are proactive defense measures, such as real-time firewall blocking or real-time monitoring by intrusion detection systems, these measures are effective in responding to security incidents. In this case, perform layer enhancement processing on the target channel subgraph to highlight relevant information and increase its importance in the knowledge graph for better focus and analysis. If the protection measures are outdated defense measures, such as expired protection rules or expired security patches, these measures are ineffective in responding to current security incidents. In this case, perform layer hiding processing on the target channel subgraph to reduce its visibility in the knowledge graph and avoid interfering with the analysis of valid information.

[0080] Step 144: If layer enhancement processing is performed, the attribute weights of the target entity nodes and the influence degree descriptors of the associated edges in the target channel subgraph are enhanced, and enhancement timestamps and enhancement reason tags are added to the layer attributes.

[0081] When deciding to perform layer enhancement on a target channel subgraph, the first step is to increase the attribute weights of the target entity nodes within the subgraph. Enhancing attribute weights makes the entity node more prominent and easier to focus on within the knowledge graph. For example, for an entity, increasing the weight of its risk level attribute gives it a more significant role in risk assessment. Simultaneously, enhancing the influence descriptors of relational edges more accurately and comprehensively demonstrates the importance of relationships between entities. Adding enhancement timestamps to layer attributes records the execution time of the layer enhancement process for easy querying and traceability; adding enhancement reason tags explains the reason for performing the layer enhancement, such as "enhancing against vulnerability exploitation events," making the process more transparent and explainable.

[0082] As one implementation, step 144 includes: Step 1441: Extract the attribute weight configuration file of each node from the target entity node set. The attribute weight configuration file contains the current weight value of each attribute field and the weight adjustment rule. The weight adjustment rule is associated with the security event type.

[0083] The attribute weight configuration file for each node is extracted from the target entity node set. This file records the current weight value and weight adjustment rules for each attribute field. The weight adjustment rules are associated with the security event type; different security event types may require different degrees of weight adjustment for different attribute fields. For example, for vulnerability exploitation events, the weight of attribute fields such as vulnerability number and risk level may need to be increased; for port scanning events, the weight of attribute fields such as unauthorized access entity IP and port open status may need to be increased. Through the attribute weight configuration file, attribute weights can be accurately adjusted according to specific security event types, making the knowledge graph more closely reflect real-world scenarios.

[0084] Step 1442: According to the weight adjustment rules corresponding to the security event type, perform weight value enhancement processing on the key attribute fields of the target entity node. The key attribute fields include risk level characteristics, impact scope characteristics, and recent occurrence time characteristics. The enhancement magnitude is positively correlated with the severity of the security event.

[0085] Based on the weighting adjustment rules corresponding to the security event type, the key attribute fields of the target entity node are weighted. Key attribute fields, such as risk level characteristics, impact scope characteristics, and recent occurrence time characteristics, are crucial for assessing the impact and risk of security events. The magnitude of the weighting is positively correlated with the severity of the security event; the more severe the security event, the greater the weighting increase of the attribute field. For example, if the security event is a high-risk vulnerability exploitation event, the weights of the risk level characteristics and impact scope characteristics of the target entity node will be significantly increased to more accurately reflect the potential harm of the security event.

[0086] Step 1443: Traverse the set of association edges of the target entity node, identify the core association edges directly related to the security event and the secondary association edges indirectly related to it, and perform numerical augmentation processing on the influence degree descriptor of the core association edges.

[0087] The algorithm iterates through the set of edges representing relationships between target entity nodes, distinguishing between core edges directly related to security events and secondary edges indirectly related. Core edges directly reflect the occurrence path and impact of security events, such as the relationship between vulnerable entities and the target; secondary edges are indirectly related to security events through other entities. The influence descriptors of core edges are numerically enhanced to make them more prominent in the knowledge graph. For example, the influence descriptor of core edges is enhanced from "moderate" to "severe," more accurately and comprehensively showcasing the relationships and impact of security events.

[0088] Step 1444: Add an enhanced timestamp to the layer attributes of the target channel sub-map, record the execution time of the layer enhancement process, and generate an enhancement reason tag based on the log content of the security protection log. The enhancement reason tag includes the security event type and the protection measure type.

[0089] Add enhancement timestamps to the layer attributes of the target channel subgraph to accurately record the execution time of layer enhancement processing. Enhancement timestamps serve as time markers, facilitating knowledge graph updates and queries. Enhancement reason tags are generated based on the content of security protection logs. These tags include the security event type and protection measure type, such as "vulnerability exploitation event, enhanced using firewall interception." These tags accurately and comprehensively explain the reasons for layer enhancement processing, enabling knowledge graph users to better understand the processing procedure and purpose, thus improving the readability and interpretability of the knowledge graph.

[0090] Step 145: If layer hiding is performed, reduce the transparency parameter of the target channel subgraph in the knowledge graph visualization, and add a hiding mark and a hiding time window in the layer properties. The hiding time window is set based on the effective duration of the protection measures.

