In the information extraction, information sources can be screened according to the characteristics of the target network at the present stage, and the knowledge graph generated thereby can play a role in assisting the security analysis of the general network or power grid control network, mobile Internet and other special networks. In the method proposed in this paper, knowledge reasoning is mainly based on the attack conditions and attack methods to reason about the success rate and return of the attack. Through the obtained quality information, map construction information extraction and reasoning are performed to realize the correlation analysis of the information, and the information processing results are stored in the graphic structure. When analyzing the alerts generated by IDS, it is necessary to solve the multi-source alarm format generated by various devices produced by different suppliers. The attack diagram constructs the attack mode to guide the defense side to take targeted defense measures, and the attack success rate is used to judge the defense priority of all network nodes. After completing the construction of the graph, the attack graph is generated for the specific network environment under the guidance of the knowledge graph. In the process of attack graph generation, attack method and attack condition of attack instance can be used to guide the match of pre-condition and post-condition, so as to find the attack path. Attack success rate and attack profit attribute can be used to assist subsequent risk analysis. After simulation tests, the timeliness and availability of the system are verified, and this makes a contribution to the grid network management.

中文翻译：

---

基于知识图谱的自动漏洞挖掘模型研究

在信息抽取中，可以根据现阶段目标网络的特点筛选信息源，由此生成的知识图谱可以起到辅助通用网络或电网控制网络、移动互联网安全分析的作用。和其他特殊网络。在本文提出的方法中，知识推理主要是根据攻击条件和攻击方式对攻击的成功率和回报进行推理。通过获取的质量信息，进行地图构建信息的提取和推理，实现信息的相关性分析，并将信息处理结果存储在图形结构中。在分析 IDS 生成的警报时，需要解决不同供应商生产的各种设备产生的多源告警格式。攻击图构造攻击模式，引导防御方采取有针对性的防御措施，攻击成功率用于判断所有网络节点的防御优先级。完成图的构建后，在知识图谱的指导下，针对特定的网络环境生成攻击图。在攻击图生成过程中，可以利用攻击实例的攻击方法和攻击条件来指导前置条件和后置条件的匹配，从而找到攻击路径。攻击成功率和攻击收益属性可用于辅助后续风险分析。经过仿真测试，验证了系统的及时性和可用性，