A Knowledge Graph-Based Security Auditing Approach

This paper proposes a knowledge graph-based security auditing method. By constructing knowledge graphs to perform security vulnerability risk assessments, the proposed method effectively identifies and evaluates potential security threats, in order to enhance the reliability and security of IT services. The approach is carried out in four stages. First, it is required to collect the public exposed vulnerability data and the asset data of the audited IT platform. Next, a knowledge graph is constructed based on the collected data by designing the meta-graph scheme including node type and relation type. Subsequently, graph queries and visualization tools are taken to identify security vulnerability risks, resulting in affected information assets and corresponding vulnerabilities. Finally, based on the identified security vulnerability risks, the risk assessment is conducted by multi-criteria decision analysis to quantify the overall risk level.