Network threat intelligence credibility identification method

Abstract

The invention discloses a network threat intelligence credibility identification method. The method disclosed by the invention comprises the following steps: 1) constructing an association diagram model of network threat intelligence, wherein a node on the diagram is a network threat indicator; 2) each network threat indicator has an initial reputation value, calculating the initial reputation value of each network threat indicator to serve as a part of a final threat reputation value of the indicator; 3) calculating a weight for each edge in the association diagram model; 4) designing a threat propagation algorithm via the idea of a diagram propagation algorithm, so that the threat reputation value is propagated step by step among the nodes and neighboring nodes, and then combining the threat reputation value with the initial reputation value of each network threat indicator to calculate a final reputation value; and 5) determining the network threat intelligence credibility accordingto the final reputation value of the network threat indicator. By adoption of the network threat intelligence credibility identification method disclosed by the invention, the quality of network threat intelligence can be better evaluated.

Description

technical field [0001] The invention relates to the field of computer network security, and is used for quantifying the quality of network threat intelligence, more specifically, a method for measuring the reputation of network threat indicators. Background technique [0002] Threat intelligence is evidence-based knowledge including scenarios, mechanisms, indicators, implications, and actionable recommendations. For existing or emerging threats, it can provide decision-making information for subjects to respond to related threats. Indicator of Comprosime (IoC for short) refers to the indicator data used to identify or point out a specific threat in a specific network environment or information system. Degree (reputation) is its key characteristic. Faced with new threats, threat intelligence has evolved from a vulnerability-centered defense idea to a threat-centered defense idea. Threat intelligence trades space for time. Compared with traditional security defenses, it can ...

AI Technical Summary

Problems solved by technology

On the one hand, due to the multi-source nature of threat intelligence, a single intelligence source cannot meet all needs, and subscription to multiple intelligence generates too many alarms; on the other hand, there are multi-level and multi-category correlations between threat As the level of analysis deepens, the amount of intelligence generated will increase exponentially

Second, there are a large number of false positive indicators in threat intelligence data, which affects the utilization efficiency of threat intelligence

The macro-assessment method takes the entire threat intelligence source as the evaluation object, evaluates and quantifies the quality of intelligence information from multiple dimensions such as relevance, accuracy, completeness, timeliness, and usability, and the results can measure the overall threat intelligence source. quality, but cannot measure specific threat intelligence metrics

The micro-assessment method takes a single threat intelligence indicator as the evaluation object, which can filter a large number of false positive intelligence indicators and reduce the amount of threat intelligence data. However, it is still mainly performed manually by domain experts and cannot be applied to large-scale threat intelligence data.

Images