CN111581397A - A network attack source tracing method, device and device based on knowledge graph - Google Patents

Abstract

The invention discloses a network attack source tracing method based on a knowledge graph. The method comprises the following steps: during the network operation process, signal detection is performed on the network; when a network attack signal is detected, each pre-established network knowledge graph is obtained; Among them, each network knowledge graph is a graph of a network graph structure constructed according to the operation data in the network; each network knowledge graph is used to trace the network attack signal to the network attack source, and obtain the network attack source tracing result. The application of the technical solutions provided by the embodiments of the present invention greatly reduces the amount of calculation, reduces the time-consuming, greatly improves the search speed, and realizes comprehensive and efficient identification of network attacks. The invention also discloses a network attack source tracing device, equipment and storage medium, which have corresponding technical effects.

Description

A network attack source tracing method, device and device based on knowledge graph

technical field

The present invention relates to the technical field of network security, and in particular, to a method, device, device and computer-readable storage medium for tracing the source of a network attack based on a knowledge graph.

Background technique

In recent years, network attacks have occurred frequently, and Trojan horses, worms, and ransomware have emerged in an endless stream on the Internet, which poses a serious threat to network security. When a network attack occurs, it is necessary to trace the source of the network attack, so as to find a solution as soon as possible and restore network security.

The existing network attack source tracing methods mainly use the network attack knowledge base based on relational database to trace the network attack source. When searching with complex conditions, the search speed is slow. For example, when performing a search such as "search for all computers that have established an insecure connection with computer A, and all computers that have established an insecure connection with these computers", the relational database needs to pass multiple database tables. The Karl product association query has a huge amount of calculation, a long time, and a slow search speed.

To sum up, how to effectively solve the problems of the existing network attack source tracing methods, such as large amount of calculation, long time consumption, slow search speed, etc., is an urgent problem to be solved by those skilled in the art at present.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a network attack source tracing method based on knowledge graph, which greatly reduces the amount of calculation, reduces the time consumption, greatly improves the search speed, and realizes comprehensive and efficient identification of network attacks; the present invention Another object of the present invention is to provide a network attack source tracing device, equipment and computer-readable storage medium.

In order to solve the above-mentioned technical problems, the present invention provides the following technical solutions:

A network attack source tracing method based on knowledge graph, including:

During network operation, signal detection is performed on the network;

When a network attack signal is detected, each pre-established network knowledge graph is obtained; wherein each of the network knowledge graphs is a graph of a network graph structure constructed according to the operation data in the network;

The network attack source is traced to the network attack signal by using each of the network knowledge graphs to obtain a network attack source tracing result.

In a specific embodiment of the present invention, the process of establishing each of the network knowledge graphs includes:

Perform knowledge extraction on the operation data to obtain each knowledge tuple; wherein, each knowledge tuple includes an operation object, an operation means and an operated object; the operation object and the operated object are operation entities, and the operation The means are operational relationships;

storing each of the knowledge tuples in their corresponding graph databases;

Send knowledge tuples in each graph database to other graph databases through message broadcasting;

Correlate knowledge tuples with the same operational entities in each graph database to obtain each of the network knowledge graphs.

In a specific embodiment of the present invention, the knowledge tuples in each graph database are sent to other graph databases through message broadcasting, including:

Using the data sharing mechanism of the blockchain network, the knowledge tuples in each graph database are sent to other graph databases through message broadcasting.

In a specific embodiment of the present invention, it also includes:

When it is detected that the number of knowledge tuples in each of the graph databases exceeds a preset value, determining the knowledge tuples to be deleted;

A deletion operation is performed on the knowledge tuple to be deleted.

In a specific embodiment of the present invention, determining the knowledge tuple to be deleted includes:

respectively perform cold and hot sorting on each of the knowledge tuples in each of the graph databases;

The knowledge tuples to be deleted are determined in the order of hot first and then hot.

A network attack source tracing device based on knowledge graph, comprising:

a signal detection module for performing signal detection on the network during network operation;

A knowledge graph acquisition module, configured to acquire each pre-established network knowledge graph when a network attack signal is detected; wherein each of the network knowledge graphs is a graph of a network graph structure constructed according to the operation data in the network;

The attack source tracing module is configured to use each of the network knowledge graphs to trace the network attack signal to the network attack source, and obtain the network attack source tracing result.

