# A Knowledge Graph-Based Consistency Detection Method for Network Security Policies
## 4 Construction of Knowledge Graph
### Detecting Logic Layer Graph  
The essence of building a detecting logic layer graph is to transform policy texts in natural language form into formal specification expressions. This article builds a knowledge graph based on the open-source neo4j database and proposes a formal language similar to BMSL (Behavior Monitoring Specification Language) that combines Cypher syntax.  
For a natural language security policy, it can be expressed in the following form:  
\[\text{Event Sequence - Response} \tag{1}\]  
Among them, the event sequence represents the set of detection behaviors corresponding to the security policy, and each detection behavior is called an event. An event takes the form of \(\text{e}(x_{1},x_{2},\ldots,x_{n})\), where \(\text{e}\) is a defined function with Cypher syntax features, and \(x_{1},x_{2},\ldots,x_{n}\) are the parameters of the function.  
An event can be formed into an event sequence through a series of operators, with the main operators defined as follows: the \"\(\,\mid\,\)\" operator is used to separate event and condition, in the form of \(\text{e}(x_{1},x_{2},\ldots,x_{n})\,\text{|}\,\text{CondExp}\). Among them, CondExp is a Boolean expression. The \"\(\,\cdot\,\)\" operator represents a sequence relationship, and \(e_{1}\,e_{2}\) represents a sequence composed of events \(e_{1}\) and \(e_{2}\) with sequential execution order. The \"\(\,\)\" operator represents the closure relationship, and \(e_{1}\,\)\"\(e_{2}\) represents the execution of events \(e_{1}\) and \(e_{2}\) in any order. The \"\(\,\mid\,\)\" operator represents the relationship between or, and \(e_{1}\,\mid\,\)\" represents the execution of event \(e_{1}\) or event \(e_{2}\). The \"\(\,\)\" operator represents a relationship of no, in the form of \(:!(\text{e}(x_{1},x_{2},\ldots,x_{n})\,\text{|}\,\text{CondExp})\), indicating an event that does not match \(\text{e}(x_{1},x_{2},\ldots,x_{n})\,\text{|}\,\text{CondExp}\).  
The response is essentially a statement of judgment and a '0/1' result. According to the requirements of the security policy, when all behaviors in the event sequence occur in the predetermined order, the result is usually in compliance or non-compliance with the policy. In case of non-compliance with the policy, the situation can also be divided in detail, such as disabling relevant device or personnel permissions, sending alerts or login logs to administrators, etc.  
For a single policy text, formalizing the policy text will result in an \"event sequence\" and a \"response measure\", which can be understood as executing the \"response measure\" when the \"event sequence\" is detected. In the detection logic layer graph, the following four entities are defined: \"policy text\", \"event sequence\", \"response measure\", and \"event\". The \"policy text\" establishes a relationship with its formalized \"event sequence\" and \"response measure\". By linking the \"event sequence\" and \"response measure\" with a relationship identified by the policy sequence number, they can be stored in the knowledge graph. A'sequence of events' usually consists of multiple events, which can be linked to the'sequence of events' in a knowledge graph using a one-way arrow relationship. For related combination policy texts, different \"policy texts\" can be linked together using relationships such as \"contain\" and \"belong\".  
The process of converting from natural language to event sequence is essentially a text2 cypher task. In professional fields such as policy detection, this task may have been tedious in the past, but now, using a \"universal big language model+prompt engineering\" can easily accomplish this task. The open-source GraphRAG is a great tool for this. By asking questions, the natural language policy text is handed over to GraphRAG, which not only provides the result of the question but also the specific query path of this policy in the graph. Through a simple script, the query path can be persisted into a cypher statement. These cypher statements combined together form the event sequence we need.