网络与信息安全学报 ›› 2023, Vol. 9 ›› Issue (6): 116-126.doi: 10.11959/j.issn.2096-109x.2023087

• 学术论文 • 上一篇    

基于知识图谱的网络安全事件数据推荐算法

祝现威, 刘伟, 刘自豪, 顾泽宇   

  1. 中国人民解放军61660部队，北京 100080
  • 修回日期:2023-11-10 出版日期:2023-12-01 发布日期:2023-12-01
  • 作者简介:祝现威（1991- ），男，河南虞城人，中国人民解放军 61660 部队工程师，主要研究方向为SDN安全、知识图谱、云计算安全
    刘伟（1982- ），男，河北邯郸人，中国人民解放军61660部队高级工程师，主要研究方向为网络安全、知识图谱、指挥控制
    刘自豪（1993- ），男，湖北十堰人，中国人民解放军61660部队助理工程师，主要研究方向为网络安全、知识图谱
    顾泽宇（1993- ），男，山东滨州人，中国人民解放军61660部队助理工程师，主要研究方向为网络安全、态势感知

Data recommendation algorithm of network security event based on knowledge graph

Xianwei ZHU, Wei LIU, Zihao LIU, Zeyu GU   

  1. The 61660 Unit of PLA, Beijing 100080, China
  • Revised:2023-11-10 Online:2023-12-01 Published:2023-12-01

在线阅读

26

pdf下载

103

摘要：

针对网络安全运维人员分析网络安全事件时难以及时准确找出所需的数据问题，提出基于知识图谱的网络安全事件数据推荐算法，利用网络威胁框架 ATT＆amp;CK 构造本体模型，根据本体模型建立网络威胁知识图谱，将攻击技术、漏洞、防御措施等离散的安全数据提炼为互相关联的安全知识。基于知识图谱提取实体数据，通过 TransH 算法进行实体向量化，并利用实体向量计算网络威胁数据实体间数据相似性。获取网络安全事件处置文献中网络安全数据实体作为运维人员处置行为，构造处置行为矩阵，通过行为矩阵实现网络威胁数据向量化表示，计算基于处置行为的网络威胁数据实体相似性。将网络威胁数据实体的相似度与基于处置行为的网络威胁数据实体的相似度进行融合，形成面向网络安全事件的数据推荐列表，实现基于用户行为的网络威胁领域间的关联。实验分析表明，在融合权重α=7和推荐数据量K=5时，所提算法最优，召回率和精确率分别为62.37%和 68.23%。所提算法在数据相似度的基础上加入了处置行为相似度，更接近事实处置行为，与其他算法相比，所提算法的召回率具有较大优势，精确率在推荐数据量小于10的范围内具有较大优势。

关键词: 网络威胁数据, 网络安全事件, 知识图谱, 相似度, 事件处置行为, 数据推荐

Abstract:

To address the difficulty faced by network security operation and maintenance personnel in timely and accurate identification of required data during network security event analysis, a recommendation algorithm based on a knowledge graph for network security events was proposed.The algorithm utilized the network threat framework ATT＆amp;CK to construct an ontology model and establish a network threat knowledge graph based on this model.It extracted relevant security data such as attack techniques, vulnerabilities, and defense measures into interconnected security knowledge within the knowledge graph.Entity data was extracted based on the knowledge graph, and entity vectors were obtained using the TransH algorithm.These entity vectors were then used to calculate data similarity between entities in network threat data.Disposal behaviors were extracted from literature on network security event handling and treated as network security data entities.A disposal behavior matrix was constructed, and the behavior matrix enabled the vector representation of network threat data.The similarity of network threat data entities was calculated based on disposal behaviors.Finally, the similarity between network threat data and threat data under network security event handling behavior was fused to generate a data recommendation list for network security events, which established correlations between network threat domains based on user behavior.Experimental results demonstrate that the algorithm performs optimally when the fusion weight α=7 and the recommended data volume K=5, achieving a recall rate of 62.37% and an accuracy rate of 68.23%.By incorporating disposition behavior similarity in addition to data similarity, the algorithm better represents factual disposition behavior.Compared to other algorithms, this algorithm exhibits significant advantages in recall rate and accuracy, particularly when the recommended data volume is less than 10.

Key words: network threat data, network security events, knowledge graph, similarity, event handling behavior, data recommendation

中图分类号: 

No Suggested Reading articles found!