# A Knowledge Graph-Based Consistency Detection Method for Network Security Policies
## 6 Other Applications
### Reasonable Policy Correction and Use Case Design Based on Consistency Detection  
Firstly, the graph structure of the knowledge graph has the function of easily and intuitively recording node paths, which enables the automated process of using the knowledge graph for policy consistency detection to be recorded in the graph. Management personnel can intuitively see the entire logical path of the detection process, so as to adjust the unreasonable aspects of the detection logic layer graph and logical dependency layer graph. Secondly, for semantic parsing functions with a unified definition and security knowledge layer graphs with a large amount of high-quality information, if there are multiple modifications to the relevant information of the detection logic layer graph and inconsistent consistency detection results of the policy are found, then the policy text itself may have ambiguity. If no matter how the relevant information of the network information layer graph is modified according to the actual situation, the policy cannot pass consistency detection, then the policy may have unreasonable aspects. In addition to the irrationality of the policy itself, there may also be conflicts between policies, which can be divided into shadowing, redundancy, exception, and correlation [22]. Conflict mining based on knowledge graphs is different from conflict mining based on policy trees. Conflict mining based on knowledge graphs will perform consistency detection and conflict mining at the same time. When two particular policies have the same detection path and result in the graph for all original log data, we can consider that there is shadowing or redundancy between these two policies. When two policies have the same detection path in the graph for all original log data, but the detection results are always opposite, we can consider that there is an exception between these two policies. When two policies always have an inclusion relationship in the detection path for all original log data, but the detection results are always opposite, we can consider that there is a correlation between these two policies. Finally, for the consistency check of running operational service security policies, it is often necessary to create well-designed test cases. The security knowledge layer graph can help us determine whether some test cases are effective or even generate good test cases. Generating test cases is a reverse engineering process to determine whether the test cases are effective. Here, we will only introduce the process of the former:  
1. The PoC or exploit of the attack feature events generates traffic in the network environment and traverses and matches the attack feature events in the network information layer graph. 2. Feature extraction for attack events can be performed as follows: (1) separate malicious nodes from other nodes; (2) extract all possible types of network basic events; (3) calculate the farthest distance from a malicious node to other nodes; (4) analyze the ring information and temporal information of events in the graph; (5) extract circular event sequence information and general event sequence information separately; (6) encapsulate the above information (including maximum distance, starting node, key event, event chain path, event chain loop logic, and other information in a five tuple data) and store it in the message queue. 3. Feature matching is performed in the security knowledge layer graph, and attack event mining is carried out to obtain single-step attack events. Aggregating single-step attack events in the graph can obtain multi-step attack events. For attack event mining perform the following steps: (1) extract quintuple data from the message queue; (2) set time window and other search parameters; (3) search for suspicious nodes; (4) identify malicious nodes and record attack events. 4.