面向网络安全事件的事理图谱构建方法研究
Research on Constructing Method of Event Evolutionary Graph for Cybersecurity Events

网络安全形势近年来呈现复杂化、广泛化等特点，对响应决策提出更高要求。现有的网络安全知识图谱只能提供静态的专业知识，无法呈现网络安全事件的动态演变。事理图谱通过追踪分析事件演化路径能为网络安全领域提供更好的决策支持。本文基于网络安全事件特征和相关标准分类构建了事理本体模型，采用模板匹配与依存句法分析获取事件表达，进行事件与事件关系抽取，并使用Gephi工具可视化呈现网络安全事理图谱。最后基于事理图谱数据实现网络安全态势预测和响应方案等决策支持。网络安全事理图谱能有效呈现网络安全事件演化的可能性，能为网络安全治理和应急响应决策提供一定参考。本文面向网络安全事件构建事理图谱，扩大了事理图谱的应用领域。
The situation of cybersecurity has become complicated and extensive in recent years, which puts forward higher requirements for response decision-making. The existing cybersecurity knowledge graph can only provide static expertise, but cannot present the dynamic evolution of cybersecurity events. Event evolutionary graph provides better decision support for cybersecurity by tracking and analyzing event evolution path. First, the event ontology model was constructed based on the characteristics of cybersecurity events and related standard classification, then the event expression was obtained by using template matching and dependency parsing to extract event and event relationship, and the cybersecurity event evolutionary graph was visualized by using Gephi. Finally, the decision support of cybersecurity situation prediction and response scheme were realized based on the event evolutionary graph data. The cybersecurity event evolutionary graph can effectively present the possibility of the evolution of cybersecurity events, and provide some reference for cybersecurity governance and emergency response decision-making. This paper builds the event evolutionary graph based on cybersecurity events which expands its application field.