[0091] When deciding to hide a target channel subgraph, reduce its transparency parameter in the knowledge graph visualization. The transparency parameter controls the accuracy and comprehensiveness of the layer's display in the visualization interface; reducing the transparency parameter makes the target channel subgraph less noticeable in the knowledge graph, reducing interference with useful information. Add a hide marker to the layer properties, containing information such as the hide trigger time, hide operation type, and operator identification, facilitating the tracing of the layer's state change history. Simultaneously, add a hide time window, set based on the effective duration of the protective measures. For example, if the effective duration of the protective measures is 24 hours, the hide time window is set to 24 hours from the current time, during which the target channel subgraph remains hidden.

[0092] As another implementation, step 145 includes: Step 1451: Obtain the current transparency parameter of the target channel sub-image. The current transparency parameter controls the accuracy and comprehensiveness of the layer's display in the visualization interface. The initial value is set to the parameter value corresponding to the maximum display accuracy and comprehensiveness.

[0093] This function retrieves the current transparency parameter of the target channel sub-image, which determines the accuracy and fullness of its display in the visualization interface. The initial value is set to the parameter corresponding to the maximum display accuracy and fullness, meaning that under normal circumstances, the target channel sub-image is accurately and fully visible. Retrieving the current transparency parameter provides a basis for adjusting the transparency. For example, if the current transparency parameter is 100%, it means the channel sub-image is fully and accurately displayed; it can be reduced as needed to make it less noticeable.

[0094] Step 1452: Query the preset transparency adjustment rule library according to the type of protection measure, determine the transparency reduction range corresponding to the hiding process, and reduce the current transparency parameter to the target transparency value through the parameter adjustment algorithm. The target transparency value is positively correlated with the hiding priority.

[0095] The system queries a pre-defined transparency adjustment rule base based on the type of protective measure. This rule base records the transparency reduction percentage for different protective measure types. For example, if the protective measure type is an outdated security patch, the corresponding transparency reduction percentage might be 50%. A parameter adjustment algorithm then reduces the current transparency parameter to the target transparency value. The target transparency value is positively correlated with the hiding priority; the higher the hiding priority, the lower the target transparency value. For example, for some severely outdated protective measures, which have a high hiding priority, the target transparency value might be set very low, making the target channel subgraph almost invisible.

[0096] Step 1453: Add a hidden marker to the layer attributes of the target channel sub-map. The hidden marker includes the hidden trigger time, the hidden operation type, and the operator identifier, which is used to trace the history of layer status changes.

[0097] Add a hidden marker to the layer properties of the target channel subgraph. The hidden marker contains important information such as the hidden trigger time, the hidden operation type, and the operator identifier. The hidden trigger time records the specific time when the layer began to be hidden, making it easy to understand the time node of the layer state change; the hidden operation type clarifies the reason for the hiding action, such as "hiding as an outdated defense measure"; and the operator identifier identifies who performed the hiding operation. With this information, the history of layer state changes can be traced, facilitating the management and maintenance of the knowledge graph.

[0098] Step 1454: Parse the effective duration field of the protection measures in the security protection log, calculate the hiding end time point in combination with the current system time, and generate a hiding time window. The start time of the hiding time window is the current system time, and the end time is the hiding end time point.

[0099] Parse the "Effective Duration" field of the security measures in the security protection log to obtain the effective duration information of the measures. Combined with the current system time, calculate the end time of the hiding process. For example, if the effective duration of the security measures is 3 hours and the current system time is 10:00 AM, then the end time of the hiding process is 1:00 PM. Generate a hiding time window, with its start time being the current system time and its end time being the end time of the hiding process. The hiding time window clearly defines the hiding period for the target channel sub-graph. During this period, the target channel sub-graph is hidden; after this period, it will be restored to normal display.

[0100] Step 1455: Write the hidden time window into the time management field of the layer properties, monitor the remaining duration of the hidden time window through a scheduled task, and automatically remove the hidden marker and restore the transparency parameter to the initial value when the end time is reached.

[0101] The hidden time window is written to the time management field of the layer properties, facilitating the management and monitoring of the hidden time. A scheduled task monitors the remaining duration of the hidden time window, periodically checking it to ensure a timely response when the end time is reached. Upon reaching the end time, the hidden marker is automatically removed, indicating that the channel sub-image is no longer hidden; simultaneously, the transparency parameter is restored to its initial value, restoring the target channel sub-image to its original accurate and complete display. This method automates the management of target channel sub-image hiding, improving system efficiency and reliability.

[0102] Step 146: After completing the target layer processing, re-verify the layer association relationships of the multi-level security situation knowledge graph, update the association strength values ​​of strongly associated layers, and generate a real-time updated security situation knowledge graph containing layer state change records.

