Font Size: a A A

Software Security Knowledge Graph Completion Based On Relation Reasoning

Posted on:2020-07-17Degree:MasterType:Thesis
Country:ChinaCandidate:H B XiaoFull Text:PDF
GTID:2518306518963119Subject:Software engineering
Abstract/Summary:PDF Full Text Request
Software security knowledge involves heterogeneous security concepts(e.g.,software weaknesses and attack patterns)and security instances(e.g.,the vulnerabilities of a particular software product),which can be considered as software security entities.There are many within-type relations as well as many across-type relations among software security entities.Reasoning software security entity relations helps to enrich software security knowledge and explain emergent entities.Unfortunately,software security entities are currently documented in separate databases,which can not support effective reasoning of software entity relations.In addition,the existing security knowledge lacks of the specific relations between software vulnerabilities and attack patterns.To solve the above problems,this paper constructs and completes software security knowledge graph based on three security databases and reasons missing and unknown relations.Firstly,software security knowledge graph is constructed based on relation extraction.This paper proposes to consolidate heterogeneous software security concepts and instances in separate databases into a coherent knowledge graph and design experiments to evaluate the impact of this knowledge heterogeneity on the performance of software security entity relation reasoning.Secondly,missing relations in software security knowledge graph are completed based on knowledge graph embedding.This paper develops a knowledge graph embedding method which embeds the symbolic relational and descriptive information of software security entities into a continuous vector space.The resulting entity and relation embeddings can support the missing relation reasoning among software security entities.Thus we can complete missing relations in the software security knowledge graph.Based on the Open World Assumption,this paper conducts extensive experiments to evaluate the effectiveness of this approach for the missing relation reasoning among existing and new software security entities.Last but not least,unknown relations in software security knowledge graph are completed based on random walk.This paper develops a random walk method to calculate the correlation between software vulnerabilities and attack patterns.And the software vulnerability and attack pattern triples are linearly classified based on the correlation of them.Thus we can complete unknown relations in the software security knowledge graph.Experiments show that this approach can effectively reason the vulnerability exploitation relation.In conclusion,this paper completes software security knowledge graph based on missing and unknown relation reasoning respectively.Extensive experiments show the effectiveness of the proposed approaches.The effective completion of software security knowledge graph can help analysts in enriching software security knowledge.
Keywords/Search Tags:Software security entity and relation, Knowledge graph embedding, Relation reasoning, Random walk
PDF Full Text Request
Related items