# A Knowledge Graph-Based Consistency Detection Method for Network Security Policies
## 5 Consistency Detection
```
Input: ID //policy number, \(GRAPH_{net}\) //Network Information Layer graph, \(GRAPH_{sc}\) //Security Knowledge Layer graph, \(GRAPH_{det}\) //Detection of Logical Layer graph, \(GRAPH_{log}\) //Logical Dependency Layer graph Output: ConsistencyTestResults //1 means the test is passed, 0 means the test is not passed
1 EventSequence, Response = match(n:policypolicyID:\"ID\") IN \(GRAPH_{det}\) return n.EventSequence, n.Response //See 2 and 3 for their form; EventSequence = \(e_{1}\)(\(x_{11}\),\(x_{12}\),...,\(x_{1}\)),...)|CondExp, \(e_{2}\)(\(x_{21}\),\(x_{22}\),...,\(x_{2j}\),...)|CondExp, \(\ldots,e_{i}\)(\(x_{i1}\),\(x_{i2}\),...,\(x_{ij}\)...)|CondExp, \(\ldots,e_{m}\)(\(x_{m1}\),\(x_{m2}\),...,\(x_{mj}\),...)|CondExp; Response = determine()//determine(\(Results_{m}\)) is bool; escape(), Def = match(n:policy dependencyID:\"ID\") IN \(GRAPH_{log}\) return n.Escape, n.Response //See 5 and 6 for their form; \(x_{unknown}\) = escape(\(x_{know}\))//predefined escape functions; Def = \(y_{1}\),\(y_{2}\),...,\(y_{k}\) //predefined default information; for\(e_{i}\) in EventSequence  for\(x_{ij}\) in \(e_{i-unknownparameters}\)//\(e_{i-unknownparameters}\) = \((x_{i1}\),\(x_{i2}\),...,\(x_{ij}\),...)do if\(x_{ij}\) IN \(GRAPH_{net}\), \(GRAPH_{sc}\)then match \(x_{ij}\) IN (\(GRAPH_{net}\), \(GRAPH_{sc}\)); elseif\(x_{ij}\) IN Defthen match \(x_{ij}\) IN Def; else\(x_{ij}\) = escape()//escape() relies on query computation in (\(GRAPH_{net}\), \(GRAPH_{sc}\));  end if
10 end for Go \(e_{i}\)(\(x_{i1}\),\(x_{i2}\),...,\(x_{ij}\),...)|CondExp//implementing Cypher syntax for BMSL-like languages;
11 end for Get \(Results_{m}\) = \(e_{m}\)(\(x_{m1}\),\(x_{m2}\),...,\(x_{mn}\))|CondExp; ConsistencyTestResults=determine(\(Results_{m}\))//consistency test result; return
```  
**Algorithm 1**Algorithm for consistency detection of a single policy. For consistency detection of combination policies, based on the logical relationships between sub-policies in the detection logic layer graph, and after completing the detection of sub-policies, the detection results of the sub-policies are combined to form the detection result of the combination policy. Here is a simple example of policy detection logic. The text description of the policy is 'All entrance and exit cameras in the computer room must have night vision function'. Let us first input some necessary information into the knowledge graph. For physical security policies, the network information layer graph focuses on the physical space of the policy and the information of network hardware in that physical space. So, we collected the actual situation and added nodes and relationships as shown in Figure 3 to the network information layer graph. For hardware-related physical security policies, the security knowledge layer graph focuses on hardware information related to the policy, which comes from the operating manuals of various hardware manufacturers or existing knowledge graphs in related fields. Therefore, we collected this information and added nodes and relationships, as shown in Figure 4, to the security knowledge layer graph. Figure 4: Case study of security knowledge layer graph. Figure 3: Case study of network information layer graph. The logical dependency layer graph focuses on semantic parsing functions and default information. For this policy, the semantic parsing function to be utilized is to systematically explain the natural language structure of \"hardware x should have y function\". Functions can be written to implement the following functions: if the y function associated with hardware x is not in the network information layer graph and the y function associated with hardware x is in the security knowledge layer graph, find the function associated with y function in the security knowledge layer graph using the \"'include' regularization form\".