[0103] After processing the target layer, whether it's layer enhancement or layer hiding, it will affect the layer relationships in the multi-level security posture knowledge graph. Therefore, it's necessary to re-verify the layer relationships. This involves recalculating the association strength values ​​between different channel subgraphs and updating the association strength values ​​of strongly associated layers. Simultaneously, layer state change records are recorded, including processing type, processing time, number of entity nodes involved, and the scope of influence of associated layers. These records are added to the knowledge graph to generate a real-time updated security posture knowledge graph containing layer state change records. This knowledge graph can promptly reflect the latest security situation and the effectiveness of protective measures.

[0104] In one exemplary design approach, step 146 includes: Step 1461: Traverse all associated layers in the multi-level security situation knowledge graph that have strong association markers with the target layer, and extract the entity mapping relationship between the associated layers and the target layer and the historical association strength value.

[0105] The system iterates through all associated layers in the multi-level security posture knowledge graph that have strong association markers with the target layer. For each associated layer, it extracts its entity mapping relationship with the target layer and its historical association strength value. The entity mapping relationship records the correspondence between identical entity nodes in the two layers, while the historical association strength value reflects the degree of association between the two layers before processing the target layer. For example, if associated layer A and target layer B have strong association markers, by extracting their entity mapping relationship and historical association strength value, it can be understood which entity nodes corresponded in the two layers before processing target layer B, and what the association strength between them was.

[0106] Step 1462: Re-compare the entity node sets of the associated layer and the target layer, calculate the entity attribute similarity and association consistency index, and generate a new comprehensive layer association strength value using the same algorithm as the initial layer fusion verification.

[0107] The entity node sets of the associated layer and the target layer are re-compared. Entity attribute similarity and association consistency indices are calculated. Entity attribute similarity reflects the degree of attribute similarity between identical entity nodes in the two layers, while the association consistency index measures the consistency of association relationships between entities. Using the same algorithm as the initial layer fusion verification, a new comprehensive layer association strength value is generated based on the entity attribute similarity and association consistency index. This new association strength value more accurately reflects the tightness of the association between the associated layer and the target layer after processing the target layer.

[0108] Step 1463: Compare the new composite layer association strength value with the historical association strength value. If the difference exceeds the preset fluctuation threshold, update the association strength value of the strongly associated layer and record the timestamp and reason for the change of the strength value.

[0109] Compare the new composite layer association strength value with the historical association strength values. If the difference exceeds a preset fluctuation threshold, it indicates that the processed target layer has significantly impacted the association relationship between the associated layers and the target layer. In this case, update the association strength value of the strongly associated layer to reflect the latest association status. Simultaneously, record the timestamp and reason for the strength value change. The timestamp specifies the exact time of the change, and the reason explains what processing was performed on the target layer that caused the change. For example, if layer enhancement processing was performed on the target layer, resulting in an increase in the association strength value, record "Association strength value increased due to target layer enhancement processing."

[0110] Step 1464: Perform state change record generation processing on the layer attributes of the target layer, record the layer processing type, processing time, number of entity nodes involved and the scope of influence of associated layers, and form a layer state change log.

[0111] The layer attributes of the target layer are logged for state changes. This includes recording the layer processing type (e.g., layer enhancement or layer hiding); the processing time to pinpoint the specific moment of the operation; the number of entity nodes involved to understand the scope of the affected entities; and the impact on related layers to assess the degree of influence of the operation on other related layers. This information is compiled into a layer state change log, which serves as a crucial basis for knowledge graph management and analysis. It facilitates the review and summarization of the processing process and helps identify potential problems and trends.

[0112] Step 1465: Append the layer state change log to the metadata area of ​​the multi-level security posture knowledge graph, and convert the updated knowledge graph data into a standard data format through the knowledge graph serialization algorithm to generate a persistent, real-time updated security posture knowledge graph.

[0113] Layer state change logs are appended to the metadata area of ​​the multi-level security posture knowledge graph. This metadata area stores relevant information about the knowledge graph, such as data sources and processing records. A knowledge graph serialization algorithm converts the updated knowledge graph data into a standard data format for easy storage and transmission. A persistent, real-time updated security posture knowledge graph is generated, ensuring long-term storage and enabling querying and analysis at any time. This allows for restoration to the latest knowledge graph state even after system restarts or other issues, guaranteeing data reliability and availability.

[0114] In a scalable embodiment, it also includes: Step 210: Receive access requests for the real-time updated security posture knowledge graph, parse the request header fields of the access request, and extract the access subject identifier and target entity type.

[0115] The system receives access requests for a real-time updated security posture knowledge graph. These requests may originate from different users or systems. The system parses the request header fields to extract the access subject identifier and target entity type. The access subject identifier identifies the visitor; different subjects may have different access permissions. The target entity type specifies the type of entity the visitor wants to access, such as a vulnerability entity. Extracting this information provides a basis for permission verification and data querying, ensuring the legitimacy and validity of access requests.

[0116] Step 220: Extract the entity attribute feature set corresponding to the target entity type from the real-time updated security situation knowledge graph. The entity attribute feature set includes the entity's unique identifier, risk level features, and descriptors of the degree of influence of the association relationship.

[0117] Based on the extracted target entity type, corresponding entity attribute feature sets are extracted from the real-time updated security posture knowledge graph. The entity attribute feature set contains important information such as unique entity identifiers, risk level features, and descriptors indicating the degree of influence of relationships. The unique entity identifier distinguishes different entities, the risk level feature reflects the potential risk level of the entity, and the descriptor indicating the degree of influence of relationships illustrates the importance of the relationship between the entity and other entities.

[0118] Step 230: Query the preset permission rule base, perform matching processing between the permission level label of the access subject identifier and the risk level feature of the entity attribute feature set, and generate permission verification results. The permission verification results include the entity attribute fields that are allowed to be accessed and the operation restrictions. The permission rule base contains the mapping relationship between the access subject identifier and the permission level label and the entity access restrictions corresponding to different permission levels.

[0119] The system queries a pre-defined permission rule base, which records the mapping between access subject identifiers and permission level tags, as well as the entity access restrictions corresponding to different permission levels. It then matches the access subject's permission level tag with the risk level features of the entity attribute feature set. A higher permission level may allow access to more entity attribute fields and more operations; a lower permission level may only allow access to some attribute fields and limited operations. Based on the matching results, a permission verification result is generated, which includes the allowed entity attribute fields and operation restrictions, such as whether data can be modified or entities can be deleted.

[0120] Step 240: Generate an entity access control list based on the permission verification results. The entity access control list includes the access subject identifier, the target entity unique identifier, the set of allowed access fields, and the access time window limit. The set of allowed access fields is determined based on the matching degree between the permission level label and the risk level feature.

[0121] An entity access control list (AVR) is generated based on the permission verification results. The AVR includes information such as the access subject identifier, the target entity's unique identifier, the set of allowed access fields, and access time window restrictions. The set of allowed access fields is determined by the matching degree between the permission level label and the risk level characteristics; the higher the matching degree, the more fields are allowed. The access time window restriction specifies the time period during which an accessor can access the target entity. For example, an access subject with a low permission level may only be able to access certain attribute fields of the target entity within a set time window. Through the AVR, access behavior can be precisely controlled, ensuring the data security of the knowledge graph.

[0122] Step 250: Attach the entity access control list to the metadata area of ​​the real-time updated security posture knowledge graph as the basis for permission verification. The entity access control list in the metadata area is updated as the access subject's permissions change or the entity's risk level is updated.

[0123] Entity access control lists (ADRs) are appended to the metadata area of ​​the real-time updated security posture knowledge graph. The metadata area stores various information related to the knowledge graph, with the ADRs serving as a crucial basis for permission verification. When the permissions of an access subject change, such as a user's role being upgraded or downgraded, or when the risk level of an entity is updated, such as an unauthorized entity's risk level being increased, the ADRs in the metadata area are updated accordingly. For example, if an access subject's permission level is increased, the ADRs will correspondingly add allowed fields and relax operation restrictions; if an entity's risk level is increased, access to that entity may be restricted for some subjects. This approach ensures the real-time nature and accuracy of permission verification.

[0124] In a scalable embodiment, it also includes: Step 310: Extract the set of entities that may be exploited by potential vulnerabilities and the associated vulnerability entity attribute information from the real-time updated security posture knowledge graph. The set of entities that may be exploited by potential vulnerabilities includes the causal relationship between entities and the impact degree descriptor. The vulnerability entity attribute information includes vulnerability number characteristics, risk level characteristics, and impact scope characteristics.

[0125] The system extracts the set of entities involved in potential vulnerability exploitation paths and the associated vulnerability entity attribute information from a real-time updated security posture knowledge graph. The set of entities involved in potential vulnerability exploitation paths records the causal relationships and impact descriptors between entities, reflecting how external penetration tests reach the target from unauthorized access entities through vulnerabilities. The vulnerability entity attribute information includes vulnerability ID characteristics, risk level characteristics, and impact scope characteristics, which are crucial for assessing the risk of vulnerability exploitation and developing protection strategies. For example, the set of entities involved in potential vulnerability exploitation paths reveals how a particular unauthorized access entity exploits a designated vulnerability for penetration testing, and the vulnerability entity attribute information reveals the risk level and impact scope of that vulnerability.

[0126] Step 320: Perform path feature extraction processing on the set of entities along the potential vulnerability exploitation path, identify the vulnerable point entities along each potential vulnerability exploitation path and the terminal target entity, and generate a risk feature vector of the potential vulnerability exploitation path.

