A method and system for actively verifying suspicious threat indicators based on open source information

Abstract

The present invention relates to a suspicious threat index active validation method and system based on source-opening information. The method comprises the following steps of: 1) designing a specialquery statement, wherein the special query statement is combination of suspicious threat indexes and special scenes; 2) collecting and crawling result information obtained through retrieval on the internet according to the special query statement; 3) performing structuring processing of the related source-opening information in the result information to obtain structural data; 4) employing the structural data to fully learn the hidden features and train a corresponding classification model; and 5) employing the classification model to verify the malevolence of the suspicious threat indexes inthe special scenes so as to identify the network threat. The system comprises a query design module, an information collection module, a data processing module, a model training module and an index verification module. The suspicious threat index active validation method and system based on source-opening information can efficiently and accurately complete the verification of the suspicious threatindexes to help users with identification of high-class threat attack so as to ensure network safety.

Description

technical field [0001] The invention belongs to the technical field of cyberspace security, and in particular relates to an active verification method and system for suspicious threat indicators based on open source information. Background technique [0002] In recent years, advanced network threats represented by APT (Advanced Persistent Threats) have grown rapidly and become increasingly complex. In order to ensure network security, some security companies, security vendors, or security researchers will publish professional articles such as security reports and technical blogs on the Internet to analyze existing advanced threat attacks and their technical details. This information helps people quickly understand the evolution and implementation process of existing cyber threats, discover early signs of attacks in a timely manner, and make appropriate defense responses. [0003] Suspicious threat indicators refer to indicators found in network traffic or logs that are not ...

AI Technical Summary

Problems solved by technology

This approach is passive, complex

Moreover, the public intelligence sources for fixed-point monitoring are incomplete, and it is impossible to monitor all public intelligence sources

In addition, it is necessary to analyze and organize information from different intelligence sources, which is costly

Images