CN113591077A - Network attack behavior prediction method and device, electronic equipment and storage medium - Google Patents
Network attack behavior prediction method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN113591077A CN113591077A CN202110875490.XA CN202110875490A CN113591077A CN 113591077 A CN113591077 A CN 113591077A CN 202110875490 A CN202110875490 A CN 202110875490A CN 113591077 A CN113591077 A CN 113591077A
- Authority
- CN
- China
- Prior art keywords
- information
- multiple groups
- network
- learned
- relationship
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 61
- 238000001514 detection method Methods 0.000 claims abstract description 32
- 238000012549 training Methods 0.000 claims abstract description 30
- 230000006399 behavior Effects 0.000 claims description 24
- 238000004891 communication Methods 0.000 claims description 19
- 230000015654 memory Effects 0.000 claims description 18
- 238000004590 computer program Methods 0.000 claims description 13
- 238000004422 calculation algorithm Methods 0.000 claims description 12
- 238000004458 analytical method Methods 0.000 claims description 11
- 238000005516 engineering process Methods 0.000 abstract description 3
- 238000004364 calculation method Methods 0.000 description 15
- 238000010586 diagram Methods 0.000 description 14
- 239000011159 matrix material Substances 0.000 description 9
- 230000008569 process Effects 0.000 description 9
- 230000006870 function Effects 0.000 description 8
- 239000013598 vector Substances 0.000 description 8
- 210000004027 cell Anatomy 0.000 description 7
- 238000002372 labelling Methods 0.000 description 6
- 210000002569 neuron Anatomy 0.000 description 6
- 238000000605 extraction Methods 0.000 description 5
- 230000003993 interaction Effects 0.000 description 5
- 238000012546 transfer Methods 0.000 description 4
- 230000009471 action Effects 0.000 description 3
- 230000004927 fusion Effects 0.000 description 3
- 230000007787 long-term memory Effects 0.000 description 3
- 230000004913 activation Effects 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 230000000052 comparative effect Effects 0.000 description 2
- 230000003247 decreasing effect Effects 0.000 description 2
- 238000004880 explosion Methods 0.000 description 2
- 238000010801 machine learning Methods 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 238000012163 sequencing technique Methods 0.000 description 2
- 238000012706 support-vector machine Methods 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 238000007476 Maximum Likelihood Methods 0.000 description 1
- 241000700605 Viruses Species 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008033 biological extinction Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000018109 developmental process Effects 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 238000007499 fusion processing Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 230000001681 protective effect Effects 0.000 description 1
- 230000000306 recurrent effect Effects 0.000 description 1
- 230000011218 segmentation Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 238000001228 spectrum Methods 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/951—Indexing; Web crawling techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
- G06F17/10—Complex mathematical operations
- G06F17/16—Matrix or vector computation, e.g. matrix-matrix or matrix-vector multiplication, matrix factorization
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/044—Recurrent networks, e.g. Hopfield networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/084—Backpropagation, e.g. using gradient descent
Abstract
The network attack behavior prediction method, the network attack behavior prediction device, the electronic equipment and the storage medium are applied to the field of information technology, network threat information can be marked and divided to obtain multiple groups of characteristic information, then the conflicting characteristic information is removed through outburst detection, then multiple groups of learned relations are obtained through knowledge inference, and finally the current network attack is predicted according to the learned relations by utilizing a network model obtained through pre-training, so that not only can the removal of the conflicting characteristic information be realized, but also deep relations can be obtained through knowledge inference, and the accuracy of network attack prediction is improved.
Description
Technical Field
The present invention relates to the field of network security technologies, and in particular, to a method and an apparatus for predicting network attack behavior, an electronic device, and a storage medium.
Background
The network security means that the hardware, software and data in the system of the network system are protected and are not damaged, changed and leaked due to accidental or malicious reasons, the system continuously, reliably and normally operates, and the network service is uninterrupted. With the rapid development of internet technology, the threat to network security is increasing. As the number of threats from the network has increased dramatically, the attack patterns have become infinite and the scope of the attack has expanded rapidly. Therefore, in order to protect network security, a network security knowledge base is often used to predict network attacks, and then corresponding protective measures are set based on the prediction result.
However, the inventor finds that, when threat situation reports are collected through a network security knowledge base in the prior art, the collected threats and the relationship thereof are often unclear, so that the prediction result is inaccurate and the prediction efficiency is low.
Disclosure of Invention
The embodiment of the invention aims to provide a network attack behavior prediction method, a network attack behavior prediction device, electronic equipment and a storage medium, so as to improve the accuracy of network attack behavior prediction. The specific technical scheme is as follows:
in a first aspect of the embodiments of the present application, a network attack behavior prediction method is provided, where the method includes:
acquiring network threat information;
marking and dividing the network threat information to obtain a plurality of groups of characteristic information;
performing conflict detection on the multiple groups of feature information to obtain and remove conflicting feature information and obtain multiple groups of detected information;
learning the characteristic relationship of the multiple groups of detected information through knowledge reasoning to obtain multiple groups of learned relationships;
and predicting the current network attack according to the learned relation by utilizing a network model obtained by pre-training.
Optionally, the predicting the current network attack according to the learned relationship by using a network model obtained by pre-training includes:
calculating a trust value between the entities through a preset formula according to the relationship information between the entities and the learned relationship;
and predicting the current network attack according to the trust value between the entities by utilizing a network model obtained by pre-training.
Optionally, the learning of the feature relationship of the multiple groups of detected information through knowledge inference to obtain multiple groups of learned relationships includes:
and learning the characteristic relations of the multiple groups of detected information by using a pre-established tuple model through a path sorting algorithm to obtain multiple groups of learned relations.
Optionally, the performing collision detection on the multiple groups of feature information to obtain and remove the collided feature information, and obtaining multiple groups of detected information includes:
and performing conflict detection on the multiple groups of feature information by using a dictionary-based analysis method through the pre-created structural information to obtain and remove the conflicting feature information, so as to obtain multiple groups of detected information.
In a second aspect of the embodiments of the present application, a device for predicting network attack behavior is provided, where the device includes:
the information acquisition module is used for acquiring network threat information;
the marking and dividing module is used for marking and dividing the network threat information to obtain a plurality of groups of characteristic information;
the conflict detection module is used for carrying out conflict detection on the multiple groups of characteristic information to obtain and remove conflicting characteristic information and obtain multiple groups of detected information;
the relation learning module is used for learning the characteristic relation of the multiple groups of detected information through knowledge reasoning to obtain multiple groups of learned relations;
and the attack prediction module is used for predicting the current network attack according to the learned relation by utilizing a network model obtained by pre-training.
Optionally, the attack prediction module includes:
the trust value operator module is used for calculating the trust value between the entities through a preset formula according to the relationship information between the entities and the learned relationship;
and the network attack prediction submodule is used for predicting the current network attack according to the trust value between the entities by utilizing a network model obtained by pre-training.
Optionally, the relationship learning module is specifically configured to perform feature relationship learning on the multiple groups of detected information through a path sorting algorithm by using a pre-created tuple model, so as to obtain multiple groups of learned relationships.
Optionally, the conflict detection module is specifically configured to perform conflict detection on the multiple sets of feature information by using a dictionary-based analysis method through pre-created structural information, so as to obtain and remove conflicting feature information, and obtain multiple sets of detected information.
On the other hand, the embodiment of the present application further provides an electronic device, which includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus;
a memory for storing a computer program;
and the processor is used for realizing any network attack behavior prediction method step when executing the program stored in the memory.
In another aspect of the embodiments of the present application, a computer-readable storage medium is further provided, where a computer program is stored in the computer-readable storage medium, and when executed by a processor, the computer program implements any of the above network attack behavior prediction method steps.
In another aspect of the embodiments of the present application, there is also provided a computer program product containing instructions, which when run on a computer, causes the computer to perform any of the above network attack behavior prediction method steps.
The embodiment of the invention has the following beneficial effects:
the network attack behavior prediction method, the network attack behavior prediction device, the electronic equipment and the storage medium provided by the embodiment of the invention can mark and divide network threat information to obtain multiple groups of characteristic information, remove conflicting characteristic information through conflict detection, obtain multiple groups of learned relations through knowledge inference, and finally predict the current network attack according to the learned relations by utilizing a network model obtained through pre-training, so that not only can the removal of the conflicting characteristic information be realized, but also deep relations can be obtained through knowledge inference, and the accuracy of network attack prediction is improved.
Of course, not all of the advantages described above need to be achieved at the same time in the practice of any one product or method of the invention.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
Fig. 1 is a schematic flowchart of a network attack behavior prediction method according to an embodiment of the present application;
FIG. 2 is a schematic structural diagram of a hexahydric group model provided in an embodiment of the present application;
FIG. 3 is a state value diagram provided by an embodiment of the present application;
fig. 4 is a schematic flowchart of predicting a current network attack according to an embodiment of the present disclosure;
fig. 5 is a schematic diagram of a network structure of an LSTM provided in an embodiment of the present application;
fig. 6a is a schematic diagram of a calculation flow of a forgetting threshold according to an embodiment of the present application;
fig. 6b is a schematic diagram of a calculation process of an input threshold according to an embodiment of the present application;
fig. 6c is a schematic diagram illustrating a calculation flow of a unit state of an input threshold according to an embodiment of the present application;
fig. 6d is a schematic diagram of a calculation flow of a unit state at the current time of the input threshold according to the embodiment of the present application;
fig. 6e is a schematic diagram of a calculation process of an output threshold according to the embodiment of the present application;
FIG. 6f is a schematic diagram of a calculation flow of the LSTM final output provided by the embodiment of the present application;
fig. 7 is another schematic flow chart of a network attack behavior prediction method according to an embodiment of the present application;
FIG. 8 is a schematic diagram of an algorithm flow of the L-BFGS provided in the embodiment of the present application;
fig. 9 is a schematic structural diagram of a network attack behavior prediction apparatus provided in an embodiment of the present application;
fig. 10 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
In order to solve the problems that in the prior art, when threat reports are collected through a network security knowledge base, collected threats are often unclear in main body, relation and the like, so that a prediction result is inaccurate and prediction efficiency is low, embodiments of the present application provide a network attack behavior prediction method, device, electronic device and storage medium.
In a first aspect of the embodiments of the present application, a method for predicting network attack behavior is provided, where the method includes:
acquiring network threat information;
marking and dividing the network threat information to obtain a plurality of groups of characteristic information;
performing conflict detection on the multiple groups of characteristic information to obtain and remove conflicting characteristic information and obtain multiple groups of detected information;
learning characteristic relations of the multiple groups of detected information through knowledge reasoning to obtain multiple groups of learned relations;
and predicting the current network attack according to the learned relation by using a network model obtained by pre-training.
Therefore, by the method of the embodiment of the application, the network threat information can be labeled and segmented to obtain multiple groups of characteristic information, then the conflicting characteristic information is removed through outburst detection, multiple groups of learned relations are obtained through knowledge reasoning, and finally the current network attack is predicted according to the learned relations by using the network model obtained through pre-training, so that not only can the conflicting characteristic information be removed, but also deep relations can be obtained through knowledge reasoning, and the accuracy of network attack prediction is improved.
Specifically, referring to fig. 1, fig. 1 is a schematic flow chart of a network attack behavior prediction method provided in the embodiment of the present application, including:
and step S11, acquiring the network threat information.