[0127] The process involves extracting path features from the set of entities along potential exploit paths. This includes identifying the vulnerable entities along each path and the final target entity. For example, a potential exploit path might begin with a pre-defined external unauthorized access entity, pass through a vulnerable entity, and ultimately reach a target entity. Based on this information, a risk feature vector for each potential exploit path is generated. This vector contains various risk characteristics of the path, such as the risk level of the vulnerability and the impact of the exploit, providing a comprehensive picture of the risk profile of a potential exploit path.

[0128] Step 330: Input the potential vulnerability exploitation path risk feature vector into the protection strategy template matching model. Based on the feature values ​​of each dimension of the potential vulnerability exploitation path risk feature vector, match the corresponding protection measure type and deployment priority to generate a set of candidate protection strategies. The protection strategy template matching model contains a preset mapping relationship between potential vulnerability exploitation path features and protection measure types.

[0129] The risk feature vector of potential vulnerability exploitation paths is input into the protection strategy template matching model. This model contains a pre-defined mapping relationship between potential vulnerability exploitation path features and protection measure types. Based on the feature values ​​of each dimension of the potential vulnerability exploitation path risk feature vector, matching is performed in the model to find the corresponding protection measure type and deployment priority. A candidate protection strategy set is generated, containing possible protection strategies for different potential vulnerability exploitation paths, providing a range of choices for strategy selection and optimization.

[0130] Step 340: Perform policy conflict detection processing on the candidate protection policy set, extract the target entities and execution time windows involved in each candidate protection policy, determine the execution order conflict and resource competition between policies based on the causal relationship of entities in the potential vulnerability exploitation path, and generate a policy conflict report. The policy conflict report includes conflict policy identifiers and conflict type descriptions.

[0131] The candidate protection strategy set undergoes strategy conflict detection and processing. The target entity and execution time window involved in each candidate protection strategy are extracted. Based on the causal relationships of entities along the potential vulnerability exploitation path, the execution order conflict and resource contention between strategies are determined. For example, if two candidate protection strategies both need to operate on the same target entity and their execution time windows overlap, an execution order conflict will occur; if both strategies require a large amount of system resources, a resource contention will occur. Based on the detection results, a strategy conflict report is generated. The strategy conflict report includes conflicting strategy identifiers and conflict type descriptions, such as "Strategy 1 and Strategy 2 have an execution time conflict on target entity XX," providing a specific problem description for strategy adjustment.

[0132] Step 350: Based on the strategy conflict report, prioritize and optimize the resource allocation of the candidate protection strategy set, adjust the execution time window and resource usage ratio of the conflicting strategies, and generate a target protection strategy set containing execution order identifiers, unique identifiers of target entities, and parameter configurations.

[0133] Based on the policy conflict report, the candidate protection policy set is prioritized and resource allocation is optimized. For conflicting policies, their execution time windows are adjusted to avoid execution order conflicts; resource usage ratios are adjusted to avoid resource contention. For example, if Policy 1 and Policy 2 have execution time conflicts, the execution time of Policy 1 can be advanced, and the execution time of Policy 2 can be postponed. Through these adjustments, a target protection policy set is generated. The target protection policy set contains information such as execution order identifiers, unique identifiers of target entities, and measure parameter configurations, clarifying the execution order of each protection policy, the target entities it targets, and specific measure parameters, such as firewall rule configurations and intrusion detection system threshold settings.

[0134] This application first collects initial exposure surface data from different channels and performs conflict resolution processing. It comprehensively considers the credibility of each channel and weights the entity attribute information and the relationship between entities, effectively solving the conflict and inconsistency problem of multi-source data, making the target exposure surface data more accurate and reliable, and avoiding erroneous analysis and decision-making caused by data conflicts.

[0135] Secondly, an initial security posture knowledge graph is constructed based on the target exposure surface data. Its node set covers vulnerable entities and entities that may be exploited by potential vulnerabilities, and the edge set contains causal relationships and impact descriptors between entities, presenting a comprehensive and detailed overall posture of the exposure surface, which is used by security personnel to accurately and comprehensively understand the ways and potential impacts of penetration testing.

[0136] Then, based on the channel labels of the initial exposure surface data, the initial security situation knowledge graph is divided into layers and its attributes are updated to obtain a multi-level security situation knowledge graph with multiple channel subgraphs. Each subgraph has a clear channel type identifier and data collection timestamp. This hierarchical structure not only facilitates the management and analysis of data from different channels, but also allows for the tracking of data changes based on the time dimension, improving the maintainability and scalability of the knowledge graph.

[0137] Finally, in response to security protection logs reported from different channels, layer enhancement or layer hiding processing is performed on the target layers associated in the multi-level security situation knowledge graph, realizing real-time updates of the knowledge graph. This enables timely reflection of the latest security situation and the effectiveness of protection measures, allowing security personnel to adjust protection strategies according to the real-time situation, thereby enhancing the system's emergency response capabilities and security.

