Rule Reduction after Knowledge Graph Mining for Cyber Situational Awareness Analysis

Abstract Cyber Knowledge Graph (CyberKG) is a mainstream technique to achieve Cyber Situational Awareness (CyberSA). Mined semantic rules, especially unordered rules, owning the advantages of interpretability, generalization and modularity, show great potential in CyberSA analysis based on CyberKG. When semantic rule mining methods are used on CyberKG, so many rules are obtained that inevitably a lot of redundancy and even some contradictions exist among them. The huge number of the rules reduces their interpretability and ability of generalization, reducing its experience for CyberSA analysis. Therefore, the rules mined on CyberKG needs to be refined. Rule subsumption is introduced to define redundant rules. A method named SRRD is proposed for mined rule reduction. SRRD discovers redundant rules based on the rule subsumption decided by knowledge graph reasoning. Experiments on CyberKG are conducted. Rules are mined by AMIE+ first, and then are reduced by SRRD. The results show that 41.5% mined rules are decided to be redundant and reduced by SRRD (3946 reserved in 6752). The reserved rules are more general and can be used for CyberSA analysis.