The network threat information may be related information of network-related vulnerabilities, attacks and other threat intelligence required by acquiring structured data such as a database and unstructured data such as texts and audios. The structured data set can acquire data stored in formats such as XML (extensible markup language) and JSON (JavaScript Object Notification), and can be updated by acquiring related downloading rules, and the two formats can be analyzed by JSONObject (JSON tool). And acquiring network security data from the network by adopting a Scapy crawler frame in the unstructured data acquisition. Wherein, the method of extracting knowledge from the structured data and the unstructured data mainly adopts a rule-based and machine learning method. The existing richer vulnerability knowledge base is a Chinese information security vulnerability database, which contains various vulnerabilities including vulnerability names, vulnerability descriptions and other information. The rule base of the attack collects a great deal of existing attack information, including the name of the attack, the type of the attack, and other attributes. For unstructured text, enough training data is obtained, information about bugs and attacks is detected and extracted by adopting a machine learning method, and an unigram bag-of-words vector model is used for training an SVM (support vector machines) classifier by the classifier. If a description of the relevant needs is found, named entity recognition tools are used to extract entities, concepts and attributes relevant to network security. For structured data, usually in a fixed tag format, corresponding information can be directly extracted from such data and stored in a queue for later invocation.
The method of the embodiment of the application is applied to the intelligent terminal, can be implemented through the intelligent terminal, and specifically, the intelligent terminal can be a computer, a server and the like.
And step S12, labeling and dividing the network threat information to obtain a plurality of groups of characteristic information.
The plurality of sets of feature information may include network security entities and relationships between the entities. The network threat information is labeled and segmented, related network security entities can be identified from the network threat information through a network security named entity identifier, and then relationships among the entities are constructed based on a relationship rule template to obtain multiple groups of characteristic information.
For example, for partial description information of a vulnerability with the serial number of CVE-2020-. The entities include a CVE (Common Vulnerabilities & Exposures) number, a vulnerability type, an operating system, and the like, and the relationship includes that an attacker "utilizes" a vulnerability, and the vulnerability "affects" the operating system.
And step S13, performing conflict detection on the multiple groups of feature information to obtain and remove conflicting feature information and obtain multiple groups of detected information.
Because the fragmented big data disclosed generally contains a large amount of redundancy, errors or collisions, there is often a lack of logic between the data. The conflict detection is carried out on the multiple groups of characteristic information, the true values of the characteristic information can be judged, the error data can be detected and removed through the arrangement and fusion of the acquired characteristic information and then through the conflict detection and consistency check, the verified correct characteristic information is reasonably organized into a knowledge base through the alignment, combination and calculation, and the accuracy of the data can be guaranteed to the greatest extent.
For example, the same vulnerability entity appears as different vulnerability records in the CVE and BID (Bugtraq ID) vulnerability libraries, and therefore, the two types of entities need to be aligned to be the same entity. For example, the vulnerability numbered "106674" in the BID vulnerability database and the vulnerability numbered "CVE-2019-1010142" in the CVE vulnerability database should belong to the same vulnerability entity. The 'CVE' attribute in the BID record and the 'CVE _ ID' in the CVE record both belong to a CVE number, the 'Published' and 'Updated' attributes in the BID vulnerability record respectively correspond to the 'Published data' and 'lastModifiedDate' in the CVE record to indicate release time and update time, and the 'Vulnerable' attribute in the BID record and the 'cpe 23 Uri' attribute in the CVE record correspond to affected entities, so the equivalent attributes are aligned and summarized into an attribute field in a network security field body construction specification, wherein the semantic information of the two attributes of the 'Local' field in the BID and the 'accessVector' in the CVE record is the same to indicate whether the vulnerability is a Local vulnerability or a network vulnerability, and the attribute field and the attribute value are required to be converted and then fused. In addition, the values of the fields with the same attribute need to be complemented and the repeated redundant information needs to be removed in the fusion process.
And step S14, learning the characteristic relationship of the multiple groups of detected information through knowledge inference to obtain multiple groups of learned relationships.
The inference can mainly learn new relationships and new attribute values from the knowledge graph spectrum, and specifically, can be implemented by using rules in the hexahydric group model, see fig. 2. Wherein, the model includes: concepts, instances, relationships, attributes, rules, levels. The concept is a collection of abstract ontologies including OS (operating system), software, etc., such as DDos (distributed denial of service attack), Smurf (a virus attack), etc. Relationships are then incidence relationships between instances, relationships between ontologies, and the like. An attribute is then a collection of instance attribute values. Rules are used to reason about new instance relationships and new attribute values. The rating represents the importance of the instance. K represents a knowledge graph, K ═ concept, instance, relationship, property, rule, level. The deduction of attributes is to deduce the attributes of the new other aspects through the instances and the existing attribute values of the instances. The rule-based reasoning method mainly uses a method based on ontology rules, and rules defined by SWRL (semantic Web Law language) or other formal languages are restricted to establish reasoning relations on the basis of the ontology, so that the rule-based reasoning method has the characteristics of concise definition and rich description.
The relationship deduction mainly uses a path sorting algorithm and predicts the relationship between two nodes by using the characteristics of edges connecting the two nodes. When the relationship between two nodes is calculated, the length of the edge between the nodes and the trust value of the edge are introduced to simultaneously calculate the relationship of the nodes. The trust value calculation mode is as follows:
Sp＝αtp+β(1-vp)+γwp,α＝β＝γ＝1/3，
wherein, tp、vp、wpThe three parameters are the mean, variance and length ratio of the whole path, SpRepresenting a trust value. The trust values of the edges are 0.1, 0.3, 0.5, 0.8 and 1.0, which respectively represent five relationships of distrust, general trust, comparative trust and extreme trust. Transfer with transfer in knowledge-based transfer processThe length of the node is increased, the current situation that the trust value is decreased is adopted, the length is limited when a path is selected, and the relationship between two nodes is calculated through simple multiplication operation. Finally, new relations can be obtained through the sorting of the paths.
And step S15, predicting the current network attack according to the learned relation by using the network model obtained by training in advance.
