Construction of network security domain knowledge graph for network attack detection

The introduction of knowledge graph technology in the field of network security can enable network security personnel to better grasp the network security situation, detect network attacks, analyze and determine the network attack chain, and then take targeted preventive measures to continuously improve the security of network space. This paper proposes a method of constructing knowledge graph based on network security domain ontology. Aiming at the multi-source heterogeneous network security data, extracting the association relation and designing the network security domain ontology model. Through knowledge extraction of massive structured, semi-structured and unstructured data, the network security domain knowledge graph is constructed according to the top-down construction method, and the knowledge is stored, displayed and queried through the Neo4j graph database. The constructed domain knowledge graph implements association analysis of multi-source heterogeneous data from six dimensions of network security-related, including asset dimension, attack dimension, vulnerability dimension, weakness dimension and alarm dimension, laying a foundation for network attack analysis and detection.