# A Knowledge Graph-Based Consistency Detection Method for Network Security Policies
## 5 Consistency Detection  
The common detection behaviors of security policies in natural language form include rule-based matching detection; feature-oriented test case classification detection; real-time monitoring and detection. The characteristics of the three detection behaviors are as follows:  
* Rule-based matching detection: by leveraging the experience and knowledge of experts, the strategic objectives are transformed into specific target configuration rule libraries. During detection, the actual configurations are brought into the rule libraries and matched one by one. * Feature-oriented test case classification detection: by predefining and writing reasonable test cases for the target policy requirements that need to be detected, the test cases can be applied to real or simulated environments, and compare the differences between the real results and expected results of the test cases can be compared. * Real-time monitoring and detection: the real-time system configuration information, and operational status are collected through product logs, traffic monitoring, and other methods, and the impact of abnormal information is compared with policy requirements. In the automated consistency detection based on knowledge graph policy, cypher statements can be used to determine whether the rule set is satisfied, find test case paths, and monitor data comparison in real time. The results of such cypher statements can be judged as to whether they are the expected results, and the response can be obtained. This can quickly and accurately link security policies with detection behavior, and obtain detection results through highly formalized judgment conditions. The automated process for single policy consistency detection is as follows:  
1. Query the logical dependency layer graph to obtain the detection target and detection criteria-related semantic parsing functions \(x_{unknown}\) = Semantic-Parsing (\(x_{know}\)) and default information Def = \(y_{1}\), \(y_{2}\),..., \(y_{m}\) for the policy text. 2. Locate the position of the event sequence and response of the target policy in the detection logic layer graph through the policy sequence number. 3. Obtain the parameters \(x_{1}\), \(x_{2}\),..., \(x_{n}\) for event = e (\(x_{1}\), \(x_{2}\),..., \(x_{n}\)) in the event sequence, which come from three parts: one part directly from the network information layer graph or security knowledge layer graph, which usually appears in the form of constants A portion of the semantic parsing functions that need to be obtained through Step 1 are calculated from the network information layer graph or security knowledge layer graph, which is known as \(x_{unknown}\) = Semantic-Parsing (\(x_{know}\)). \(x_{know}\) are the data that can be directly queried from the network information layer graph or security knowledge layer graph. The semantic parsing function Semantic-Parsing() often relies on query calculations in the security knowledge layer graph. Another part is the default information obtained in Step 1, which is \(x_{unknown}\in\) Def. 4. According to the operator logic in the event sequence, execute the cypher statements of the event in sequence in neo4j, and complete policy consistency detection through the judgment conditions of the response. The algorithm representation of the above process is shown in Algorithm 1.