A method and system for verifying suspicious threat indicators based on multi-instance learning

Abstract

The invention discloses a method and system for verifying suspicious threat indicators based on multi-instance learning. The method is as follows: processing the intelligence information text content related to each suspicious threat indicator to generate a word sequence containing original semantic information; for each suspicious threat indicator, selecting a plurality of processed word sequences corresponding to the suspicious threat indicator , using a multi-instance learning algorithm to train the word sequences corresponding to each of the selected suspicious indicators and generate a multi-instance learning and verification model; using natural language processing technology to process the intelligence information text of the suspicious threat indicators to be tested, and generate the to-be-tested The word sequence corresponding to the threat indicator can be used; then, the multi-instance learning and verification model is used to predict and verify the word sequence corresponding to the suspicious threat indicator to be tested, and determine whether the suspicious threat indicator to be predicted is a malicious threat indicator. The invention can efficiently and accurately complete the verification of suspicious threat indicators.

Description

technical field [0001] The invention relates to the field of cyberspace security, in particular to a method and system for verifying suspicious threat indicators based on multi-instance learning. Background technique [0002] Suspicious threat indicator verification is to judge the maliciousness of suspicious indicators appearing in the network or logs, that is, to determine whether they are real malicious threat indicators. Verifying suspicious threat indicators can identify network threats in a timely manner and ensure network security. [0003] For specific suspicious threat indicators, it can be verified based on relevant intelligence information. At present, there are mainly three types of verification methods of this type: one is the manual verification method based on security experts, that is, using security experts to analyze the collected relevant intelligence information to manually determine the threat of suspicious indicators; the other is the verification meth...

AI Technical Summary

Problems solved by technology

[0004] The manual verification method based on security experts often relies on the experience accumulated by security experts to manually analyze and sort out existing intelligence information, and the labor cost is high.

[0005] The verification method based on rule matching directly applies regular expressions to match suspicious indicators, ignoring the semantic information in intelligence information, resulting in a high false positive rate of verification

[0006] The verification method based on specific context words needs to collect candidate context words in advance, and then extract the context words matching in the intelligence information. This method is complex, and if the candidate set is not updated in time, the accuracy of verification cannot be guaranteed.

Images