A method and apparatus for identifying multi-layered semantic advanced threat knowledge

By building a multi-layer semantic advanced threat knowledge model and combining it with the STIX and ATT&CK frameworks, we address the ambiguity and incompleteness of existing threat modeling methods, achieve a standardized and comprehensive description of network threat intelligence, and make it applicable to diverse network threat scenarios.

CN120017341BActive Publication Date: 2025-10-21NO 15 INST OF CHINA ELECTRONICS TECH GRP
2 Cites 0 Cited by

Patent Information

Application Number
CN202510108294.8
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2025-01-23
Publication Date
2025-10-21
Estimated Expiration
2045-01-23

AI Technical Summary

Technical Problem

Existing threat modeling methods are ambiguous, heterogeneous, and incomplete in terms of multi-domain knowledge sharing, standardization, and comprehensive description of threat intelligence domain knowledge information, making it difficult to cope with ever-changing network threat scenarios.

Method used

A multi-layer semantic advanced threat knowledge identification method is adopted, combined with the STIX threat data element standard and the ATT&CK tactics knowledge framework. By performing information identification and analysis, knowledge extraction and semantic expansion on the original data, high-level and low-level semantic entity models are constructed, and semantic technology is used to build a universal and practical network threat ontology knowledge model.

Benefits of technology

It achieves a comprehensive description of complex and changeable network threat scenarios in the context of multi-domain knowledge sharing, provides a unified behavioral model architecture, and can better identify network attack behaviors.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The application discloses a method and device for identifying multilayer semantic advanced threat knowledge, namely, the application proposes a multilayer semantic advanced threat knowledge description framework, the method combines STIX threat data element standards and ATT&CK technique and tactics knowledge framework, utilizes semantic technology to construct a perfect advanced threat knowledge framework, establishes a set of relatively universal network threat ontology knowledge model which has practicability and expansibility, provides a unified behavior model architecture for complex and changeable attack behaviors such as APT attacks, and thus can comprehensively describe the knowledge model of threat intelligence field knowledge information in a multiregion knowledge sharing and standardized scene to cope with changeable network threat scenes.
Need to check novelty before this filing date? Find Prior Art