The current network attack is predicted according to the learned relationship, and the whole network system can be decomposed into three layers of a system, a host and a service by using a hierarchical analysis method. And calculating the network security situation of the service, the host and the whole network system in sequence. The hierarchical analysis method comprises the following steps:
service S for calculating time tjThreat index of
Where n is time t for service SjNumber of attack categories of Di(t) attack severity of the ith attack, Ni(t) the ith attack pair service S at time tjThe attack times of (1), wherein, in the actual use process, the number of types of attacks and the verification degree of the attacks can be searched according to the public information of the attacks, for example, the attacks can be searched through a Chinese information security vulnerability database.
Calculate time t host HkThreat index of
Wherein m is host HkNumber of services opened, Vj(t) is the weight vector that the service occupies in all services that the host is open.
Calculating threat index of the whole network at the time t
Where c is the number of hosts in the entire network, Wk(t) is the weight vector that the host takes in the importance of the local area network being evaluated.
The network model obtained by the pre-training may be LSTM (long term memory network). After the threat index is obtained, the network security situation can be normalized to obtain a network situation value in a (0,1) interval. And then judging the condition of the network according to the network security situation value through the LSTM. Therein, a situation value diagram can be seen in fig. 3, wherein a-F represent different nodes.
Therefore, by the method of the embodiment of the application, the network threat information can be labeled and segmented to obtain multiple groups of characteristic information, then the conflicting characteristic information is removed through outburst detection, multiple groups of learned relations are obtained through knowledge reasoning, and finally the current network attack is predicted according to the learned relations by using the network model obtained through pre-training, so that not only can the conflicting characteristic information be removed, but also deep relations can be obtained through knowledge reasoning, and the accuracy of network attack prediction is improved.
Optionally, step S13 performs collision detection on multiple sets of feature information, obtains and removes the colliding feature information, and obtains multiple sets of detected information, including: and performing conflict detection on the multiple groups of feature information by using a dictionary-based analysis method through the pre-created structural information to obtain and remove the conflicting feature information and obtain multiple groups of detected information.
The characteristic relation of a plurality of groups of detected information is learned through knowledge reasoning, and a dictionary analysis-based method can be utilized to learn a large amount of structural information of Wikipedia, including entity pages, redirection pages, disambiguation pages, head segment blackened fields and hyperlink texts in encyclopedia pages. And expanding and expressing the document describing the entity object into a space vector model containing concepts and topics in the Wikipedia by using the classification information of the entity object page extracted from the Wikipedia and a large number of hyperlink texts contained in the page as the topics and the concepts respectively to obtain a plurality of groups of learned relations.
Specifically, the Chinese named entity linking method comprises three stages of nominal identification, candidate entity set generation and disambiguation;
1. the title recognition is to perform word segmentation and named entity recognition on the text by extracting a named entity title from the text to be disambiguated;
2. the generation of the candidate entity set is to provide a series of possible candidate entities for each name so as to avoid traversing the whole knowledge base in the disambiguation stage and further improve the disambiguation efficiency;
3. and sequencing and learning the corpus by using the text similarity characteristic and the entity type disambiguation characteristic to obtain a sequencing model, so that the target entities of the named items in the corpus can be predicted.
Therefore, through the method of the embodiment of the application, the conflict detection can be performed on the multiple groups of feature information through the pre-established structural information by utilizing the dictionary-based analysis method, and the conflicting feature information is removed, so that the accuracy of threat prediction is improved.
Optionally, in step S14, learning the feature relationship of the multiple groups of detected information through knowledge inference to obtain multiple groups of learned relationships, including: and learning the characteristic relations of the multiple groups of detected information by using a pre-established tuple model through a path sorting algorithm to obtain multiple groups of learned relations.
The inference can mainly learn new relations and new attribute values from the knowledge graph, and specifically can be realized by using rules in the hexahydric group model. The deduction of attributes is to deduce the attributes of the new other aspects through the instances and the existing attribute values of the instances.
And (3) assuming that A and B have a certain relation and B and C have a certain relation, and reasoning out the implicit relation of A and C through a chain relation. Clustering groups in the knowledge graph according to attribute similarity between the entities, calculating numbers on connecting lines by combining interaction times, relationship types and interest similarity between the entities to represent the trust degree between the two entities, and converting the whole network relationship into an entity interaction graph, which is shown in fig. 5. For the transfer relationship between nodes in the graph, it may be set as: obtaining information from only one man-in-the-middle is generally more reliable than information delivered by long-chain users, while the most accurate information will come from the most trusted neighbors, so path length limits and confidence value minimum thresholds can be established in finding a trusted path.
Wherein m represents the number of layers between A and E; n represents the L thj-1Layer units and LjThe number of layer individual interactions; t represents the L thj-1Layer and LjTotal number of layer interactions; n represents the number of links between A and E, WiIs the weight corresponding to the ith link, hiIs the hop count of the ith link layer, htotalTrust (A, E) is the Trust value between A and E for the total hop count. The number of layers between a and E, the hop count of the link layer, and the like can be obtained through the entity interaction diagram.
Therefore, by the method of the embodiment of the application, the characteristic relations of a plurality of groups of detected information can be learned by utilizing the pre-established tuple model through the path sorting algorithm to obtain a plurality of groups of learned relations, so that the network threat can be predicted through the learned relations.
Optionally, in fig. 4, the feature information in step S15 includes entity information and relationship information between entities, and the predicting of the current network attack according to the learned relationship by using the network model obtained through pre-training includes:
step S151, calculating trust values between the entities through a preset formula according to the relationship information between the entities and the learned relationship;
and S152, predicting the current network attack according to the trust value between the entities by using a network model obtained by pre-training.
The current network attack can be predicted by using the LSTM network according to the trust value between the entities by using a network model obtained by pre-training. In order to solve the problems of gradient elimination and gradient explosion in the long sequence training process, the method can be realized by a tenserflow frame regulation library. Continuously updating the batch _ size, the time _ step _ size and the test _ size by calculating a loss function when the LSTM parameter is set; the activation function may employ tanh; to prevent overfitting, regularization can be performed using dropout. Dropout may update the weights of other neurons by gradient descent by deleting a portion of the neurons. This is done the same way the next time other neurons are temporarily deleted, thus preventing overfitting. And finally, calculating errors through cross entropy, and repeatedly training to obtain an optimal value.