In a specific embodiment of the present invention, it also includes a knowledge graph establishment module, and the knowledge graph establishment module includes:

The knowledge extraction submodule is used to extract knowledge from the operation data of the network to obtain each knowledge tuple; wherein, each knowledge tuple includes an operation object, an operation means and an object to be operated; the operation object and the object to be operated The operation object is an operation entity, and the operation means is an operation relationship;

a knowledge tuple storage submodule, used for storing each of the knowledge tuples in the respective corresponding graph databases;

The knowledge tuple sending sub-module is used to send the knowledge tuple in each graph database to other graph databases through message broadcasting;

The knowledge graph obtaining sub-module is used for associating knowledge tuples with the same operational entities in each graph database to obtain each of the network knowledge graphs.

In a specific embodiment of the present invention, the knowledge tuple sending sub-module specifically uses the data sharing mechanism of the blockchain network to send the knowledge tuple in each graph database to other graph databases through message broadcasting. module.

A network attack source tracing device based on knowledge graph, including:

memory for storing computer programs;

The processor is configured to implement the steps of the method for tracing the source of a network attack based on the knowledge graph as described above when executing the computer program.

A computer-readable storage medium storing a computer program on the computer-readable storage medium, when the computer program is executed by a processor, implements the steps of the method for tracing the source of a network attack based on a knowledge graph as described above.

By applying the method provided by the embodiment of the present invention, in the process of network operation, signal detection is performed on the network; when a network attack signal is detected, each pre-established network knowledge graph is obtained; wherein, each network knowledge graph is based on the operation in the network. The graph of the network graph structure obtained by constructing the data; using each network knowledge graph to trace the network attack signal to the source of the network attack, and obtain the result of the source of the network attack. By pre-establishing a network knowledge graph with a network graph structure, when a network attack signal is detected, each network knowledge graph is used to trace the network attack signal to the network attack source. The network knowledge graph expresses the knowledge contained in the operation data, and turns the abstract relationship into a visual expression. Compared with the existing tabular display, the present invention does not need to perform a large number of external link association calculations, and can capture the knowledge more intuitively. It greatly reduces the amount of calculation, reduces the time-consuming, greatly improves the search speed, and realizes comprehensive and efficient identification of network attacks.

Correspondingly, the embodiments of the present invention also provide a network attack source tracing apparatus, device, and computer-readable storage medium corresponding to the above-mentioned knowledge graph-based network attack source tracing method, which have the above technical effects, and are not repeated here.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

Fig. 1 is a kind of implementation flow chart of the network attack source tracing method based on knowledge graph in the embodiment of the present invention;

Fig. 2 is another implementation flow chart of the network attack source tracing method based on knowledge graph in the embodiment of the present invention;

3 is a structural block diagram of a knowledge chain in an embodiment of the present invention;

4 is a network knowledge graph corresponding to a network attack event in an embodiment of the present invention;

FIG. 5 is an overall architecture diagram of a knowledge chain in an embodiment of the present invention;

6 is a structural block diagram of a network attack source tracing device based on a knowledge graph in an embodiment of the present invention;

FIG. 7 is a structural block diagram of a network attack source tracing device based on a knowledge graph in an embodiment of the present invention.

Detailed ways

In order to make those skilled in the art better understand the solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, but not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Example 1:

Referring to FIG. 1, FIG. 1 is an implementation flowchart of a method for tracing the source of a network attack based on a knowledge graph in an embodiment of the present invention, and the method may include the following steps:

S101: During the network operation process, perform signal detection on the network.

During network operation, signal detection is performed on the network. For example, the traffic range of the network in a normal operation state can be pre-stored, and whether the network traffic is within the pre-stored traffic range can be detected during the network operation process.

S102: When a network attack signal is detected, obtain each pre-established network knowledge graph; wherein each network knowledge graph is a graph of a network graph structure constructed according to the operation data in the network.

In the process of performing various operations on the network, the network knowledge graph of the network graph structure is constructed according to the operation data in the network, so that the connected operation data are related to each other. When a network attack signal is detected by performing signal detection on the network, the pre-established knowledge graph of each network is acquired.

S103: Use each network knowledge graph to trace the network attack signal to the network attack source, and obtain the network attack source tracing result.

