Threat intelligence IOC credibility analysis method

Abstract

The invention relates to a threat information IOC credibility analysis method, which comprises the steps of obtaining threat information IOC, analyzing and establishing network threat behavior activities and communities, and dynamically optimizing an established model at preset time intervals. In the present invention, attackers and data source features are obtained by deeply mining flow data andlog data of own equipment, third-party shared data and data in each project through technical means. By establishing a threat intelligence IOC credibility scoring model, the data use of each data source can be met, data source credibility verification in an existing threat information source sharing system is satisfied, the problems that a large amount of threat intelligence source data is inaccurate and threat intelligence lacks a failure mechanism in the existing market are solved, creditworthiness evaluation can be carried out no matter whether a three-party open source data source is collected or flow analysis is carried out on own equipment, the system can dynamically adjust the model structure along with time, and the data failure mechanism is ensured.

Description

technical field [0001] The invention belongs to the technical field of digital information transmission, such as telegram communication, and in particular relates to a threat intelligence IOC credibility analysis method. Background technique [0002] Threat intelligence has been used in military and production processes in ancient times, and has become one of the hot words in cyber security in recent years. [0003] With the gradual development of threat intelligence in China, the number of companies with internal threat intelligence research teams is increasing rapidly. At the same time, related products, platforms, and intelligence data designed on the Internet have also increased accordingly. How to do a good job in the foundation of threat intelligence-data checks, establish a reliable data reputation evaluation system, and establish an effective evaluation mechanism for the data used by platforms or products has become a pain point in the use of threat intelligence toda...

AI Technical Summary

Problems solved by technology

[0005] The present invention solves the problem that in the prior art, there are a large number of third-party threat intelligence data sources, and all parties do not have a unified evaluation mechanism to evaluate the data sources when

Images