The network structure of the LSTM can be seen in fig. 5. The LSTM network may remember the state of the preamble, selectively let the information pass, forget the old information, and remember the new subject information. The LSTM network may include:
1. a forgetting threshold, which can determine the state c of the unit at the previous momenti-1How much to keep current time ci. The expression for the forget gate is:
athbfft＝σ(Wf·[ht-1,xt]+bf)，
in the above formula, WfIs the weight matrix of the forgetting gate, ht-1,xtRepresenting the concatenation of two vectors into a longer vector, bfIs the offset term of the forgetting gate, σ () is the sigmoid function, athbfftIs a forgetting threshold. If the dimension of the input is dxDimension of the hidden layer is dhDimension of cell state is dc(dc＝dh) Then forget the weight matrix W of the gatefDimension is dcx(dh+dx). Weight matrix WfBoth are formed by splicing two matrixes: a matrix WfhIt corresponds to the entry ht-1Of dimension dcxdh(ii) a Another matrix WfWhich corresponds to the entry xtOf dimension dcxdx，WfCan be written as:
wherein, the calculation of the forgetting gate can be seen in fig. 6 a.
2. Inputting a threshold: i.e. it＝σ(Wi·[ht-1,xt]+bi) Wherein W isiIs an input gateWeight matrix, biIs an offset term of the input gate, itIs the input threshold. The calculation of the input gate can be seen in fig. 6 b.
Calculating cell states for describing current inputs
Can be calculated according to the output of the last time and the input of this time:
see fig. 6c, where wcA matrix is represented.
Calculating the cell state c at the current timetFrom the last cell state ct-1Multiplication by element of forget gate ftReuse the currently input cell state
Multiplying input Gate i by elementtThen, two products are added to generate:
ctsee FIG. 6d for an example of the calculation of LSTM with respect to the current memory
And long term memory ct-1Combine to form a new cell state ct，ftAn entry is represented. The control of the forgetting gate can save information of a long time ago, and the control of the input gate can prevent the current irrelevant content from entering into memory.
3. And an output threshold, which controls the influence of long-term memory on the current output: ot＝σ(Wo·[ht-1,xt]+bo)，otPresentation input gateLimit, woIs a predetermined matrix, boIs a preset item. The calculation of the output gates can be seen in fig. 6 e.
The final output of the LSTM is determined by the output gates and cell states together: h ist＝otοtanh(ct) The calculation of the final output of the LSTM can be seen in fig. 6 f.
Therefore, by the method of the embodiment of the application, the trust value between the entities can be calculated through the preset formula according to the relationship information between the entities and the learned relationship, so that the current network attack can be predicted by using the network model obtained by pre-training, and the precaution is provided for a decision maker.
Referring to fig. 7, fig. 7 is another schematic flow chart of a network attack behavior prediction method provided in the embodiment of the present application. The embodiment of the application further provides a network security knowledge base, which comprises five modules, wherein the five modules are respectively as follows: the system comprises a data source module, an ontology module, a knowledge extraction module, a knowledge fusion module, a knowledge deduction module and a threat prediction module. The main functions and implementation of each module are as follows:
1. a data source module: the module is mainly used for acquiring needed relevant information of bugs, attacks and other threat intelligence from structured data such as a database and unstructured data such as texts and audios, and provides a large amount of knowledge information for the knowledge extraction module.
2. An ontology module: the body of network security contains four entity types, which are vulnerability, software, operating system and attack. And researching the unified formal representation of the network security elements based on the ontology, and establishing a multilevel security ontology structural system.
3. A knowledge extraction module: the module is mainly used for processing data acquired from the data source module, and performing operations such as data arrangement, data normalization and the like. The purpose of knowledge extraction is to label and segment sequences for data, so knowledge graph methods are used. The idea of the conditional random field is derived from a Markov network in a undirected graph model, mainly represents a linear chain element random field, and can be regarded as popularization of a maximum entropy Markov model on a labeling problem. The method has the advantage that rich internal and context statement information can be utilized in the process of labeling a position, so that a linear chain element random field is used for realizing the labeling classification of the sequence. The model is an unconstrained optimization problem, the learning strategy of which is maximum likelihood estimation. However, the dimension of the characteristic function involved in the sequence labeling problem is very high, so the embodiment of the present application selects L-BFGS (quasi-newton method under limited memory), and the basic idea of L-BFGS is to only store the latest m times of iteration information, thereby greatly reducing the storage space of data, and being better applied to the practical application with a larger scale, and the algorithm flow is shown in fig. 8.
The algorithm is described as follows: the L-BFGS first sets an initial value for the parameter
The estimation of the parameters is then refined a time after time:
is required to be driven from
Is updated to
Then the search direction needs to be calculated
By a step a in the directiontThe size of (2). To calculate
Need to use
And
the last m changes take values, m being given by the user, typically between 3 and 20.
Is the time of the ith iteration
The gradient vector of (2), at the time of the k-th iteration, the search direction is calculated
M pairs are required
Where i ═ k-m + 1, …, k. Step length akIs chosen to satisfy a strong Wolfe condition (a termination condition) to avoid steps that are too large or too small. Wherein HtIs an approximation of the hessian matrix, H per iterationtMay all be different.
4. A knowledge fusion module: through the knowledge extraction module, the tasks of the entities, the relationships, the entity attributes and other information are obtained. However, fragmented big data disclosed by the internet generally contains a large amount of redundancy, errors or conflicts, and the data usually lacks logicality, so that the acquired knowledge needs to be sorted and fused, then the true value of the knowledge is judged through conflict detection and consistency check, the error data is detected and removed, the verified correct knowledge is reasonably organized into a knowledge base through alignment, combination and calculation, a comprehensive shared knowledge network is provided for users, and the accuracy of the data is guaranteed to the maximum extent. Here, a dictionary analysis-based approach is mainly utilized, with the help of the large amount of structural information of wikipedia, including entity pages, redirection pages, disambiguation pages, first segment blackened fields, hyperlinked text in encyclopedia pages. And expanding and representing the document describing the entity object into a space vector model containing concepts and topics in the Wikipedia by using the classification information of the entity object page extracted from the Wikipedia and a large number of hyperlink texts contained in the page as the topics and the concepts respectively, and finally performing one-to-one linking.