Each network knowledge graph has the upstream and downstream information of each link involved in the attack, and the network knowledge graph can clearly show the connection between the stakeholders of the network attack. Therefore, the network knowledge graph is applied to each isolated network segment in the network. Intrusion prevention system, as the support of identification rules of intrusion prevention equipment. After obtaining each network knowledge graph, use each network knowledge graph to trace the network attack signal to the network attack source, and obtain the network attack source tracing result. The network knowledge graph expresses the knowledge contained in the operation data, and turns the abstract relationship into a visual expression. Compared with the existing tabular display, the present invention does not need to perform a large number of external link association calculations, and can capture the knowledge more intuitively. It greatly reduces the amount of calculation, reduces the time-consuming, greatly improves the search speed, and realizes comprehensive and efficient identification of network attacks.

By applying the method provided by the embodiment of the present invention, in the process of network operation, signal detection is performed on the network; when a network attack signal is detected, each pre-established network knowledge graph is obtained; wherein, each network knowledge graph is based on the operation in the network. The graph of the network graph structure obtained by constructing the data; using each network knowledge graph to trace the network attack signal to the source of the network attack, and obtain the result of the source of the network attack. By pre-establishing a network knowledge graph with a network graph structure, when a network attack signal is detected, each network knowledge graph is used to trace the network attack signal to the network attack source. The network knowledge graph expresses the knowledge contained in the operation data, and turns the abstract relationship into a visual expression. Compared with the existing tabular display, the present invention does not need to perform a large number of external link association calculations, and can capture the knowledge more intuitively. It greatly reduces the amount of calculation, reduces the time-consuming, greatly improves the search speed, and realizes comprehensive and efficient identification of network attacks.

It should be noted that, based on the foregoing first embodiment, the embodiment of the present invention also provides a corresponding improvement solution. In subsequent embodiments, the same steps or corresponding steps in the above-mentioned first embodiment can be referred to each other, and corresponding beneficial effects can also be referred to each other, which will not be repeated in the following improved embodiments.

Embodiment 2:

Referring to FIG. 2, FIG. 2 is another implementation flowchart of the method for tracing the source of a network attack based on a knowledge graph in an embodiment of the present invention, and the method may include the following steps:

S201: Perform knowledge extraction on the operation data in the network to obtain each knowledge tuple; wherein, each knowledge tuple includes an operation object, an operation means and an operated object; the operation object and the operated object are the operation entity, and the operation means is the operation relation.

When operation data is generated in the network, knowledge extraction is performed on the operation data in the network to obtain each knowledge tuple. Each knowledge tuple includes an operation object, an operation means, and an operated object, and the operation object and the operated object are recorded as an operation entity, and the operation means is recorded as an operation relationship.

For example, the extraction objects of network attack knowledge include attack identification information of network intrusion detection system, switch logs, router logs, firewall logs, terminal equipment logs, application logs, enterprise network asset database tables, etc. The structure of network attack knowledge can be simply regarded as a multi-relational graph, which is composed of nodes and edges. Usually, “operational entities” are used to represent nodes in the graph, and “operational relationships” are used to represent edges in the graph. Indicates that there is an operational relationship between two operational entities. Mapped to the actual network attack, the "operation entity" corresponds to the relevant operation object of the network attack, which can be an IP address, a device, an application or a specific data object, and the "operation relationship" corresponds to the operation means, that is, the action relationship. It can be aggressive behavior, subordinate behavior, operational behavior, etc. For example, we can express the "attack IP address" as the operation entity, "attack host" as the operation entity, and "attack method" as the operation relationship, then we can use <"ip address", "attack method", " The triplet of the attacked host "> to represent the relationship between nodes and edges. Knowledge extraction based on triple knowledge structure is carried out on all operating objects and related information of manipulated objects, and the attack information is processed into knowledge representation in triple format. The extracted knowledge will be presented in the form of a knowledge tuple of <"operation entity", "operation relation", "operation entity">.

S202: Store each knowledge tuple in the corresponding graph database.

After each knowledge tuple is obtained by performing knowledge extraction on the operation data in the network, each knowledge tuple is stored in its corresponding graph database.