[0138] Based on the same inventive concept, embodiments of this application also provide a knowledge integration system based on multi-source exposure surface data. See also... Figure 2 As shown, this is a schematic diagram of the structure of a possible knowledge integration system based on multi-source exposure surface data provided in an embodiment of this application. Figure 2 The knowledge integration system 200 based on multi-source exposure surface data includes a processor 210 and a memory 220. The memory 220 stores computer programs executable by the processor 210. By executing the instructions stored in the memory 220, the processor 210 can perform the steps of the aforementioned knowledge integration method based on multi-source exposure surface data.

[0139] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium including a computer program. When the computer program is run on a knowledge integration system based on multi-source exposure surface data, the computer program is used to cause the knowledge integration system based on multi-source exposure surface data to perform the steps of the aforementioned knowledge integration method based on multi-source exposure surface data. In some possible implementations, various aspects of the knowledge integration method based on multi-source exposure surface data provided in this application can also be implemented in the form of a program product, including a computer program. When the program product is run on a knowledge integration system based on multi-source exposure surface data, the computer program is used to cause the knowledge integration system based on multi-source exposure surface data to perform the steps of the aforementioned knowledge integration method based on multi-source exposure surface data. For example, the knowledge integration system based on multi-source exposure surface data can perform actions such as... Figure 1 The steps are shown in the figure.

[0140] The above content is only a preferred exemplary embodiment of this application and is not intended to limit the implementation of this application. Those skilled in the art can easily make corresponding modifications or alterations based on the main concept and spirit of this application.

Claims

1. A knowledge integration method based on multi-source exposure surface data, characterized in that, The method includes: Initial exposure surface data from different channels is collected, and conflict resolution processing is performed on the initial exposure surface data to obtain target exposure surface data. The target exposure surface data includes entity attribute information weighted by channel credibility and description of the relationship between entities. An initial security posture knowledge graph is constructed based on the target exposure surface data. The node set of the initial security posture knowledge graph includes vulnerability entities and potential vulnerability exploitation path entities, and the edge set includes causal relationships and impact degree descriptors between entities. Based on the channel tags of the initial exposure surface data, perform layer division and attribute update operations on the initial security situation knowledge graph to obtain a multi-level security situation knowledge graph containing multi-level channel subgraphs. The layer attributes of the multi-level channel subgraphs include channel type identifiers and data collection timestamps. In response to security protection logs reported from different channels, layer enhancement or layer hiding processing is performed on the target layers associated with the security protection logs in the multi-level security situation knowledge graph to generate a real-time updated security situation knowledge graph.

2. The method according to claim 1, characterized in that, The process of collecting initial exposure surface data from different channels, performing conflict resolution on the initial exposure surface data, and obtaining target exposure surface data includes: Initial exposure surface data from multiple channels is received through a preset data access interface. The initial exposure surface data includes scan data, vulnerability intelligence data, and threat intelligence data. The initial exposure surface data from each channel carries a channel type identifier and a data credibility score. The initial exposure surface data is subjected to entity normalization processing, which maps heterogeneous data describing the same entity from different channels to a preset entity attribute description framework to generate a standardized entity set. The entity attributes of the standardized entity set include the entity's unique identifier, entity type, and entity feature vector. A conflict detection rule base is constructed, and conflict identification operations are performed on the entity attribute information and inter-entity relationships in the standardized entity set based on the entity attribute similarity threshold and the conflict level of the association relationship, to obtain a conflict data set, which includes attribute value conflict data and relationship type conflict data. Based on the data credibility scores of each channel, a weighted voting fusion process is performed on the conflict data set, retaining the entity attribute values ​​and association types corresponding to the channel with the highest credibility score, and generating intermediate exposure surface data after conflict resolution. Redundant data filtering is performed on the intermediate exposure surface data to remove duplicate entity attribute records and association descriptions with confidence levels lower than preset values, thereby obtaining target exposure surface data containing entity attribute verification identifiers.

3. The method according to claim 1, characterized in that, The process of performing layer division and attribute update operations on the initial security posture knowledge graph based on the channel tags of the initial exposure surface data to obtain a multi-level security posture knowledge graph containing multi-level channel subgraphs includes: The channel tags of the initial exposure surface data are parsed, channel type information and data collection timestamps are extracted, and the initial security situation knowledge graph is divided into multiple channel subgraphs based on the channel type information, with each channel subgraph corresponding to a data source channel. Add layer attributes to each channel sub-graph. The layer attributes include channel type identifier, data collection timestamp, and data integrity index. The data integrity index is calculated by the proportion of non-empty fields of entity attributes in the channel sub-graph. Attribute enhancement processing is performed on the entity nodes in each channel subgraph, and the entity feature vector in the target exposure surface data of the corresponding channel is embedded into the attribute field of the entity node to generate an enhanced entity node set containing multi-dimensional feature descriptions; Construct entity association rules across channel subgraphs, and match the same entity nodes in different channel subgraphs based on the entity's unique identifier to establish entity mapping relationships between channel subgraphs and generate a cross-layer entity association index table; Based on the cross-layer entity association index table, layer fusion verification is performed on each channel subgraph. The attribute similarity and association consistency of the same entity node in different channel subgraphs are calculated. Channel subgraphs with attribute similarity higher than the preset similarity are marked as strongly associated layers, resulting in a multi-level security situation knowledge graph containing the layer association strength matrix.

