# A Knowledge Graph-Based Consistency Detection Method for Network Security Policies
## 6 Other Applications
### Intelligent Inference Based on Knowledge Graph for Reasoning Judgement  
The intelligent inference function of knowledge graph extension depends on the algorithm, and some applicable algorithms and their roles in the knowledge graph are as follows. The centrality algorithm is applied to detect the importance of each policy in the logic layer graph. The centrality algorithm is applied in the detection logic layer graph because each pair of nodes associated with a policy number in the graph corresponds to a policy. By individually or comprehensively using centrality, intermediate centrality, and proximity centrality indicators, the centrality of each node in the graph can be calculated. In other words, the larger the centrality value of a node, the more it is connected to other nodes. The policy corresponding to that node is more widely connected in all of our policies and is more likely to become a sub-policy of a composite policy or a pre-policy of a large number of policies. The importance level can be used as an entity attribute annotation in the detection logic layer graph, helping us to prioritize finding possible sub-policies or pre-policies when clarifying the logical relationships between sub-policies of a combination policy. In practice, batch detection of a large set of policies can save a lot of time by prioritizing the detection of highly important policies. The graph propagation algorithm is applied to detect the distributed features of policies and network topology in the logic layer graph and network information layer graph. The graph propagation algorithm does not have a clear paradigm or goal. In practice, it uses a labeled graph propagation algorithm that aims to discover overlapping communities. This graph propagation algorithm can find highly concentrated nodes (entities) in the detection logic layer graph and the network information layer graph. Nodes within the community are highly connected, but their connections with other nodes in the graph are relatively rare. In some tasks outside the focused community, the differences between all nodes in a community can be considered small as a whole. In some tasks within the focused community, the relationship between \"in\" and \"out\" communities can be extended to all nodes in the community. In the detection logic layer graph, the graph propagation algorithm can discover the detection subject community of the policy, discover a class of detection subjects with similar detection targets, and their detection processes will have similarities. They can call a few detection cases with different parameters or configuration controls to complete their detection logic writing and detection operations in batches. Similarly, it is possible to discover the detection target community of the policy, discover a class of detection targets with similar detection subjects, and complete the detection in batches. Long-term memory can be achieved by adding the class numbers that can be batch detected as attributes to the entity attributes of the detection logic layer graph. The application in the network information layer graph is also similar; finding a similar attack method, a device model with the same characteristics, a vulnerability with the same principle, etc., can all be propagated using this graph algorithm. Introduce standards in the security knowledge layer graph and network information layer graph, and apply the rule-based inference algorithm AMIE to conduct risk assessment of network situation. Risk assessment of network situation can compare the vulnerability set, attack feature set, security event set, and other existing vulnerability sets in the security knowledge layer graph to predict the network nodes or dangerous data flows that may encounter security risks in the future in the network information layer graph. If these potential security risk network nodes or dangerous data flows are under the concern of our policy, then labeling them before detection and conducting key detection can achieve prevention in advance.