As shown in Figure 3, a corresponding knowledge module is established for each operation on the network. Each knowledge module consists of a graph database and a message processing plug-in. The knowledge modules are connected to each other to form a knowledge chain. The message processing plug-in is mainly responsible for receiving and processing data messages (knowledge) and control instructions in the knowledge chain network, encrypting and decrypting data messages, and adding, deleting, checking, and modifying graph databases. A graph database is a type of database that is a non-relational database. The focus of the graph database is the graph formed by the "association relationship", and its goal is to store and analyze the association relationship between the operating entities and the operating entities in the network, that is, abstract the operating entities into vertices, and abstract the operations between the operating entities. Relationships are abstracted as edges. Through the graph structure formed by vertices and edges, the relationship between all things is intuitively and naturally expressed, and the performance problem of deep retrieval of complex relationship relationships is solved. Since the knowledge structure itself is a data structure based on a relational graph, a graph database is used to store knowledge. The knowledge module can support mainstream graph data on the market, including arangob, neo4j, orientdb and allegrograph.

S203: Use the data sharing mechanism of the blockchain network to send the knowledge tuple in each graph database to other graph databases through message broadcasting.

After each knowledge tuple is stored in its corresponding graph database, the knowledge tuple in each graph database is sent to other graph databases through message broadcasting by using the data sharing mechanism of the blockchain network, so that each graph The knowledge information with the same version will be retained in the data. By using the blockchain network to share the storage of knowledge tuples to create a network attack knowledge chain, it is beneficial for the intrusion detection system to make full use of the attack knowledge of the entire network and realize comprehensive and efficient identification of network attacks.

S204 : Associate knowledge tuples with the same operation entity in each graph database to obtain each network knowledge graph.

After using the data sharing mechanism of the blockchain network to send the knowledge tuples in each graph database to other graph databases through message broadcasting, correlate the knowledge tuples with the same operational entities in each graph database, and obtain each graph database. Network Knowledge Graph.

For example, knowledge tuple 1<"10.21.34.56", "DDos attack", "10.67.89.46">, knowledge 2<"10.67.89.46", "Subordinate", "Li San of Human Resources Department">, the association is Yes: The host with the IP address "10.21.34.56" attacked the host of Li San of the Human Resources Department.

Each network knowledge graph involved in a network attack has upstream and downstream information of each link involved in the attack. Through the network knowledge graph, users can clearly see the stakeholders of the network attack, and can trace the source of the attack and conduct in-depth analysis of the impact. As shown in Figure 4, the network knowledge graph formed by a network attack event is described. The network attack 001 occurred on May 1, 2019. The IP address of the attacked host was 10.10.1.1, and the host was equipped with an OA system. The attack of network attack 001 ended in failure.

As shown in Figure 5, for each network knowledge graph in the knowledge chain, it will be applied to the intrusion prevention system of each isolated network segment in the network, as the support of the identification rules of the intrusion prevention equipment.

S205: During the network operation process, perform signal detection on the network.

S206: When a network attack signal is detected, obtain each pre-established network knowledge graph.

S207: Use each network knowledge graph to trace the network attack signal to the network attack source, and obtain the network attack source tracing result.

In a specific embodiment of the present invention, the method may further comprise the following steps:

Step 1: When it is detected that the number of knowledge tuples in each graph database exceeds a preset value, determine the knowledge tuples to be deleted;

Step 2: Delete the knowledge tuple to be deleted.

The method for tracing the source of a network attack based on a knowledge graph provided by the embodiment of the present invention may further include, when it is detected that the number of knowledge tuples in each graph database exceeds a preset value, determining the knowledge tuple to be deleted, and determining the knowledge tuple to be deleted. Perform delete operation. By cleaning the knowledge tuples in the graph database, the storage space is saved and the performance of the network system is improved.

In a specific embodiment of the present invention, determining the knowledge tuple to be deleted may include the following steps:

Step 1: Sort each knowledge tuple in each graph database by hot and cold;

Step 2: Determine the knowledge tuples to be deleted in the order of cold first and then hot.

The knowledge tuples in each graph database can be sorted by cold and hot respectively, and the knowledge tuples to be deleted are determined according to the order of cold first and then hot. Thus, it is ensured that knowledge tuples with high data access frequency are not deleted, and the reliability of the data is ensured.

Corresponding to the above method embodiments, the embodiments of the present invention further provide a network attack source tracing device. The knowledge graph-based network attack source tracing device described below and the knowledge graph-based network attack source tracing method described above may refer to each other correspondingly. .