5. A knowledge deduction module: knowledge reasoning is mainly to learn new relations from knowledge profilesAttribute values, here implemented primarily using rules in the six-tuple model. The deduction of attributes is to deduce the attributes of the new other aspects through the instances and the existing attribute values of the instances. The relationship deduction mainly uses a path sorting algorithm, and utilizes the characteristics of edges connecting two nodes in a graph so as to predict the relationship between the two nodes. When the relationship between two nodes is calculated, the length of the edge between the nodes and the trust value of the edge are introduced to simultaneously calculate the relationship of the nodes. Wherein, the trust value is calculated as followsp＝αtp+β(1-vp)+γwp,α＝β＝γ＝1/3，tp、vp、wpThe three parameters are the mean, variance and length ratio of the whole path. The range of the trust value of the edge is V ═<0.1,0.3,0.5,0.8,1.0>The numbers represent five relationships of distrust, poor trust, general trust, comparative trust and very trust. Based on the current situation that the trust value is decreased along with the increase of the transmission length in the knowledge transmission process, the length is limited when a path is selected, and the relationship between two nodes is calculated through simple multiplication operation. Finally, new relations can be obtained through the sorting of the paths. The rule-based reasoning method mainly uses a method based on ontology rules, and OWL and SWRL or rule constraints defined by other formal languages establish reasoning relations on the basis of the ontology.
6. A risk prediction module: threat prediction is mainly to mine hidden risks and thus provide advance precaution for decision makers. The deep learning method uses the LSTM network for prediction. LSTM is a special RNN (Recurrent Neural Network) and mainly aims to solve the problems of gradient extinction and gradient explosion during long sequence training. This is done directly through the tenserflow framereconcile library. Continuously updating the batch _ size, the time _ step _ size and the test _ size by calculating a loss function when the LSTM parameter is set; the activation function adopts tanh; to prevent overfitting, regularization is performed using dropout. dropout is to temporarily delete a part of neurons, and to update the weights of other neurons by gradient descent. This is then done the same way the next time other neurons are temporarily deleted, thus preventing overfitting. And finally, calculating errors through cross entropy, and repeatedly training to obtain an optimal value.
In a second aspect of the embodiments of the present application, there is further provided a network attack behavior prediction apparatus, with reference to fig. 9, where the apparatus includes:
an information obtaining module 901, configured to obtain network threat information;
a labeling and dividing module 902, configured to label and divide the network threat information to obtain multiple sets of feature information;
a conflict detection module 903, configured to perform conflict detection on the multiple sets of feature information, obtain and remove conflicting feature information, and obtain multiple sets of detected information;
a relationship learning module 904, configured to learn a feature relationship of multiple groups of detected information through knowledge inference, so as to obtain multiple groups of learned relationships;
and the attack prediction module 905 is configured to predict a current network attack according to the learned relationship by using a network model obtained through pre-training.
Optionally, the attack prediction module 905 includes:
the trust value calculation operator module is used for calculating the trust value between the entities through a preset formula according to the relationship information between the entities and the learned relationship;
and the network attack prediction submodule is used for predicting the current network attack according to the trust value between the entities by utilizing the network model obtained by pre-training.
Optionally, the relationship learning module 904 is specifically configured to perform feature relationship learning on multiple groups of detected information through a path sorting algorithm by using a pre-created tuple model, so as to obtain multiple groups of learned relationships.
Optionally, the collision detection module 903 is specifically configured to perform collision detection on multiple sets of feature information through pre-created structural information by using a dictionary-based analysis method, to obtain and remove feature information of a collision, so as to obtain multiple sets of detected information.
Therefore, by the aid of the device, network threat information can be marked and divided to obtain multiple groups of characteristic information, conflicting characteristic information is removed through outburst detection, multiple groups of learned relations are obtained through knowledge reasoning, and the current network attack is predicted according to the learned relations by means of the network model obtained through pre-training, so that not only can the conflicting characteristic information be removed, but also deep relations can be obtained through knowledge reasoning, and accuracy of network attack prediction is improved.
The embodiment of the present invention further provides an electronic device, as shown in fig. 10, which includes a processor 1001, a communication interface 1002, a memory 1003 and a communication bus 1004, wherein the processor 1001, the communication interface 1002 and the memory 1003 complete mutual communication through the communication bus 1004,
a memory 1003 for storing a computer program;
the processor 1001 is configured to implement the following steps when executing the program stored in the memory 1003:
acquiring network threat information;
marking and dividing the network threat information to obtain a plurality of groups of characteristic information;
performing conflict detection on the multiple groups of feature information to obtain and remove conflicting feature information and obtain multiple groups of detected information;
learning the characteristic relationship of the multiple groups of detected information through knowledge reasoning to obtain multiple groups of learned relationships;
and predicting the current network attack according to the learned relation by utilizing a network model obtained by pre-training.
The communication bus mentioned in the electronic device may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown, but this does not mean that there is only one bus or one type of bus.
The communication interface is used for communication between the electronic equipment and other equipment.
The Memory may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.
The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components.
In another embodiment of the present invention, a computer-readable storage medium is further provided, in which a computer program is stored, and the computer program, when executed by a processor, implements the steps of any of the above network attack behavior prediction methods.
In yet another embodiment, a computer program product containing instructions is provided, which when run on a computer, causes the computer to perform any one of the above described network attack behavior prediction methods.
In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the invention to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for embodiments such as the apparatus, the electronic device, and the computer-readable storage medium, since they are substantially similar to the method embodiments, the description is relatively simple, and for the relevant points, reference may be made to part of the description of the method embodiments.
