# A Knowledge Graph-Based Consistency Detection Method for Network Security Policies
## 5 Consistency Detection
This function can be used to search for the three sub-functions of \"night vision function\" in the security knowledge layer graph, namely \"visible night vision\", \"infrared night vision\", and \"thermal imaging night vision\". These are represented using cypher-like statements, as follows:  
match(n:surveillance_camera_projects_knowledge)-[:include]->(m: surveillance_camera_projects_knowledge)wheren.name=\" exfunction_night_vision\"returnm; The detection logic layer graph focuses on the construction of formal language, executing semantic parsing functions in the logical dependency layer, and finding the three sub-functions of \"night vision function\". After formalizing the policy text, the event sequence and response measures obtained are the following:  
Event1: match(n:door)-[:locate_door_camera]->(a:camera)wheresum(a. exfunction_visible_night_vision,a.exfunction_infrared_night_vision,a.exfunction_thermal_imaging_night_vision)>=1 returna; Event2:match(n:door)-[:locate_door_camera]->(b:camera)returnb; EventSequences:Event1*Event2; Response:ifa==breturn1 elsereturn0; By following the rules to execute the event sequence and response measures, consistency detection can be completed. Examples of common security policy language descriptions and corresponding event sequence and response are as follows. These examples demonstrate the feasibility of using cypher-like statements to represent policies. For the policy \"Device A has disabled protocol B\", the corresponding cypher statement is as follows:  
Event1: match(n:equipment)-[:Disable_Protocol]->(m:Protocol)wheren.name=\"A\"ANDm.name=\"B\"returnm;//NetworkInformationLayer Graph EventSequences:Event1 Response:ifEvent1.result==NULLreturn\"no\"elsereturn\"yes\"// Rule-basedMatchingDetection For the policy \"Device A needs to complete action C every time T\", the corresponding cypher statement is as follows:  
Event1:match(n:equipment)-[:execute]->(m:action)wheren.name=\"A\" ANDm.name=\"C\"returnm.Log_location;//NetworkInformation LayerGraph EventSequences:Event1; Response:Time_interval_query_script(Event1.result,T)//Feature-OrientedTestCaseClassificationDetection For the policy \"Device A can support function E by monitoring status information D\", the corresponding cypher statement is as follows:  
Event1:match(n:equipment)-[:monitor_information]->(m:information)wheren.name=\"A\"ANDm.name=\"D\"returnm;//NetworkInformation LayerGraph Event2:match(n:equipment)-[:have_function]->(m:function)wheren. name=\"A\"ANDm.name=\"E\"returnm;//NetworkInformationLayer GraphEvent3: match(n: function)-[: supported]-> (m: information) where n. name=\"E\" AND m.name=\"D\" return m ;// Security Knowledge Layer Graph Event Sequences: Event! * Event2* Event3 Response: if Event!.result!=NULL AND Event2.result!=NULL AND Event3.result!=NULL return \"yes\" else return \"no\" //Rule-based Matching Detection For the policy \"Device A can work normally under the condition of temperature T\", the corresponding cypher statement is as follows: Event1: match(n:equipment)-[: require]-> (m:use_condition) where n. name=\"E\" return m ;// Security Knowledge Layer Graph Event Sequences: Event1 Response: if Event!.result.min_temperature<-T<=Event1.result. max_temperature return \"yes\" else return \"no\" //Rule-based Matching Detection For the policy \"Personnel H cannot access database I\", the corresponding cypher statement is as follows: Event1: match(n:personnel)-[:allow_access_to]-> (m:database) where n. name=\"H\" AND m.name=\"I\" return m ;// Network Information Layer Graph Event Sequences: Event!