4. The method according to claim 3, characterized in that, The attribute enhancement processing performed on the entity nodes in each channel subgraph involves embedding the entity feature vector from the target exposure surface data of the corresponding channel into the attribute fields of the entity nodes, generating an enhanced entity node set containing multi-dimensional feature descriptions, including: Extract entity feature vectors corresponding to each channel from the target exposure surface data. The entity feature vectors include vulnerability number features, risk level features, and impact range features of the vulnerability entities. The entity feature vector is normalized by performing a feature scaling algorithm, which maps feature values ​​of different dimensions to a preset numerical range to generate a standardized entity feature vector. The feature value range of each dimension of the standardized entity feature vector remains consistent. Create a feature attribute field for each entity node in the channel subgraph, write the standardized entity feature vector into the feature attribute field in dimensional order, and generate a feature attribute record containing vector dimension identifier and feature value description. Perform hash index construction processing on the feature attribute records of entity nodes, and generate feature retrieval index based on the entity's unique identifier and feature dimension identifier; The feature cross-validation algorithm is used to remove feature attribute records with missing dimensions or outliers from the written standardized entity feature vectors. The enhanced entity nodes that are not removed are then used to form an enhanced entity node set.

5. The method according to claim 3, characterized in that, The step of performing layer fusion verification on each channel sub-graph according to the cross-layer entity association index table, calculating the attribute similarity and association consistency of the same entity node in different channel sub-graphs, and marking channel sub-graphs with attribute similarity higher than a preset similarity as strongly associated layers includes: Extract entity node pairs with mapping relationships from the cross-layer entity association index table. The entity node pairs contain entity nodes with the same unique entity identifier in different channel subgraphs. Perform a dimension-by-dimensional comparison of the attribute fields of entity node pairs, calculate the similarity of attribute values ​​for numerical attributes and the matching degree of categorical attributes, and fuse the comparison results of each dimension through a weighted average algorithm to obtain the entity attribute similarity score. Extract the set of relationships between entity nodes in their respective channel subgraphs, compare the relationship type identifiers and influence degree descriptors of the set of relationships, and count the proportion of edges with the same relationship type as the consistency index of relationships. The entity attribute similarity score and the consistency index of the association relationship are input into the layer association strength calculation model to generate a comprehensive layer association strength value. The value range of the comprehensive layer association strength value corresponds to the preset similarity threshold range. Channel subgraphs with a correlation strength value higher than a preset strength value are marked as strongly correlated layers. Strong correlation identifiers and correlation strength values ​​are added to the layer attributes of the multi-level security situation knowledge graph. The strong correlation identifiers and correlation strength values ​​are used for the selection of correlated layers during layer enhancement processing.

6. The method according to claim 1, characterized in that, In response to security protection logs reported from different channels, the system performs layer enhancement or layer hiding processing on the target layers associated with the security protection logs in the multi-level security posture knowledge graph, generating a real-time updated security posture knowledge graph, including: Receive security protection logs reported from different channels, parse the log fields of the security protection logs, and extract the security event type, protection measure type and associated channel type identifier. The security event type includes vulnerability exploitation events, port scanning events and malicious code propagation events. Based on the channel type identifier, the corresponding target channel subgraph is located from the multi-level security situation knowledge graph. The security event type is matched with the entity node attributes in the target channel subgraph to determine the set of target entity nodes associated with the security event. The processing method for the target channel sub-map is determined based on the type of protection measure. When the type of protection measure is an active defense measure, layer enhancement processing is performed; when the type of protection measure is an outdated defense measure, layer hiding processing is performed. If layer enhancement processing is performed, the attribute weights of the target entity nodes and the influence descriptors of the associated edges in the target channel subgraph are enhanced, and enhancement timestamps and enhancement reason tags are added to the layer attributes; If layer hiding is performed, the transparency parameter of the target channel subgraph in the knowledge graph visualization is reduced, and a hiding mark and a hiding time window are added to the layer properties. The hiding time window is set based on the effective duration of the protection measures. After the target layer is processed, the layer relationships of the multi-level security situation knowledge graph are re-verified, the association strength values ​​of strongly associated layers are updated, and a real-time updated security situation knowledge graph containing layer state change records is generated.