Referring to FIG. 6, FIG. 6 is a structural block diagram of a knowledge graph-based network attack source tracing device in an embodiment of the present invention, and the device may include:

The signal detection module 61 is used for performing signal detection on the network during the operation of the network;

The knowledge graph acquiring module 62 is configured to acquire each pre-established network knowledge graph when a network attack signal is detected; wherein, each network knowledge graph is a graph of a network graph structure constructed according to the operation data in the network;

The attack source tracing module 63 is configured to use each network knowledge graph to trace the network attack signal to the network attack source, and obtain the network attack source tracing result.

By applying the device provided by the embodiment of the present invention, during the network operation process, signal detection is performed on the network; when a network attack signal is detected, each pre-established network knowledge graph is obtained; wherein, each network knowledge graph is based on the operation in the network. The graph of the network graph structure obtained by constructing the data; using each network knowledge graph to trace the network attack signal to the source of the network attack, and obtain the result of the source of the network attack. By pre-establishing a network knowledge graph with a network graph structure, when a network attack signal is detected, each network knowledge graph is used to trace the network attack signal to the network attack source. The network knowledge graph expresses the knowledge contained in the operation data, and turns the abstract relationship into a visual expression. Compared with the existing tabular display, the present invention does not need to perform a large number of external link association calculations, and can capture the knowledge more intuitively. It greatly reduces the amount of calculation, reduces the time-consuming, greatly improves the search speed, and realizes comprehensive and efficient identification of network attacks.

In a specific embodiment of the present invention, the device may further include a knowledge graph establishment module, and the knowledge graph establishment module includes:

The knowledge extraction sub-module is used to extract knowledge from the operation data of the network to obtain each knowledge tuple; wherein, each knowledge tuple includes the operation object, the operation means and the operated object; the operation object and the operated object are the operation entities, The means of operation is the operation relationship;

The knowledge tuple storage sub-module is used to store each knowledge tuple in the corresponding graph database;

The knowledge tuple sending sub-module is used to send the knowledge tuple in each graph database to other graph databases through message broadcasting;

The knowledge graph obtaining sub-module is used to associate knowledge tuples with the same operational entities in each graph database to obtain each network knowledge graph.

In a specific embodiment of the present invention, the knowledge tuple sending sub-module is specifically a module that uses the data sharing mechanism of the blockchain network to send the knowledge tuple in each graph database to other graph databases through message broadcasting.

In a specific embodiment of the present invention, the knowledge graph establishment module may further include:

A knowledge tuple determination submodule to be deleted, configured to determine the knowledge tuple to be deleted when it is detected that the number of knowledge tuples in each of the graph databases exceeds a preset value;

The knowledge tuple deletion sub-module is used to delete the knowledge tuple to be deleted.

In a specific embodiment of the present invention, the sub-module for determining the knowledge tuple to be deleted includes:

A knowledge tuple hot and cold sorting unit, configured to perform cold and hot sorting on each of the knowledge tuples in each of the graph databases;

The to-be-deleted knowledge tuple determination unit is configured to determine the to-be-deleted knowledge tuple in the order of cold first and then hot.

Corresponding to the above method embodiment, see FIG. 7 , which is a schematic diagram of a network attack source tracing device based on knowledge graph provided by the present invention, and the device may include:

memory 71 for storing computer programs;

The processor 72 can implement the following steps when executing the computer program stored in the above-mentioned memory 71:

In the process of network operation, signal detection is performed on the network; when a network attack signal is detected, each pre-established network knowledge graph is obtained; wherein, each network knowledge graph is a graph of a network graph structure constructed according to the operation data in the network ; Use each network knowledge graph to trace the network attack signal to the network attack source, and obtain the network attack source tracing result. By pre-establishing a network knowledge graph with a network graph structure, when a network attack signal is detected, each network knowledge graph is used to trace the network attack signal to the network attack source.

For the introduction of the device provided by the present invention, please refer to the above method embodiments, which will not be repeated in the present invention.

Corresponding to the above method embodiments, the present invention also provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps can be implemented:

In the process of network operation, signal detection is performed on the network; when a network attack signal is detected, each pre-established network knowledge graph is obtained; wherein, each network knowledge graph is a graph of a network graph structure constructed according to the operation data in the network ; Use each network knowledge graph to trace the network attack signal to the network attack source, and obtain the network attack source tracing result. By pre-establishing a network knowledge graph with a network graph structure, when a network attack signal is detected, each network knowledge graph is used to trace the network attack signal to the network attack source.