The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall fall within the protection scope of the present invention.
Claims (10)
1. A network attack behavior prediction method, the method comprising:
acquiring network threat information;
marking and dividing the network threat information to obtain a plurality of groups of characteristic information;
performing conflict detection on the multiple groups of feature information to obtain and remove conflicting feature information and obtain multiple groups of detected information;
learning the characteristic relationship of the multiple groups of detected information through knowledge reasoning to obtain multiple groups of learned relationships;
and predicting the current network attack according to the learned relation by utilizing a network model obtained by pre-training.
2. The method of claim 1, wherein the feature information includes entity information and relationship information between entities, and predicting the current cyber attack according to the learned relationship by using a pre-trained cyber model includes:
calculating a trust value between the entities through a preset formula according to the relationship information between the entities and the learned relationship;
and predicting the current network attack according to the trust value between the entities by utilizing a network model obtained by pre-training.
3. The method of claim 1, wherein learning the feature relationships of the multiple groups of detected information through knowledge inference to obtain multiple groups of learned relationships comprises:
and learning the characteristic relations of the multiple groups of detected information by using a pre-established tuple model through a path sorting algorithm to obtain multiple groups of learned relations.
4. The method of claim 1, wherein the performing collision detection on the multiple sets of feature information to obtain and remove collided feature information and obtain multiple sets of detected information comprises:
and performing conflict detection on the multiple groups of feature information by using a dictionary-based analysis method through the pre-created structural information to obtain and remove the conflicting feature information, so as to obtain multiple groups of detected information.
5. A cyber attack behavior prediction apparatus, characterized in that the apparatus comprises:
the information acquisition module is used for acquiring network threat information;
the marking and dividing module is used for marking and dividing the network threat information to obtain a plurality of groups of characteristic information;
the conflict detection module is used for carrying out conflict detection on the multiple groups of characteristic information to obtain and remove conflicting characteristic information and obtain multiple groups of detected information;
the relation learning module is used for learning the characteristic relation of the multiple groups of detected information through knowledge reasoning to obtain multiple groups of learned relations;
and the attack prediction module is used for predicting the current network attack according to the learned relation by utilizing a network model obtained by pre-training.
6. The apparatus of claim 5, wherein the attack prediction module comprises:
the trust value operator module is used for calculating the trust value between the entities through a preset formula according to the relationship information between the entities and the learned relationship;
and the network attack prediction submodule is used for predicting the current network attack according to the trust value between the entities by utilizing a network model obtained by pre-training.
7. The apparatus of claim 5,
the relationship learning module is specifically configured to perform feature relationship learning on the multiple groups of detected information through a path sorting algorithm by using a pre-created tuple model to obtain multiple groups of learned relationships.
8. The apparatus of claim 5,
the conflict detection module is specifically configured to perform conflict detection on the multiple sets of feature information by using a dictionary-based analysis method through pre-created structural information, obtain and remove conflicting feature information, and obtain multiple sets of detected information.
9. An electronic device is characterized by comprising a processor, a communication interface, a memory and a communication bus, wherein the processor and the communication interface are used for realizing mutual communication by the memory through the communication bus;
a memory for storing a computer program;
a processor for implementing the method steps of any of claims 1 to 4 when executing a program stored in the memory.
10. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, which computer program, when being executed by a processor, carries out the method steps of any one of claims 1 to 4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110875490.XA CN113591077B (en) | 2021-07-30 | 2021-07-30 | Network attack behavior prediction method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110875490.XA CN113591077B (en) | 2021-07-30 | 2021-07-30 | Network attack behavior prediction method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113591077A true CN113591077A (en) | 2021-11-02 |
| CN113591077B CN113591077B (en) | 2024-03-19 |
Family
ID=78253033
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110875490.XA Active CN113591077B (en) | 2021-07-30 | 2021-07-30 | Network attack behavior prediction method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113591077B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114301795A (en) * | 2021-11-15 | 2022-04-08 | 南京翌淼信息科技有限公司 | Network data security identification method and system |
| CN114884686A (en) * | 2022-03-17 | 2022-08-09 | 新华三信息安全技术有限公司 | PHP threat identification method and device |
| CN114915539A (en) * | 2022-05-20 | 2022-08-16 | 电子科技大学 | SDN flow rule conflict fault detection method based on knowledge graph |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140337974A1 (en) * | 2013-04-15 | 2014-11-13 | Anupam Joshi | System and method for semantic integration of heterogeneous data sources for context aware intrusion detection |
| US9292695B1 (en) * | 2013-04-10 | 2016-03-22 | Gabriel Bassett | System and method for cyber security analysis and human behavior prediction |
| CN109347801A (en) * | 2018-09-17 | 2019-02-15 | 武汉大学 | A kind of vulnerability exploit methods of risk assessment based on multi-source word insertion and knowledge mapping |
| CN109922075A (en) * | 2019-03-22 | 2019-06-21 | 中国南方电网有限责任公司 | Network security knowledge map construction method and apparatus, computer equipment |
| CN110688456A (en) * | 2019-09-25 | 2020-01-14 | 北京计算机技术及应用研究所 | Vulnerability knowledge base construction method based on knowledge graph |
| CN111698207A (en) * | 2020-05-07 | 2020-09-22 | 北京华云安信息技术有限公司 | Method, equipment and storage medium for generating knowledge graph of network information security |
| CN111741023A (en) * | 2020-08-03 | 2020-10-02 | 中国人民解放军国防科技大学 | Attack studying and judging method, system and medium for network attack and defense test platform |
| US20200327223A1 (en) * | 2019-04-09 | 2020-10-15 | International Business Machines Corporation | Affectedness scoring engine for cyber threat intelligence services |
| CN112165462A (en) * | 2020-09-11 | 2021-01-01 | 哈尔滨安天科技集团股份有限公司 | Attack prediction method and device based on portrait, electronic equipment and storage medium |
| WO2021103492A1 (en) * | 2019-11-28 | 2021-06-03 | 福建亿榕信息技术有限公司 | Risk prediction method and system for business operations |
-
2021
- 2021-07-30 CN CN202110875490.XA patent/CN113591077B/en active Active
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9292695B1 (en) * | 2013-04-10 | 2016-03-22 | Gabriel Bassett | System and method for cyber security analysis and human behavior prediction |
| US20140337974A1 (en) * | 2013-04-15 | 2014-11-13 | Anupam Joshi | System and method for semantic integration of heterogeneous data sources for context aware intrusion detection |
| CN109347801A (en) * | 2018-09-17 | 2019-02-15 | 武汉大学 | A kind of vulnerability exploit methods of risk assessment based on multi-source word insertion and knowledge mapping |
| CN109922075A (en) * | 2019-03-22 | 2019-06-21 | 中国南方电网有限责任公司 | Network security knowledge map construction method and apparatus, computer equipment |
| US20200327223A1 (en) * | 2019-04-09 | 2020-10-15 | International Business Machines Corporation | Affectedness scoring engine for cyber threat intelligence services |
| CN110688456A (en) * | 2019-09-25 | 2020-01-14 | 北京计算机技术及应用研究所 | Vulnerability knowledge base construction method based on knowledge graph |
| WO2021103492A1 (en) * | 2019-11-28 | 2021-06-03 | 福建亿榕信息技术有限公司 | Risk prediction method and system for business operations |
| CN111698207A (en) * | 2020-05-07 | 2020-09-22 | 北京华云安信息技术有限公司 | Method, equipment and storage medium for generating knowledge graph of network information security |
| CN111741023A (en) * | 2020-08-03 | 2020-10-02 | 中国人民解放军国防科技大学 | Attack studying and judging method, system and medium for network attack and defense test platform |
| CN112165462A (en) * | 2020-09-11 | 2021-01-01 | 哈尔滨安天科技集团股份有限公司 | Attack prediction method and device based on portrait, electronic equipment and storage medium |
Non-Patent Citations (4)
| Title |
|---|
| 董聪;姜波;卢志刚;刘宝旭;李宁;马平川;姜政伟;刘俊荣;: "面向网络空间安全情报的知识图谱综述", 信息安全学报, no. 05 * |
| 谢博;申国伟;郭春;周燕;于淼;: "基于残差空洞卷积神经网络的网络安全实体识别方法", 网络与信息安全学报, no. 05 * |
| 贾焰 等: "一种构建网络安全知识图谱的实用方法", ENGINEERING, vol. 04, no. 01, pages 59 - 67 * |
| 高见;王安;: "基于本体的网络威胁情报分析技术研究", 计算机工程与应用, no. 11 * |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114301795A (en) * | 2021-11-15 | 2022-04-08 | 南京翌淼信息科技有限公司 | Network data security identification method and system |
| CN114301795B (en) * | 2021-11-15 | 2023-12-01 | 深圳市乐数科技有限责任公司 | Network data security identification method and system |
| CN114884686A (en) * | 2022-03-17 | 2022-08-09 | 新华三信息安全技术有限公司 | PHP threat identification method and device |
| CN114884686B (en) * | 2022-03-17 | 2024-03-08 | 新华三信息安全技术有限公司 | PHP threat identification method and device |
| CN114915539A (en) * | 2022-05-20 | 2022-08-16 | 电子科技大学 | SDN flow rule conflict fault detection method based on knowledge graph |
| CN114915539B (en) * | 2022-05-20 | 2023-07-28 | 电子科技大学 | SDN flow rule conflict fault detection method based on knowledge graph |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113591077B (en) | 2024-03-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111552855B (en) | Network threat information automatic extraction method based on deep learning | |
| CN111523119B (en) | Vulnerability detection method and device, electronic equipment and computer readable storage medium | |
| CN113591077B (en) | Network attack behavior prediction method and device, electronic equipment and storage medium | |
| CN113596007B (en) | Vulnerability attack detection method and device based on deep learning | |
| Long et al. | Collecting indicators of compromise from unstructured text of cybersecurity articles using neural-based sequence labelling | |
| CN114330322A (en) | Threat information extraction method based on deep learning | |
| US20220414228A1 (en) | Methods and systems for natural language processing of graph database queries | |
| CN111931935B (en) | Network security knowledge extraction method and device based on One-shot learning | |
| Ra et al. | DeepAnti-PhishNet: Applying deep neural networks for phishing email detection | |
| CN111709225B (en) | Event causal relationship discriminating method, device and computer readable storage medium | |
| Rajalakshmi et al. | Transfer learning approach for identification of malicious domain names | |
| Yang et al. | Automated cyber threat intelligence reports classification for early warning of cyber attacks in next generation SOC | |
| CN112699375A (en) | Block chain intelligent contract security vulnerability detection method based on network embedded similarity | |
| Sohrabi et al. | Topic modeling and classification of cyberspace papers using text mining | |
| Muslihi et al. | Detecting SQL injection on web application using deep learning techniques: a systematic literature review | |
| Nowroozi et al. | An adversarial attack analysis on malicious advertisement url detection framework | |
| Mondal et al. | A review of SQLI detection strategies using machine learning | |
| Chua et al. | Problem Understanding of Fake News Detection from a Data Mining Perspective | |
| CN116756327B (en) | Threat information relation extraction method and device based on knowledge inference and electronic equipment | |
| CN112966507A (en) | Method, device, equipment and storage medium for constructing recognition model and identifying attack | |
| CN115001763B (en) | Phishing website attack detection method and device, electronic equipment and storage medium | |
| Elnagar et al. | A cognitive framework for detecting phishing websites | |
| Thajeel et al. | Machine and deep learning-based xss detection approaches: a systematic literature review | |
| Yuliani et al. | Hoax news classification using machine learning algorithms | |
| Lin et al. | Novel JavaScript malware detection based on fuzzy Petri nets |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |