A threat intelligence ioc reputation analysis method

Abstract

The invention relates to a threat intelligence IOC credibility analysis method, which comprises the steps of obtaining the threat intelligence IOC, analyzing and establishing network threat behavior activities and communities, and dynamically optimizing the established model at preset intervals. In the present invention, the threat intelligence IOC reputation scoring model is established mainly based on the traffic data and log data of the self-owned equipment and the data shared with the third party, as well as the attacker and data source characteristics obtained through deep mining of the data in each project through technical means, which can satisfy The use of data from various data sources satisfies the verification of the credibility of data sources in the existing threat intelligence source sharing system, and solves the problem that there are a large number of inaccurate threat intelligence source data in the existing market and the lack of failure mechanisms for threat intelligence, so that no matter whether it is collected by three parties Open source data sources and traffic analysis in self-owned equipment can be evaluated for credibility. The system can dynamically adjust the model structure over time to ensure the data failure mechanism.

Description

technical field [0001] The invention belongs to the technical field of digital information transmission, such as telegram communication, and in particular relates to a threat intelligence IOC credibility analysis method. Background technique [0002] Threat intelligence has been used in military and production processes in ancient times, and has become one of the hot words in cyber security in recent years. [0003] With the gradual development of threat intelligence in China, the number of companies with internal threat intelligence research teams is increasing rapidly. At the same time, related products, platforms, and intelligence data designed on the Internet have also increased accordingly. How to do a good job in the foundation of threat intelligence-data checks, establish a reliable data reputation evaluation system, and establish an effective evaluation mechanism for the data used by platforms or products has become a pain point in the use of threat intelligence toda...

AI Technical Summary

Problems solved by technology

[0005] The present invention solves the problem that in the prior art, there are a large number of third-party threat intelligence data sources, and all parties do not have a unified evaluation mechanism to evaluate the data sources when using the data sources, resulting in inaccurate data of a large number of threat intelligence sources and lack of threat intelligence The issue of failure mechanism provides an optimized threat intelligence IOC reputation analysis method

Images