The computer-readable storage medium may include: a USB flash drive, a removable hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, etc., which can store program codes. medium.

For the introduction of the computer-readable storage medium provided by the present invention, please refer to the foregoing method embodiments, which will not be repeated in the present invention.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments may be referred to each other. For the apparatuses, devices, and computer-readable storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and reference may be made to the descriptions of the methods for related parts.

The principles and implementations of the present invention are described herein by using specific examples, and the descriptions of the above embodiments are only used to help understand the technical solutions and core ideas of the present invention. It should be pointed out that for those skilled in the art, without departing from the principle of the present invention, several improvements and modifications can also be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims (10)

1. A network attack tracing method based on a knowledge graph is characterized by comprising the following steps:

in the network operation process, carrying out signal detection on the network;

when a network attack signal is detected, acquiring each pre-established network knowledge graph; each network knowledge graph is a graph of a mesh graph structure constructed according to operation data in the network;

and utilizing each network knowledge graph to trace the network attack signal to obtain a network attack tracing result.

2. The method of claim 1, wherein the process of establishing each network knowledge graph comprises:

extracting knowledge from the operation data to obtain knowledge tuples; wherein each knowledge tuple comprises an operation object, an operation means and an operated object; the operation object and the operated object are operation entities, and the operation means is an operation relationship;

storing each said set of knowledge-tuples in a respective corresponding graph database;

sending the knowledge element group in each graph database to other graph databases in a message broadcasting mode;

and associating the knowledge groups with the same operation entity in each graph database to obtain each network knowledge graph.

3. The method of claim 2, wherein sending the tuples of knowledge in each graph database to other graph databases in a message broadcast form comprises:

and transmitting the knowledge tuples in each graph database to other graph databases in a message broadcasting mode by using a data sharing mechanism of the block chain network.

4. The method for tracing network attacks based on the knowledge graph according to claim 2 or 3, further comprising:

when detecting that the number of the knowledge groups in each map database exceeds a preset value, determining the knowledge groups to be deleted;

and deleting the knowledge group to be deleted.

5. The network attack tracing method based on the knowledge graph of claim 4, wherein the determining the set of knowledge groups to be deleted comprises:

performing cold-hot sequencing on each knowledge element group in each map database respectively;

and determining the knowledge element group to be deleted according to the sequence of cold before hot.

6. A network attack tracing device based on knowledge graph is characterized by comprising:

the signal detection module is used for detecting signals of the network in the network operation process;

the system comprises a knowledge graph acquisition module, a network attack detection module and a network attack detection module, wherein the knowledge graph acquisition module is used for acquiring pre-established network knowledge graphs when a network attack signal is detected; each network knowledge graph is a graph of a mesh graph structure constructed according to operation data in the network;

and the attack tracing module is used for carrying out network attack tracing on the network attack signals by utilizing each network knowledge graph to obtain a network attack tracing result.

7. The apparatus of claim 6, further comprising a knowledge graph establishing module, wherein the knowledge graph establishing module comprises:

the knowledge extraction submodule is used for extracting knowledge from the operation data of the network to obtain each knowledge element group; wherein each knowledge tuple comprises an operation object, an operation means and an operated object; the operation object and the operated object are operation entities, and the operation means is an operation relationship;

the knowledge group storage submodule is used for storing each knowledge group in a corresponding graph database;

the knowledge group sending submodule is used for sending the knowledge group in each graph database to other graph databases in a message broadcasting mode;

and the knowledge map obtaining submodule is used for associating the knowledge groups with the same operation entity in each map database to obtain each network knowledge map.

8. The apparatus according to claim 7, wherein the tuple sending submodule is specifically a module that sends a tuple in each graph database to another graph database in a message broadcast manner by using a data sharing mechanism of a blockchain network.

9. A network attack tracing device based on knowledge graph is characterized by comprising:

a memory for storing a computer program;

a processor for implementing the steps of the method for tracing network attacks based on knowledge-graph according to any one of claims 1 to 5 when executing the computer program.

10. A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when executed by a processor, the computer program implements the steps of the method for tracing a network attack based on a knowledge graph according to any one of claims 1 to 5.

Images