Cyber threat intelligence generation method and system

Abstract

The invention provides a cyber threat intelligence generation method and system. The method comprises the steps of collecting text information of a network security event from a network by utilizing akeyword; classifying the text information by utilizing a classification model, and filtering the text information not belonging to any category; extracting a security entity in each piece of the textinformation comprised in each category, and generating a text abstract of each piece of the text information comprised in each category, and according to the security entities and the text abstracts,forming intelligence information; and clustering the text information with the same timestamps, obtaining class text information corresponding to the timestamps, obtaining all class text information,related to the same network security event, of different timestamps, and sorting the intelligence information corresponding to all the class text information related to the same network security event according to a timestamp sequence. An intelligence tracking system taking an event chain as a presentation form is formed, so that security personnel can track the security event in real time, and the manpower resource cost of intelligence collection is reduced.

Description

technical field [0001] The present invention relates to the technical field of information processing, and more specifically, to a method and system for generating network threat intelligence. Background technique [0002] Threat intelligence is a fact based on knowledge, which is transmitted to a specific user through a certain media, affects the user's choice and decision-making, and is used to assist in solving specific problems. According to the definition of the Center for the Protection of National Infrastructure (CPNI), Cyber ​​Threat Intelligence (Cyber ​​Threat Intelligence) is intelligence information oriented to the field of network security. Through intelligence, specific attack methods can be analyzed to identify malicious To understand the development trend of network security threats, optimize and improve traditional security defense methods, and form a security strategy that can cope with diversified and persistent threats. [0003] With the development of t...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides a network threat intelligence generation method and system in order to overcome the problems of difficulty in extracting network threat intelligence information in the prior art, various types, large amounts of data and unmarked data, and inconvenient understanding for security managers

Images