基于知识图谱推理的网络攻击识别方法  

Cyber Attack Identification Method Based on Knowledge Graph Reasoning

作　　者：张雅雯 张玉臣[1] 吴越 李程[1] ZHANG Yawen;ZHANG Yuchen;WU Yue;LI Cheng(Information Engineering University,Zhengzhou 450001,China)

机构地区：[1]信息工程大学,河南郑州450001

出　　处：《信息工程大学学报》2023年第4期492-498,共7页Journal of Information Engineering University

摘　　要：针对在海量网络数据中识别网络攻击的问题,运用知识图谱推理能力,提出了基于知识图谱推理的网络攻击识别方法。首先利用Turtle文件解析算法将ttl格式文件解析为能够应用于知识嵌入模型的形式;其次,构建系统状态本体,为不同的系统状态实例提供统一的上层描述,提高利用网络安全知识图谱分析系统状态的可行性;最后,利用基于TransH模型得到图模型中的各类实例数据的嵌入表示,并从候选攻击模式中推理潜在的网络攻击行为。通过实验进一步验证了所提方法的可行性和有效性。To identify cyber attacks in massive network data,a cyber attack identification method based on knowledge graph reasoning is proposed by using the ability of knowledge graph reasoning.First,the TTL file is parsed into a form that can be applied to the knowledge embedding model using Turtle file parsing algorithm.Second,the system state ontology is constructed to provide a unified upper level description for different system state instances,which improves the feasibility of using cyber security knowledge graph to analyze system state.Finally,the embedded representation of each type of instance data in the graph model is obtained based on the TransH model,and the potential cyber attack behaviors are inferred from the candidate attack patterns.The feasibility and effectiveness of the proposed method are further verified by experiments.

关 键 词：攻击识别 知识图谱 本体构建 知识嵌入 知识推理 

分 类 号：TN915.08[电子电信—通信与信息系统]