Threat intelligence processing method and device, computing equipment and storage medium

Abstract

The invention provides a threat intelligence processing method and device, computing equipment and a storage medium. The method comprises the steps of obtaining unstructured data in threat intelligence source data; performing word segmentation processing on the unstructured data to obtain a plurality of pieces of intelligence knowledge; performing semantic understanding on each piece of intelligence knowledge by using a natural language processing technology to obtain a semantic expression of each piece of intelligence knowledge; and associating each piece of intelligence knowledge with a known threat intelligence type according to the semantic expression of each piece of intelligence knowledge and the known threat intelligence type. According to the scheme, the recognition quantity of the threat intelligence can be improved, and then effective utilization of the threat intelligence source data is achieved.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of network security, and in particular, to a threat intelligence processing method, device, computing device, and storage medium. Background technique [0002] With the continuous progress and development of information technology, the security of large-scale cyberspace increasingly depends on the extraction, understanding, construction and sharing of threat intelligence. Threat intelligence can be expressed against specific attack vectors used by attackers in a specific industry or geographic area to inform decision-making in threat response. [0003] Threat intelligence source data includes unstructured data, semi-structured data, and structured data. For unstructured data, such as emails, web pages, and text, it needs to be converted into natural language for analysis. In the related art, when extracting threat intelligence from unstructured data, a neural network model is generally...

AI Technical Summary

Problems solved by technology

[0004] Based on the problem that only a small amount of threat intelligence can be identified in related technologies, and the effective use of threat intelligence source data cannot be realized, embodiments of the present invention provide a threat intelligence processing method, device, computing device, and storage medium, which can improve Identify the amount of threat intelligence and realize the effective use of threat intelligence source data

Images