The invention discloses a
network security dynamic early warning method and
system based on a
knowledge graph, and relates to the technical field of
network security early warning, and the method comprises the steps: collecting the
original data Raw of a
network security event, analyzing
core network entities and the interaction relationship thereof, constructing a structured
basic knowledge graph KG, constructing a behavior feature
algorithm based on the
core network entities and the interaction relationship thereof, and carrying out the dynamic early warning of the network security. The method comprises the steps of generating a behavior
feature set CE, generating a potential
attack path set CP based on dynamic trigger points of the behavior
feature set CE, screening a high
threat path pmax in combination with a candidate path propagation
score pps, calculating a
threat index ATI to generate an early warning report AS, and performing linkage response action and closed-
loop optimization. According to the method, the scattered events are associated as the
attack chain through the
knowledge graph, the risk is dynamically quantified, the threshold value is adaptively adjusted, the problems that early warning is lagged, the
false alarm rate is high and multi-stage attacks cannot be associated in a traditional method are solved, and the early recognition and blocking capacity of complex threats is remarkably improved.