# A Knowledge Graph-Based Consistency Detection Method for Network Security Policies
## 4 Construction of Knowledge Graph
### Security Knowledge Layer Graph  
The data sources of the security knowledge layer graph include the attack dimension, and asset dimension, vulnerability dimension. The data source can come from public databases, encyclopedias, blogs, technical manuals, etc. Considering that semi-structured data sources are more conducive to knowledge extraction, simple crawling methods can achieve good results. Therefore, it is recommended to use existing knowledge bases or rule bases, such as the attack behavior knowledge base ATT&CK and the general attack pattern enumeration and classification knowledge base CAPEC; the general platform enumeration database CPE for asset dimension; the public vulnerability and exposure database CVE and the common vulnerability enumeration database CWE for vulnerability maintenance, various compiled blog tables, official technical manuals for various devices and software, etc.  
The construction of a security knowledge layer graph requires entity recognition, knowledge extraction, and knowledge fusion. There are many methods for entity recognition and knowledge extraction in the field of network security, such as automated network security entity annotation methods, supervised entity extraction methods based on security related corpus annotation, and network security entity relationship extraction methods that combine semi-supervised natural language processing and bootstrapping algorithms [21]. These methods all have good results. However, there are not many methods available  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Policy Type** & **Important Information in the Policy** \\ \hline \multirow{3}{*}{physical security policy} & The location, model, parameters, functions, logs, \\  & environmental sensor records and manual records of the \\  & equipment, personnel management and usage relationships \\  & of the equipment, etc. \\ \hline \multirow{5}{*}{operational service security policy} & The type of device, the IP address of the device in the \\  & network, the MAC address of the network card where the \\  & device is located, the open ports and possible services that \\  & the device may run, the operating system type of the device, \\  & all possible CPE information on the device, the \\  & vulnerabilities and risks of the device, the network segment \\  & where the device is located, etc. \\ \hline \multirow{3}{*}{data security policy} & Objects at all levels of classified permission management; \\  & the process, effectiveness, potential risks, etc., of encrypted \\ \cline{1-1}  & communication \\ \hline \multirow{3}{*}{content security policy} & Version, parameters, functions, efficiency, audit rules, audit \\  & use cases, etc., of content audit software \\ \hline \hline \end{tabular}
\end{table}
Table 1: Some important information involved in the four types of policies in the network information layer graph.  
for knowledge fusion in the field of network security, due to the large scale of the corpus, diverse data sources, and different data sources with different focuses. The most important aspect of knowledge fusion is entity alignment, and the most common method of entity alignment is based on similarity function feature matching to achieve alignment. As there is currently no universal similarity function for entity alignment in the field of network security, this paper adopts a method of weighting iteration by mixing multiple text similarity functions for entity alignment to achieve acceptable accuracy.