A threat information generation method and device

Abstract

The invention discloses a threat intelligence generation method and device, and the method comprises the steps: collecting description texts of various types of security events, and collecting a vulnerability database and an attack utilization database; Filtering a first type of description text from the collected description text by using a regular expression to obtain a second type of description text, the first type of description text not comprising a threat field, and the second type of description text comprising a threat field; Classifying the second type of description text by using aconvolutional neural network to obtain a real threat information text and a false positive case threat information text; Extracting entities from the real threat information text, extracting a relationship between the entities, and generating triple information based on the relationship between the entities; And generating a threat intelligence knowledge map based on the triple information.

Description

technical field [0001] The present application relates to information processing technologies, and in particular to a method and device for generating threat intelligence based on knowledge graphs. Background technique [0002] In recent years, network attack incidents have occurred frequently, the scope of influence has become wider and wider, and network attack technology has continued to improve, and more threatening zero-day (0day) attacks, Advanced Persistent Threat (Advanced Persistent Threat, APT) attacks and other attack methods have emerged in an endless stream. , Traditional static security protection measures based on rule matching (such as firewalls, intrusion detection systems (Intrusion Detection Systems, IDS)) are difficult to effectively identify and block this new type of unknown attack. In order to deal with such new types of network attacks, academia and industry have proposed active defense methods based on threat intelligence. However, the existing tech...

AI Technical Summary

Problems solved by technology

However, the existing technologies mainly have the following two deficiencies. First, the accuracy of entity recognition and relationship extraction of threat intelligence cannot achieve the expected results. Second, the threat intelligence extracted from a single document only carries a very small amount of context. Information, such isolated intrusion indicators (Indicators Of Compromise, IOC) are difficult for security personnel to understand and apply to the protection system

Images