7. The method according to claim 6, characterized in that, The step of locating the corresponding target channel subgraph from the multi-level security situation knowledge graph based on the channel type identifier, matching the security event type with the entity node attributes in the target channel subgraph, and determining the set of target entity nodes associated with the security event includes: Parse the channel type identifier of the security protection log to obtain the channel type code and data source identifier, and perform matching retrieval in the layer attributes of the multi-level security situation knowledge graph based on the channel type code to locate the corresponding target channel subgraph; Extract the set of entity nodes from the target channel subgraph, traverse the attribute fields of the entity nodes, and filter out candidate entity nodes that contain features related to security events; The semantic similarity between the security event type and the event type attribute of the candidate entity node is calculated by a text matching algorithm to generate an event type matching score. The event type matching score is used to measure the degree of association between the candidate entity node and the security event. Set an event type matching threshold, filter candidate entity nodes with matching scores higher than the event type matching threshold as preliminary associated entity nodes, traverse the association relationship edge set of the preliminary associated entity nodes, and identify indirect associated entity nodes that have a causal relationship with the security event. The initially associated entity nodes and indirectly associated entity nodes are merged, and duplicate nodes are removed to generate a target entity node set. An association strength label is added to each entity node in the set. The association strength label is determined based on the matching degree score and the association strength factor after the relationship path length is converted. The shorter the relationship path length, the higher the association strength factor.

8. The method according to claim 6, characterized in that, If layer enhancement processing is performed, the attribute weights and influence descriptors of the target entity nodes and their associated edges in the target channel subgraph are enhanced, and enhancement timestamps and enhancement reason tags are added to the layer attributes, including: Extract the attribute weight configuration file of each node from the target entity node set. The attribute weight configuration file contains the current weight value of each attribute field and the weight adjustment rule. The weight adjustment rule is associated with the security event type. According to the weight adjustment rules corresponding to the security event type, the key attribute fields of the target entity node are subjected to weight value enhancement. The key attribute fields include risk level characteristics, impact scope characteristics, and most recent occurrence time characteristics. The enhancement magnitude is positively correlated with the severity of the security event. Traverse the set of association edges of the target entity node, identify the core association edges that are directly related to the security event and the secondary association edges that are indirectly related, and perform numerical augmentation processing on the influence degree descriptor of the core association edges; Add an enhanced timestamp to the layer attributes of the target channel sub-map, record the execution time of the layer enhancement process, and generate an enhancement reason tag based on the log content of the security protection log. The enhancement reason tag includes the security event type and the protection measure type. If layer hiding is performed, the transparency parameter of the target channel subgraph in the knowledge graph visualization is reduced, and a hiding marker and a hiding time window are added to the layer properties. The hiding time window is set based on the effective duration of the protection measures, including: Obtain the current transparency parameter of the target channel sub-image. The current transparency parameter controls the accuracy and comprehensiveness of the layer's display in the visualization interface. The initial value is set to the parameter value corresponding to the maximum display accuracy and comprehensiveness. The system queries a preset transparency adjustment rule base based on the type of protective measure to determine the corresponding reduction in transparency for the hiding process. Then, it uses a parameter adjustment algorithm to reduce the current transparency parameter to the target transparency value, which is positively correlated with the hiding priority. Add a hidden marker to the layer properties of the target channel sub-map. The hidden marker includes the hidden trigger time, the hidden operation type, and the operator identifier, which is used to trace the history of layer status changes. The effective duration field of the protection measures in the security protection log is parsed, and the hiding end time point is calculated in combination with the current system time to generate a hiding time window. The start time of the hiding time window is the current system time, and the end time is the hiding end time point. Write the hidden time window into the time management field of the layer properties, monitor the remaining duration of the hidden time window through a scheduled task, and automatically remove the hidden marker and restore the transparency parameter to the initial value when the end time is reached.

9. The method according to claim 6, characterized in that, After completing the target layer processing, the layer relationships of the multi-level security situation knowledge graph are re-verified, the association strength values ​​of strongly associated layers are updated, and a real-time updated security situation knowledge graph containing layer state change records is generated, including: Traverse all associated layers in the multi-level security situation knowledge graph that have strong associations with the target layer, and extract the entity mapping relationship between the associated layers and the target layer and the historical association strength value. The entity node sets of the associated layer and the target layer are re-compared, the entity attribute similarity and association consistency index are calculated, and a new comprehensive layer association strength value is generated using the same algorithm as the initial layer fusion verification. The new composite layer association strength value is compared with the historical association strength value. If the difference exceeds the preset fluctuation threshold, the association strength value of the strongly associated layer is updated, and the timestamp of the strength value change and the reason for the change are recorded. Perform state change record generation processing on the layer attributes of the target layer, record the layer processing type, processing time, number of entity nodes involved and the scope of influence of associated layers, and form a layer state change log; The layer state change log is attached to the metadata area of ​​the multi-level security posture knowledge graph. The updated knowledge graph data is converted into a standard data format through the knowledge graph serialization algorithm to generate a persistent, real-time updated security posture knowledge graph.

10. A knowledge integration system based on multi-source exposure surface data, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of any one of the methods described in claims 1 to 9.

Images