# A Knowledge Graph-Based Consistency Detection Method for Network Security Policies
## 2 Background and Related Work  
Security policy is the cornerstone of the security threat defense system, and has been the focus of many researchers since the 1990s. In 1992, [PERSON] and [PERSON], etc., added an intermediate step to the object-oriented method model based on extended entity relationship styles for the process of transforming security policies from natural language expression to axiomatic form [7]. This is one of the earlier attempts at formalizing policies, and its approach aligns well with knowledge graph methods. In 1993, [PERSON] and [PERSON] proposed a formal method for testing the logical consistency of composite security policies [8]. In 1997, [PERSON] and [PERSON] proposed a method for inferring security policy attributes and developed a security policy consistency checking tool based on Prolog [9]. [PERSON], [PERSON] and [PERSON], [PERSON] et al. proposed and improved the Behavior Monitoring Standard Language (BMSL) in 1999 and 2003, respectively [10; 11]. The BMSL method can be extended to many fields of network security, and this article also refers to the use of this method. In 2008, [PERSON] and [PERSON] designed and implemented a system for formally specifying and verifying security policies [12]. In 2014, [PERSON] and [PERSON], etc., proposed a program that can synthesize an automaton to implement a given security policy [13]. In 2015, [PERSON] and [PERSON], etc., proposed a method for static detection when formulating and modifying policies: the method of dynamic detection during system operation [14]. The attempts of these automated systems for verifying security policies provide many ideas for detecting classification and detection methods. In 2022, [PERSON] and [PERSON], etc., proposed a constraint-based access control policy security analysis framework to conduct security analysis on access control policies [15]. This is a good formal framework, but it only focuses on a single access control issue. Although the research results on security policies mentioned above are abundant, most of these studies focus on the theoretical level of policy design and conflict resolution. There is a lack of intelligent means for consistency detection. At the same time, the formal methods of policies are not only diverse, but also have significant differences in methods for different security domains, without a relatively unified logical approach.  
Although the concept of the knowledge graph originated early, it was not officially proposed by Google until 2012 [16]. Subsequently, the development of knowledge graph technology has been rapid, with methods gradually becoming more diverse and the system gradually maturing. In 2021, [PERSON] et al. provided a systematic system introduction and technical summary for knowledge graphs [17]. While knowledge graphs are widely used in engineering practice, some researchers have also applied knowledge graphs in the field of network security. In 2016, [PERSON] and [PERSON] described CyGraph, a system used to improve network security posture and maintain situational awareness in the face of network attacks [18]. Their system fully utilizes knowledge graph technology, integrating network configuration, vulnerability attack knowledge base, and network situational analysis into the knowledge graph. This idea is excellent and is one of the earliest practices to integrate knowledge graph technology into the practical field of network security. In 2018, [PERSON] and [PERSON], etc., improved the technical details of the automatic production of attack graphs [19]. This knowledge graph reasoning, like technique, can be extended to consistency detection of security policies, obtaining graph paths of device configurations, raw data, use cases, etc., that match security policies. In 2020, [PERSON] and [PERSON] et al. investigated the performance of BERT models in named entity recognition tasks in the field of network security and explored a new data augmentation approach to accomplish entity recognition tasks [20].