面向应急响应决策支持的网络安全事理图谱检索机制研究

Research on Retrieval Mechanism of Cybersecurity Event Evolutionary Graph for Emergency Response Decision Support

摘要: 传统网络安全应急决策主要依赖于安全管理人员个人经验积累，缺乏必要系统的知识支撑，难以应对复杂的网络安全新形势。事理图谱技术的引入可以在应急响应各阶段提供更高效决策支持。本文针对事理图谱中的事件检索机制进行研究，在网络安全事件知识表示建模的基础上，采用BERT-wwm-ext模型进行事件要素的向量化语义处理，并提出将余弦相似度计算和动态规划相结合的方法进行事件相似度计算，实现了高关联事件的快速准确检出。研究还结合PDCERF应急响应流程提出了基于事理图谱的网络安全响应决策支持应用框架。本文研究成果对于事理图谱技术在网络安全领域的应用提供了基本思路和实现方法。

Abstract: Traditional cybersecurity emergency decision-making primarily relies on the accumulated personal experience of security personnel, lacking systematic knowledge support, which makes it difficult to cope with the complex new cybersecurity landscape. Event evolutionary graph technology can provide more efficient decision support at various stages of emergency response. This paper focuses on the event retrieval mechanism in the event evolutionary graph. Based on the knowledge representation modeling of cybersecurity incidents, the BERT-wwm-ext model is employed for vectorized semantic processing of event elements. Additionally, a method combining cosine similarity calculation and dynamic programming is proposed for event similarity computation, enabling rapid and accurate detection of highly correlated events. The paper also presents a decision support application framework for cybersecurity response, aligned with the PDCERF emergency response process. This paper provides fundamental ideas and implementation methods for applying event evolutionary graph technology in the cybersecurity domain.