信息网络安全

信息网络安全 ›› 2025, Vol. 25 ›› Issue (10): 1615-1626.doi: 10.3969/j.issn.1671-1122.2025.10.012

• 技术研究 • 上一篇    下一篇

基于图神经网络的网络资产主动识别技术研究

李涛1,2,3(), 程柏丰1   

  1. 1.东南大学网络空间安全学院，南京 211189
    2.网络通信与安全紫金山实验室，南京 211189
    3.东南大学移动信息通信与安全前沿科学中心，南京 211189
  • 收稿日期:2024-12-30 出版日期:2025-10-10 发布日期:2025-11-07
  • 通讯作者: 李涛 E-mail:lit@seu.edu.cn
  • 作者简介:李涛（1984—），男，江苏，副教授，博士，主要研究方向为信息系统安全、可信计算、内生安全|程柏丰（1997—），男，黑龙江，硕士研究生，主要研究方向为网络空间安全
  • 基金资助:
    国家自然科学基金(61601113)

Research on Network Asset Identification Technology Based on Graph Neural Network

LI Tao1,2,3(), CHENG Baifeng1   

  1. 1. School of Cyber Science and Engineering, Southeast University, Nanjing 211189, China
    2. Network Communication and Security of Purple Mountain Laboratories, Nanjing 211189, China
    3. Frontiers Science Center for Mobile Information Communication and Security, Southeast University, Nanjing 211189, China
  • Received:2024-12-30 Online:2025-10-10 Published:2025-11-07
  • Contact: LI Tao E-mail:lit@seu.edu.cn

RichHTML

11

PDF (PC)

39

摘要：

网络资产是网络空间中某机构所拥有的一切可能被潜在攻击者利用的设备、信息、应用等数字资产的总和，因此对网络资产进行识别至关重要。为提高网络资产识别的效率和准确率，文章设计了一种基于图神经网络的识别模型，通过将资产响应报文转化为图结构，直观呈现各元素间的复杂关联性，并利用节点连接关系保留全局图信息。该模型包含3个组成部分，首先基于资产响应报文构建了包含3类节点和5类边的异质图，然后引入双级注意力机制训练两层图卷积神经网络，最后计算两类损失函数并得出最终识别结果。实验使用包含3000个网络资产响应报文的样本集进行训练，模型最终识别准确率达92.38%，较现有方法提升约5%，验证了该模型在资产识别任务中的有效性。

关键词: 响应报文, 异质图, 图神经网络, 网络资产识别

Abstract:

Network assets are the sum of all digital assets such as equipment, information and applications owned by an organization in cyberspace that can be used by potential attackers. It is very important to identify network assets. In order to improve the efficiency and accuracy of network asset recognition, this paper designed a network asset recognition model based on graph neural network, which representd the asset response message in the form of a graph. The model could intuitively express the relationship between various elements in the text, and could use the connection relationship between nodes to retain the global graph information. The model consisted of three parts. Firstly, a heterogeneous graph containing three types of nodes and five types of edges was constructed based on the asset response message, then a two-level attention mechanism was introduced to train the two-layer convolutional neural network, and finally two types of loss functions were calculated and the final recognition results were obtained. Experiments using a sample set of 3000 network asset response messages achieves an identification accuracy of 92.38% after training, representing approximately 5% improvement over existing methods, which demonstrates the model’s effectiveness in asset recognition.

Key words: response message, heterogeneous graph, graph neural network, network asset identification

中图分类号: