Data processing method and device for information data traceability analysis

Abstract

The invention discloses a data processing method and device for information data traceability analysis. The method comprises the following steps: acquiring basic network information data information; the basic network intelligence data information comprises H pieces of first network intelligence data information; performing classification processing on the basic network intelligence data information to obtain target classification intelligence information; the target classification intelligence information comprises M pieces of target network intelligence data information; each piece of target network intelligence data information comprises N pieces of target category intelligence information; each piece of target category intelligence information comprises L pieces of target intelligence data information; the target intelligence data information corresponds to the first network intelligence data information; l is an integer not less than 0; and analyzing and processing the target classified intelligence information to obtain target processing intelligence information.

Description

Technical Field

[0001] The present invention relates to the technical field of network security processing, and in particular to a data processing method and device for intelligence data traceability analysis. Background Art

[0002] With the rapid development of technology and globalization, the rapid and extensive dissemination of information has opened a new era of fragmentation. The incompleteness, opacity, unreliability, and asymmetry of information have gradually increased the complexity of intelligence analysis and collection. The information acquisition channels of open-source intelligence are diversified, including online multimedia content, social networks, etc. The collected data is in various formats and difficult to process. There have long been problems such as messy intelligence materials, semantic gaps, and low automation levels of intelligence identification and extraction. Therefore, a data processing method and device for intelligence data traceability analysis are provided to improve the depth of network security intelligence data mining, enhance the accuracy and efficiency of data analysis, and further enhance the data traceability analysis ability and information precise push ability, and improve the user experience of accurately obtaining network security data information. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a data processing method and device for intelligence data traceability analysis, which are beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, and further enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0004] To solve the above technical problem, in the first aspect of the embodiments of the present invention, a data processing method for intelligence data traceability analysis is disclosed, and the method includes:

[0005] Obtain basic network intelligence data information; the basic network intelligence data information includes H first network intelligence data information;

[0006] Classify the basic network intelligence data information to obtain target classified intelligence information; the target classified intelligence information includes M target network intelligence data information; each target network intelligence data information includes N target category intelligence information; each target category intelligence information includes L target intelligence data information; the target intelligence data information corresponds to the first network intelligence data information; L is an integer not less than 0;

[0007] Analyze the target classified intelligence information to obtain target processed intelligence information.

[0008] In the second aspect of the embodiments of the present invention, a data processing device for intelligence data traceability analysis is disclosed, and the device includes:

[0009] An acquisition module for acquiring basic network intelligence data information; the basic network intelligence data information includes H pieces of first network intelligence data information;

[0010] A first processing module for classifying the basic network intelligence data information to obtain target classified intelligence information; the target classified intelligence information includes M pieces of target network intelligence data information; each piece of the target network intelligence data information includes N pieces of target category intelligence information; each piece of the target category intelligence information includes L pieces of target intelligence data information; the target intelligence data information corresponds to the first network intelligence data information; L is an integer not less than 0;

[0011] A second processing module for analyzing the target classified intelligence information to obtain target processed intelligence information.

[0012] A third aspect of the present invention discloses another data processing device for intelligence data traceability analysis, the device includes:

[0013] A memory storing executable program code;

[0014] A processor coupled to the memory;

[0015] The processor calls the executable program code stored in the memory and executes some or all of the steps in the data processing method for intelligence data traceability analysis disclosed in the first aspect of the embodiments of the present invention.

[0016] A fourth aspect of the present invention discloses a computer-readable storage medium, the computer-readable storage medium stores computer instructions, and when the computer instructions are called, they are used to execute some or all of the steps in the data processing method for intelligence data traceability analysis disclosed in the first aspect of the embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings without creative efforts based on these drawings.

[0018] Figure 1 is a schematic diagram of the scenario of the data processing system for intelligence data traceability analysis provided by the embodiments of the present invention;

[0019] Figure 2 is a schematic flowchart of a data processing method for intelligence data traceability analysis disclosed by the embodiments of the present invention;

[0020] Figure 3It is a schematic structural diagram of a data processing device for intelligence data traceability analysis disclosed in an embodiment of the present invention;

[0021] Figure 4 It is a schematic structural diagram of another data processing device for intelligence data traceability analysis disclosed in an embodiment of the present invention;

[0022] Figure 5 It is a schematic structural diagram of an intelligence association analysis model disclosed in an embodiment of the present invention. Detailed implementation manners

[0023] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0024] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product or equipment that includes a series of steps or units is not limited to the listed steps or units, but optionally further includes steps or units not listed, or optionally further includes other steps or units inherent to these processes, methods, products or equipment.

[0025] Referring to "embodiments" herein means that a specific feature, structure, or characteristic described in connection with the embodiments can be included in at least one embodiment of the present invention. The phrase appears in various places in the specification and does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art will explicitly and implicitly understand that the embodiments described herein can be combined with other embodiments.

[0026] In this application, the term "exemplary" is used to mean "serving as an example, illustration, or instance". Any embodiment described as "exemplary" in this application is not necessarily to be construed as more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use this application. In the following description, details are set forth for the purpose of explanation. It should be understood that those of ordinary skill in the art can recognize that this application can be implemented without these specific details. In other instances, well-known structures and processes are not elaborated in detail to avoid obscuring the description of this application with unnecessary details. Therefore, this application is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed in this application.

[0027] It should be noted that since the method of the embodiment of this application is executed in a computer device, the processing objects of each computer device exist in the form of data or information. For example, time, which is actually time information. It can be understood that in subsequent embodiments, if dimensions, quantities, positions, etc. are mentioned, they are all corresponding data existences for the computer device to process, and specific details are not elaborated here.

[0028] A brief introduction to the artificial intelligence-related technologies that may be involved in this application is provided. Artificial Intelligence (AI) is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a way similar to human intelligence. Artificial intelligence also studies the design principles and implementation methods of various intelligent machines to enable the machines to have the functions of perception, reasoning, and decision-making.

[0029] Artificial intelligence technology is an interdisciplinary subject involving a wide range of fields, including both hardware-level technologies and software-level technologies. The basic technologies of artificial intelligence generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, and mechatronics. The software technologies of artificial intelligence mainly include several major directions such as computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0030] Computer Vision Technology (CV) Computer vision is a science that studies how to enable machines to "see". More specifically, it refers to using cameras and computers to replace human eyes for tasks such as object recognition and measurement in machine vision, and further performing graphic processing to make the images processed by the computer more suitable for human eyes to observe or be transmitted to instruments for detection. As a scientific discipline, computer vision researches related theories and technologies, and attempts to establish artificial intelligence systems that can obtain information from images or multi-dimensional data. Computer vision technology usually includes image processing, image recognition, image semantic understanding, image retrieval, OCR, video processing, video semantic understanding, video content / behavior recognition, three-dimensional object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping, etc. technologies, and also includes common biometric recognition technologies such as face recognition and fingerprint recognition.

[0031] Single-modal information is data of only one type, such as one of the data information of text, image, audio, video, electromagnetic signal, etc. Multi-modal information is data information that includes at least 2 types of single-modal information. Further, multi-modal information is applicable to complex tasks that require integrating multiple information sources, such as sentiment analysis, robot interaction, autonomous driving, etc. By integrating information of multiple modalities, higher performance and accuracy can usually be achieved in tasks.

[0032] A large model refers to an artificial neural network model with a very large number of parameters. In the field of artificial intelligence, a large model usually refers to a model with hundreds of millions to trillions of parameters. The model usually needs to be trained on a large-scale dataset and requires a large amount of computing resources for optimization and adjustment. Large models are usually used to solve complex natural language processing, computer vision, and speech recognition tasks. Generative AI is a type of AI that can create new content and ideas, including conversations, stories, images, videos, and music. In the embodiments of this application, the large model can be large language models such as ChatGPT, BERT, XLNet, Zhipu Model, Claude, Moonshot AI Model, ChatGLM Model, Tongwen Qianyi Model, MiniMax Model, Spark Model, Llama Model, 360GPT Model, Qwen Model, Baichuan Model, Lark Model, vivoLM Model, and Wenxin Yiyan, and the embodiments of this application do not make any limitations.

[0033] The embodiments of this application provide a data processing method, device, computer device, and computer-readable storage medium for intelligence data traceability analysis, which will be described in detail below respectively.

[0034] Please refer to Figure 1 , Figure 1A scenario schematic diagram of a data processing system for intelligence data traceability analysis provided by an embodiment of the present application. The data processing system for intelligence data traceability analysis may include a computer device 100, and a data processing device for intelligence data traceability analysis is integrated in the computer device 100, such as Figure 1 the computer device in

[0035] In an embodiment of the present application, the computer device 100 is mainly used to obtain basic network intelligence data information; the basic network intelligence data information includes H first network intelligence data information;

[0036] Classify the basic network intelligence data information to obtain target classified intelligence information; the target classified intelligence information includes M target network intelligence data information; each target network intelligence data information includes N target category intelligence information; each target category intelligence information includes L target intelligence data information; the target intelligence data information corresponds to the first network intelligence data information; L is an integer not less than 0;

[0037] Analyze and process the target classified intelligence information to obtain target processed intelligence information.

[0038] It can improve the depth of network security intelligence data mining, enhance the accuracy and efficiency of data analysis, and further enhance the data traceability analysis ability and information precise push ability, and improve the user experience of accurately obtaining network security data information.

[0039] In an embodiment of the present application, the computer device 100 may be an independent server, or a server network or server cluster composed of servers. For example, the computer device 100 described in an embodiment of the present application includes, but is not limited to, a computer, a network host, a single network server, a set of multiple network servers, or a cloud server composed of multiple servers. Among them, the cloud server is composed of a large number of computers or network servers based on cloud computing (Cloud Computing).

[0040] It can be understood that the computer device 100 used in an embodiment of the present application may be a device that includes both receiving and transmitting hardware, that is, a device having receiving and transmitting hardware capable of performing two-way communication on a two-way communication link. Such devices may include: cellular or other communication devices, which have a single-line display or a multi-line display or a cellular or other communication device without a multi-line display. Specifically, the computer device 100 may specifically be a desktop terminal or a mobile terminal, and the computer device 100 may specifically also be one of a mobile phone, a tablet computer, a laptop computer, etc.

[0041] Those skilled in the art can understand, Figure 1The application environment shown is only one application scenario of the solution of this application, and does not constitute a limitation on the application scenario of the solution of this application. Other application environments may also include more or fewer computer devices than those shown in Figure 1 shown, for example Figure 1 only 1 computer device is shown in . It can be understood that the data processing system for intelligence data traceability analysis may also include one or more other services, which are not specifically limited here.

[0042] In addition, as Figure 1 shown, the data processing system for intelligence data traceability analysis may also include a memory 200 for storing data, such as image data, location information, etc.

[0043] It should be noted that Figure 1 the scenario schematic diagram of the data processing system for intelligence data traceability analysis shown is only an example. The data processing system and scenario described in the embodiments of this application are for more clearly explaining the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art know that with the evolution of the data processing system for intelligence data traceability analysis and the emergence of new business scenarios, the technical solutions provided by the embodiments of this application are equally applicable to similar technical problems.

[0044] The present invention discloses a data processing method and device for intelligence data traceability analysis, which are beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, and further enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information. The following will be described in detail respectively.

[0045] Embodiment 1

[0046] Please refer to Figure 2 , Figure 2 which is a schematic flowchart of a data processing method for intelligence data traceability analysis disclosed in an embodiment of the present invention. Among them, Figure 2 the data processing method for intelligence data traceability analysis described is applied to a management system, such as a local server or a cloud server for management, etc., which is not limited in the embodiments of the present invention. As Figure 2 shown, the data processing method for intelligence data traceability analysis may include the following operations:

[0047] 101. Obtain basic network intelligence data information.

[0048] In the embodiments of the present invention, the basic network intelligence data information includes H first network intelligence data information.

[0049] 102. Classify the basic network intelligence data information to obtain the target classified intelligence information.

[0050] In the embodiment of the present invention, the target classified intelligence information includes M target network intelligence data information; each target network intelligence data information includes N target category intelligence information; each target category intelligence information includes L target intelligence data information; the target intelligence data information corresponds to the first network intelligence data information; L is an integer not less than 0.

[0051] 103. Analyze the target classified intelligence information to obtain the target processed intelligence information.

[0052] It should be noted that the above H is a positive integer greater than 1, M is a positive integer greater than or equal to 1, and N is a positive integer greater than or equal to 1. The embodiments of the present invention do not make limitations.

[0053] It should be noted that the above first network intelligence data information is the intelligence material sources such as websites, social platforms, scientific research databases, and vulnerability databases collected through the multi-source heterogeneous cross-language security intelligence data collection technology, so as to break through the core technical points such as intelligence collection based on self-learning of subject knowledge, deep intelligence material collection for DeepWeb, and multi-search engine fusion collection, and combine the MSNB anti-crawling technology for the intelligence source to realize the real-time collection of security information such as the global cyber space strategy, industrial status, equipment system, research hotspots, and threats, and provide data support for the breakthrough and verification of network security intelligence in-depth mining, correlation analysis, and network security intelligence trend perception technology. The embodiments of the present invention do not make limitations.

[0054] Further, the first network intelligence data information can be collected through self-learning based on subject knowledge. Aiming at the goal of quickly obtaining network security intelligence materials that meet the requirements of pertinence and focus, breakthroughs in the technology of focused intelligence collection based on subject knowledge self-learning are achieved from aspects such as subject representation models and subject knowledge expansion, supporting and realizing the comprehensive and high-quality collection of intelligence materials driven by the subject. The embodiments of the present invention do not make limitations. The implementation process is as follows: (1) Construct a subject representation model. Before data collection, the user needs to describe the subject he hopes to collect, that is, the subject representation model. The described subject is subject knowledge. To reduce the complexity of searching for the subject representation model and improve the ease of use for users to use and maintain, the present invention constructs a triple-based subject representation model. The subject knowledge is described by a triple <I, E, C>. I is a set composed of a group of keywords directly related to the subject, E is a set composed of keywords contrary to the subject, and C is a feature vector composed of keywords indirectly related to the subject. Among them, the eigenvalue of each keyword in C represents the degree of relevance of the keyword to the subject. The I set in the model refers to the set of keywords that can fully represent the domain characteristics. To limit the crawling and collection scope; the E set is used to filter documents irrelevant to the subject, that is, any keyword in the E set shall not be included; the C vector enables the algorithm to perform quantitative calculations on the relevance of web pages, URLs, and keywords in the web pages to the subject, so as to expand subject knowledge according to the quantitative calculation results during the crawling and collection process, and sort the output web pages and URLs according to the degree of relevance to the subject. During initialization, the user only needs to give a small number of representative keywords and weights to construct the C vector, and the subject knowledge expansion algorithm will continuously expand and improve the C vector. For the above-mentioned subject representation model, the user only needs to set several keywords initially, and it is relatively easy to describe the subject. (2) Subject knowledge expansion. A large amount of knowledge related to the subject is included in the text of the data source. By making full use of the subject-related keywords included in the text of the intelligence source and continuously expanding the subject knowledge, the problem of insufficient description of the user's subject knowledge can be better solved. During the process of technological breakthrough, full consideration is given to perfecting the synonyms or sub-categories of the subject natural language. The present invention will construct a formula for evaluating the relevance of subject-related vocabulary, which is used to describe the ability of keywords to represent the subject, as follows:

[0055]

[0056] Among them, the function γ k represents the subject relevance of the keyword. x is a noun, df(x) represents the DF value of x, D represents the set of web pages that have been collected currently, |D| is the size of the D set, and γ k (x, d) is defined as follows:

[0057]

[0058] Among them, d is a web page, and φ(x, d) is a set composed of sentences that simultaneously contain x and the keywords in set I in the body text of d; S(d) represents the set of sentences in the body text of d; tf(x, u) and tf(x, d) represent the TF values of x in the anchor text of u and in the body text of d; U(d) is the set of all URLs in web page d. The complexity of this calculation method is linearly related to the number of web pages, and is linearly related to the number of elements in set I and the number of URLs in the web page. The number of nouns and the number of URLs in each web page are generally not too large, and will not increase infinitely over time.

[0059] Furthermore, the first network intelligence data information can be collected through deep mining of the DeepWeb. In the network environment, pages that can be directly accessed through links on web pages and can be accessed by search engines are ordinary web pages, with brief content summaries and missing core information. Most effective, core, and comprehensive information can only be accessed by filling in the interactive interface on the page and sending a query request to the site server to access the detailed intelligence information stored in the database, that is, the Deep Web. To meet the basic requirements of comprehensiveness and depth in obtaining intelligence materials driven by security, the present invention adopts core technical points such as interface detection of the DeepWeb and noise elimination of result linkages based on research on DeepWeb data sources to support obtaining high-quality intelligence materials from intelligence sources with DeepWeb characteristics, thereby improving the quality of intelligence material collection. The embodiments of the present invention are not limited in this regard. Further, (1) DeepWeb interface detection. To obtain Deep Web data information, it is first necessary to discover Deep Web data sources on web pages, that is, to determine DeepWeb site pages. The query interface page is the only entry to the DeepWeb background database, and the determination of Deep Web data sources can be transformed into the problem of query interface page detection. The present invention extracts features through the html structure information of web forms to determine the Deep Web query interface page and interaction mode, and on this basis, performs interface accuracy verification. In addition, to improve the matching coverage of DeepWeb query interfaces for core intelligence sources, a patterned Deep Web query interface configuration library is constructed to adapt to various different coding styles. (2) Noise elimination. In the field of topic search and collection, a large amount of noise content such as advertisements and navigation bars will cause topic drift. To improve the quality of search and collection, the present invention eliminates noise through a style tree comparison denoising method, retains core and effective information, and improves the efficiency and quality of DeepWeb deep mining.

[0060] Further, the first network intelligence data information can be collected based on the fusion of multiple search engines. For a certain network security intelligence theme, the search results of a single search engine may be incomplete for the content to be collected. At the same time, the noise in the search results will cause the deviation of the content collected for the theme. In view of the above problems in collecting network security intelligence materials based on search engines, the present invention performs noise elimination processing on the search results of multiple search engines such as Baidu, Google, Zhongsou, Sogou, Qihoo, Bing, iAsk, Yahoo, NetEase, Tieyi, Soso, Daqi, etc. one by one based on the collection theme, generates effective search result information focused on the theme, and weakens the adverse effects such as excessive theme deviation. On this basis, the results of multiple search engines that have been noise-eliminated one by one are collected, providing effective and targeted support for the subsequent intelligence material fusion processing, and weakening the impact of incomplete single search result information on the generation of high-quality intelligence. Finally, the collection of intelligence materials is comprehensive and effective, which is not limited in the embodiments of the present invention.

[0061] It should be noted that after analyzing and processing the target classified intelligence information to obtain the target processed intelligence information, intelligence collaborative production can also be carried out on the target processed intelligence information, that is, it is jointly completed through the collaborative management and control of intelligence and the quality assessment of intelligence collaborative production, so as to realize the integration of intelligence on key objects of concern, cutting-edge scientific and technological technologies, industrial development trends, network equipment systems, etc. (1) Collaborative management and control. After the intelligence materials are collected, identified, and analyzed, they will exist in the database in different forms. In order to form a complete intelligence product, it is necessary to carry out collaborative management and control of different intelligences on the same subject. The ways taken are described as follows: After the intelligence information enters the primary processing site, by setting keywords, information on a certain theme is automatically aggregated, or other conditions are set to further screen the preliminary selected information and classify it into the database. For the information containing effective information elements, marks are made and then editing processing is carried out. Through the data fusion technology that integrates intelligence collection technology, automatic abstract, automatic viewing, automatic proofreading, information association, etc. of intelligence are realized. Finally, according to the form of the set intelligence product, such as the release of a special research report, a characteristic professional database, and a portal website, the information is processed and the final destination of the intelligence is determined. According to the development characteristics of different intelligences, it is necessary to establish a data template for the development of the intelligence industry, discover the inflection points and hotspots of the information by long-term tracking of the intelligence information, and mine valuable intelligence based on this to carry out intelligence situation awareness. (2) Quality assessment of intelligence collaborative production. For the same subject, different intelligence data evaluate the quality of the intelligence according to the nature, scope of application, purpose, timeliness, etc. of the intelligence content, and evaluate it according to 5-level indicators of timeliness, accuracy, availability, comprehensiveness, and pertinence, such as low, relatively low, medium, relatively high, and high, so as to provide suitable intelligence for different users and ensure the readability, usability, and high quality of the intelligence content.

[0062] It should be noted that the data processing method for intelligence data traceability analysis in this application addresses the requirements for source analysis of intelligence and analysis of the intelligence dissemination path during the intelligence analysis process, as well as the requirement to determine the release source. The security intelligence traceability analysis technology performs traceability analysis on two types of intelligence data, namely text and code. It utilizes text similarity comparison technology and code intelligence comparison technology based on homology determination, and combines intelligence association analysis based on types. For text, it realizes traceability analysis of the release source and the author, and for code, it realizes traceability analysis of the release source and the attacker. The embodiments of the present invention do not make any limitations in this regard.

[0063] It can be seen that implementing the data processing method for intelligence data traceability analysis described in the embodiments of the present invention is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, thereby enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0064] In an optional embodiment, analyzing and processing the target classified intelligence information to obtain target processed intelligence information includes:

[0065] Based on the target classified intelligence information, determining target intelligence traceability information; the target intelligence traceability information includes several first target traceability information;

[0066] Based on the target intelligence traceability information, determining the target processed intelligence information.

[0067] It should be noted that each of the above first target traceability information corresponds to a target intelligence data information, and the embodiments of the present invention do not make any limitations in this regard.

[0068] In this optional embodiment, as an optional implementation manner, the above determining the target processed intelligence information based on the target intelligence traceability information includes:

[0069] Obtaining user attention information; the user attention information includes several browsing record information;

[0070] Generating a first association vector based on the browsing times in the browsing record information in the user attention information;

[0071] Using the browsing association model to perform statistical analysis processing on the target classified intelligence information and the browsing record information to obtain a second association vector;

[0072] Performing element-by-element multiplication calculation processing on the first association vector and the second association vector to obtain a target association vector;

[0073] Taking the target category intelligence information corresponding to the maximum value of the vector elements in the target association vector as the target associated intelligence information;

[0074] Use all the first target traceability information corresponding to the target intelligence data information in the target associated intelligence information as the target push intelligence information in the target processed intelligence information.

[0075] It should be noted that the above browsing record information represents the browsing times of the user for the major intelligence categories (target network intelligence data information) and minor intelligence categories (corresponding to the target category intelligence information), which is not limited in the embodiments of the present invention.

[0076] It should be noted that the above generation of the first association vector based on the browsing times in the browsing record information in the user's concern information is to fill the vector in sequence according to the order of all the minor intelligence categories (corresponding to the target category intelligence information), so as to obtain the first association vector, which is not limited in the embodiments of the present invention. For example, when the minor intelligence categories are XL1, XL2, XL3, XL4, and XL5 (corresponding to N = 5), and the browsing times of the user are 1, 0, 2, 3, and 1 in sequence, the first association vector is (1, 0, 2, 3, 1).

[0077] It should be noted that the above statistical analysis processing of the target classification intelligence information and the browsing record information by using the browsing association model to obtain the second association vector is to first quantify the target classification intelligence information browsed by the user by using the browsing association model, and then fill it into the vector to form a second association vector with the same dimension as the first association vector, which is not limited in the embodiments of the present invention. Further, the browsing association model is:

[0078]

[0079] It should be noted that the above element-by-element multiplication calculation processing of the first association vector and the second association vector is to multiply the vector elements corresponding to each position in the two vectors, which is not limited in the embodiments of the present invention.

[0080] It should be noted that the above use of the target category intelligence information corresponding to the maximum value of the vector elements in the target association vector as the target associated intelligence information is to select the intelligence category that the user is currently most concerned about, so as to determine the current intelligence traceability information, that is, the target push intelligence information, which is not limited in the embodiments of the present invention.

[0081] It should be noted that after determining the target push intelligence information, data distribution can also be performed based on the user's intelligence subscription situation, that is, the target push intelligence information is sent to the user through intelligence data subscription processing, intelligence data distribution strategy configuration, and intelligence data distribution. The embodiments of the present invention do not make limitations. (1) By accepting, parsing, and reviewing the user subscription request, the subsequent distribution process is started. (2) Then, the distribution strategy is configured. Based on the intention preferences of the distributed users and different intelligence categories, a distribution strategy based on user subscriptions is configured, and a data permission control strategy is customized for links such as the visibility and availability of intelligence data. Among them, the user intention preference setting is obtained through the mining of user behavior intentions and the push of intelligence data based on theme recommendations, or configured according to the user's subscription request; the distributed intelligence security intelligence data can be filtered or limited according to information such as the type of intelligence, the region described by the security intelligence data, the target direction, the receiving unit, and the data classification level, mainly including the definition of distribution data rules, the definition of distribution object rules, and the definition of distribution mode rules. The data permission control strategy can authorize the management of data resources such as the shared intelligence data directory to ensure the controlled access to the security intelligence data resource directory. (3) Finally, data distribution is performed. Through the mapping relationship between the intelligence subscription data order and the data resource, the extraction of structured and unstructured data is realized. For periodic subscription requirements, the control and management of data distribution tasks are carried out according to the mode, priority, and effective time of the intelligence distribution strategy. According to the corresponding relationship between data elements, data themes, and intelligence data, data extraction is performed, and a distribution data loading service is provided.

[0082] It can be seen that implementing the data processing method for intelligence data traceability analysis described in the embodiments of the present invention is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, and further enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0083] In another optional embodiment, based on the target classified intelligence information, the target intelligence traceability information is determined, including:

[0084] For any target intelligence data information, the target intelligence data information is parsed to obtain the intelligence data source information corresponding to the target intelligence data information;

[0085] Based on the intelligence data source information and the target intelligence data information, the first target traceability information corresponding to the target intelligence data information is determined.

[0086] It should be noted that the above determination of the target intelligence traceability information based on the target classification intelligence information is for the requirements of analyzing the intelligence source and the intelligence dissemination path during the intelligence analysis process, and the requirement of determining the release source. The security intelligence traceability analysis technology conducts traceability analysis on two types of intelligence data, text and code, uses the text similarity comparison technology and the code intelligence comparison technology based on homologous determination, and combines the intelligence correlation analysis based on the null model to realize the traceability analysis of the release source and the author for text, and the traceability analysis of the release source and the attacker for code, so as to realize the intelligence traceability analysis of network security information. The embodiments of the present invention are not limited thereto.

[0087] It can be seen that implementing the data processing method for intelligence data traceability analysis described in the embodiments of the present invention is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, and further enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0088] In another optional embodiment, the target intelligence data information is parsed to obtain the intelligence data source information corresponding to the target intelligence data information, including:

[0089] The target intelligence data information is extracted to obtain the intelligence feature information corresponding to the target intelligence data information;

[0090] It is determined whether the information type corresponding to the target intelligence data information is a text type to obtain a type determination result;

[0091] When the determination result is yes, the intelligence feature information is subjected to text standardization processing to obtain the first intelligence text information corresponding to the target intelligence data information;

[0092] The first intelligence text information is vectorized to obtain the second intelligence text information corresponding to the target intelligence data information;

[0093] The second intelligence text information and all the basic traceability text information in the traceability candidate text information are calculated by using the correlation calculation model to obtain the first correlation value information corresponding to the target intelligence data information; the first correlation value information includes a plurality of first correlation values;

[0094] Among them, the correlation calculation model is:

[0095]

[0096] Among them, DYGLZ represents the first correlation value; SY1 and SY2 respectively represent the second intelligence text information and the basic traceability text information; xs1 and xs1 respectively represent the first calculation coefficient and the second calculation coefficient;

[0097] The basic traceability text information corresponding to the largest first association value in the first association value information is the target traceability text information corresponding to the target intelligence data information;

[0098] Determine the text source information corresponding to the target traceability text information as the intelligence data source information corresponding to the target intelligence data information;

[0099] When the judgment result is negative, perform detection and analysis processing on the intelligence feature information to obtain the intelligence data source information corresponding to the target intelligence data information.

[0100] It should be noted that the above information types include text types and code types, and the embodiments of the present invention are not limited.

[0101] It should be noted that the above extraction of the intelligence feature information corresponding to the target intelligence data information can be implemented based on a convolutional neural network, and the embodiments of the present invention are not limited. Further, using a convolutional neural network for traceability analysis of two types of intelligence data, text and code, for text, traceability analysis of the release source and author is realized, and for code, traceability analysis of the release source and attacker is realized. This technology first parses the intelligence data to extract the time, location, author, and content information of the intelligence, and the embodiments of the present invention are not limited. Further, before extracting the intelligence feature information corresponding to the target intelligence data information, the data can also be audited, that is, the integrity and accuracy of the intelligence data are audited to ensure the effectiveness of the traceability data, and the embodiments of the present invention are not limited. Further, after extracting the intelligence feature information corresponding to the target intelligence data information, incorrect, invalid, and redundant partial data can also be removed to provide effective input data for traceability analysis, and the embodiments of the present invention are not limited.

[0102] It should be noted that the above first calculation coefficient and second calculation coefficient are positive numbers between 0 and 1, and the sum of the two is 1, and the embodiments of the present invention are not limited.

[0103] It should be noted that the above text standardization processing of the intelligence feature information removes messy characters that affect the word segmentation effect, and directly deletes them or replaces them with spaces. In addition, since the computer does not consider the full-width and half-width formats of the same character to be the same character, the text characters need to be converted between full-width and half-width formats, and the embodiments of the present invention are not limited.

[0104] It should be noted that the above vectorization processing of the first intelligence text information is a process of converting it into a form that the computer can recognize. Further, this application uses the n-gram algorithm to vectorize the text, that is, sliding a window of size n over the content in the text in bytes to form a sequence of byte segments of length n, and the embodiments of the present invention are not limited.

[0105] It should be noted that the above basic traceable text information includes the release source and author information of the text, which is not limited in the embodiments of the present invention.

[0106] It should be noted that the above basic traceable text information is the collected network text information pre-stored in the system, including the writing style, keywords, organizational unit information, release source and author information of the text, etc., which is not limited in the embodiments of the present invention.

[0107] It should be noted that the above calculation and processing of all basic traceable text information in the second intelligence text information and traceable candidate text information using the association calculation model is to calculate the association situation between the representation vectors corresponding to the second intelligence text information and the basic traceable text information using the association calculation model, so as to obtain the similarity between the two, so as to select the directly associated basic traceable text information, and then determine the release source and author information of the corresponding text, which is not limited in the embodiments of the present invention.

[0108] It can be seen that implementing the data processing method for intelligence data traceability analysis described in the embodiments of the present invention is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, and further enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0109] In another optional embodiment, the intelligence feature information is detected and analyzed to obtain the intelligence data source information corresponding to the target intelligence data information, including:

[0110] Performing image mapping processing on the intelligence feature information to obtain the mapped intelligence data information corresponding to the target intelligence data information;

[0111] Performing image texture feature extraction on the mapped intelligence data information to obtain the intelligence feature data information corresponding to the target intelligence data information;

[0112] Performing homologous analysis on the intelligence feature data information to obtain the intelligence data source information corresponding to the target intelligence data information.

[0113] It should be noted that the above detection and analysis processing of the intelligence feature information to obtain the intelligence data source information corresponding to the target intelligence data information mainly solves the problem of classifying security codes to judge the family and source of the codes, and mining malicious codes or attack organizations associated with the codes, so as to lay a foundation for the construction of the network security defense system. In this application, a code homologous determination technology based on deep learning is adopted to map the code binary file into a grayscale image, and the code is analyzed and detected according to the texture features of the image, which is not limited in the embodiments of the present invention.

[0114] It should be noted that the above-mentioned image mapping process for intelligence feature information to obtain the mapped intelligence data information corresponding to the target intelligence data information is the code image mapping of malicious code based on the B2M algorithm, which is not limited in the embodiments of the present invention. For the malicious code executable file corresponding to the intelligence feature information, that is, the binary file, 8 bits are read as an unsigned integer (range 0-255), the fixed line width is a vector, and finally a two-dimensional array is generated for the entire file. This array is visualized as a grayscale image (mapped intelligence data information). The range of each element in this two-dimensional array is 0-255, which is exactly the value range of each pixel in the grayscale image, that is, each array element corresponds to a pixel in the image, which is not limited in the embodiments of the present invention.

[0115] The extraction of image texture features from the mapped intelligence data information to obtain the intelligence feature data information corresponding to the target intelligence data information is realized based on the extraction method of GLCM. That is, by using the spatial correlation between the gray elements of the image, the gray correlation between two pixels with a certain relative position relationship in the image is calculated, a gray-level co-occurrence matrix of the image is established, and the required feature quantities are statistically analyzed from this matrix to analyze the image texture features to obtain the intelligence feature data information, such as contrast, inverse difference, autocorrelation, difference, second moment, and entropy, etc. These statistical quantities include the pixel gray change frequency and dependence relationship in the direction and distance of the image, which is not limited in the embodiments of the present invention.

[0116] It should be noted that the above-mentioned homology analysis of the intelligence feature data information to obtain the intelligence data source information corresponding to the target intelligence data information is the code homology analysis based on the convolutional neural network, which is not limited in the embodiments of the present invention. Further, for the homology analysis of malicious code, a code sample library with labels and associated with the attacking organization needs to be established first. For a large number of collected code samples, the publicly available file analysis platform VirusTotal can be used for analysis and tagging, and with the help of the knowledge of network security experts, the malicious code attacking organization is analyzed to establish a code sample library. Finally, the code sample library is input into the convolutional neural network model for training, and the trained model is used for the determination of the malicious code family and the identification and analysis of the attacking organization, which is not limited in the embodiments of the present invention.

[0117] It can be seen that implementing the data processing method for intelligence data traceability analysis described in the embodiments of the present invention is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, and further enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0118] In an optional embodiment, based on the intelligence data source information and the target intelligence data information, the first target traceability information corresponding to the target intelligence data information is determined, including:

[0119] Use the intelligence correlation analysis model to perform data analysis on the target intelligence data information to obtain the intelligence correlation information corresponding to the target intelligence data information;

[0120] Perform fusion processing on the intelligence data source information and the intelligence correlation information to obtain the first target traceability information corresponding to the target intelligence data information.

[0121] It should be noted that the above-mentioned intelligence correlation information represents time correlation information (such as release time, production time, etc. correlation information) and space correlation information (such as release country, release website, etc. information), and the embodiments of the present invention do not make limitations.

[0122] It should be noted that the above-mentioned fusion processing of the intelligence data source information and the intelligence correlation information is to splice the two data, so as to form traceability information representing the path of the ship of network security intelligence, so as to provide an orderly intelligence traceability analysis result, and the embodiments of the present invention do not make limitations.

[0123] It should be noted that as Figure 5 shown, the above-mentioned intelligence correlation analysis model includes a first encoding module, a second encoding module, a third encoding module, a first convolution module, a second convolution module, a third convolution module, a first normalization module, a second normalization module, a first attention module, a second attention module, a third attention module and a first fusion module; wherein,

[0124] The input end of the first encoding module and the input end of the second encoding module are configured to receive the model input of the intelligence correlation analysis module; the output end of the first encoding module is respectively connected to the input end of the first attention module and the input end of the first normalization module; the output end of the first attention module is connected to the input end of the first normalization module; the output end of the first normalization module is connected to the input end of the first convolution module; the output end of the first convolution module is connected to the input end of the first fusion module; the output end of the second encoding module is respectively connected to the input end of the second attention module and the input end of the second normalization module; the output end of the second attention module is connected to the input end of the second normalization module; the output end of the second normalization module is connected to the input end of the second convolution module; the output end of the second convolution module is connected to the input end of the first fusion module; the output end of the first fusion module is connected to the input end of the third encoding module; the output end of the third encoding module is connected to the input end of the third attention module; the output end of the third attention module is connected to the input end of the third convolution module; the output end of the third convolution module is configured to output the model output of the intelligence correlation analysis module.

[0125] It should be noted that the above-mentioned model input represents the target intelligence data information, and the model output represents the intelligence correlation information, and the embodiments of the present invention do not make limitations.

[0126] It should be noted that the above first encoding module, second encoding module, and third encoding module are constructed based on position encoding operations, and the embodiments of the present invention do not make any limitations.

[0127] It should be noted that the convolution kernels of the above first convolution module, second convolution module, and third convolution module have a size of 1×1 and a channel number of 1, and the embodiments of the present invention do not make any limitations.

[0128] It should be noted that the above first normalization module and second normalization module are constructed based on the max pooling layer, and the embodiments of the present invention do not make any limitations.

[0129] It should be noted that the above first attention module, second attention module, and third attention module are constructed based on the multi-head attention mechanism, or can also be constructed based on the scaled attention mechanism. The embodiments of the present invention do not make any limitations. Further, the module constructed based on the scaled attention mechanism is a module that performs weighted summation on the input information by at least two linear layers, then inputs it into the scaled convolution unit for scaled dot product operation, and then multiplies it with the output of one of the linear layers to output the data representation. The embodiments of the present invention do not make any limitations.

[0130] It should be noted that the above first fusion module is constructed based on the concatenation operation, and the embodiments of the present invention do not make any limitations.

[0131] It should be noted that the above intelligence correlation analysis module respectively extracts features from the time correlation information and the space correlation information through two parallel data processing branches, and then fuses them into one branch to form the feature extraction analysis of the correlation relationship of the spatio-temporal correlation information, so as to realize the in-depth analysis of the spatio-temporal intelligence correlation information and the traceability analysis of the intelligence spatio-temporal relationship. The embodiments of the present invention do not make any limitations.

[0132] It should be noted that the above intelligence correlation analysis module can be trained based on the cross-entropy loss function, and the number of iterative training cycles is not less than 300 times. The training samples can be formed by clustering the network security intelligence data collected by the user and then performing label calibration (such as using the file analysis platform VirusTotal for analysis and tagging). The embodiments of the present invention do not make any limitations.

[0133] It can be seen that implementing the data processing method for intelligence data traceability analysis described in the embodiments of the present invention is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, and further enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0134] In another alternative embodiment, classifying the basic network intelligence data information to obtain the target classified intelligence information includes:

[0135] Perform word segmentation on the basic network intelligence data information to obtain the first processed intelligence information;

[0136] Perform vectorization on the first processed intelligence information to obtain the second processed intelligence information;

[0137] Perform normalization on the second processed intelligence information to obtain the third processed intelligence information;

[0138] Perform serialization on the third processed intelligence information to obtain the fourth processed intelligence information;

[0139] Perform identification on the fourth processed intelligence information to obtain the target classification intelligence information.

[0140] It should be noted that the above-mentioned word segmentation of the intelligence text information corresponding to the basic network intelligence data information is to perform word segmentation on the first network intelligence data information to split the text into words and lexical units, which is not limited in the embodiments of the present invention.

[0141] It should be noted that the above-mentioned vectorization of the first processed intelligence information is to use TF-IDF (Term Frequency-Inverse Document Frequency) to convert the text data into vectors, which is not limited in the embodiments of the present invention.

[0142] It should be noted that the above-mentioned normalization of the second processed intelligence information is to use Min-Max normalization to scale the data to the interval [0,1], which is not limited in the embodiments of the present invention.

[0143] It should be noted that the above-mentioned serialization of the third processed intelligence information is to serialize the third processed intelligence information into one-hot encoding to map each word or token to a unique integer, which is not limited in the embodiments of the present invention.

[0144] It should be noted that the above-mentioned identification of the fourth processed intelligence information to obtain the target classification intelligence information is to first use the intelligence identification model constructed based on the long short-term memory network to detect and identify the intelligence data corresponding to the fourth processed intelligence information to obtain the intelligence classification information (including intelligence major category - intelligence minor category, such as destructive program - Trojan horse), and then associate the intelligence classification information with the corresponding basic network intelligence data information to obtain the corresponding target intelligence data information. Further, the intelligence major category corresponds to the target network intelligence data information, and the intelligence minor category corresponds to the target category intelligence information, which is not limited in the embodiments of the present invention.

[0145] Furthermore, the model training of the above-mentioned intelligence identification model is implemented based on the following method:

[0146] A1 Training sample screening: Use the result of hierarchical clustering analysis (perform clustering analysis using the complete-linkage agglomerative hierarchical clustering algorithm. The basic steps include:

[0147] Aa1 Classify each intelligence material into one category, calculate the distance between every two categories, that is, calculate the similarity between samples. This process is calculated using the Euclidean distance formula;

[0148] Aa2 Find the two closest categories among all categories and merge them into one category;

[0149] Aa3 Recalculate the similarity between the newly generated category and each other category. The calculation between categories is performed using the Average Linkage calculation method;

[0150] Aa4 Repeat steps Aa2 and Aa3 until all sample points are merged into one category, thus forming the training samples for each intelligence category), and vectorize and normalize the samples;

[0151] A2 Modeling: Establish a basic recognition model corresponding to the long short-term memory network, and set the network structure parameters and training parameters;

[0152] A3 Training: Use the samples obtained in step A1 to train the basic recognition model (the loss function can be the cross-entropy loss function, and the number of iterations is not less than 300 times) to obtain the intelligence recognition model;

[0153] A4 Self-learning: Under the assistance of the updated clustering analysis results, automatically perform incremental training and update the model. Through the self-learning process, construct an identification and classification system with adaptive capabilities.

[0154] It should be noted that the above hierarchical clustering algorithm can partition the data set to form a tree-shaped clustering structure, which helps us explain the clustering results in a visual way. By clustering the intelligence data, different types of intelligence can be classified, and the same type of intelligence can be aggregated. Through multiple clusterings, newly emerging intelligence types can be discovered, which is convenient for discovering new research hotspots and new equipment systems. The embodiments of the present invention do not make limitations.

[0155] It can be seen that implementing the data processing method for intelligence data traceability analysis described in the embodiments of the present invention is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, and further enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0156] Embodiment 2

[0157] Please refer to Figure 3 , Figure 3It is a schematic structural diagram of a data processing device for intelligence data traceability analysis disclosed in an embodiment of the present invention. Among them, Figure 3 The described device can be applied to a management system, such as a local server or a cloud server for management, etc., which is not limited in the embodiments of the present invention. For example, Figure 3 As shown, the device may include:

[0158] An acquisition module 201, configured to acquire basic network intelligence data information; the basic network intelligence data information includes H first network intelligence data information;

[0159] A first processing module 202, configured to perform classification processing on the basic network intelligence data information to obtain target classification intelligence information; the target classification intelligence information includes M target network intelligence data information; each target network intelligence data information includes N target category intelligence information; each target category intelligence information includes L target intelligence data information; the target intelligence data information corresponds to the first network intelligence data information; L is an integer not less than 0;

[0160] A second processing module 203, configured to perform analysis processing on the target classification intelligence information to obtain target processing intelligence information.

[0161] It can be seen that implementing Figure 3 The described data processing device for intelligence data traceability analysis is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, thereby enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0162] In another alternative embodiment, as Figure 3 shown, performing analysis processing on the target classification intelligence information to obtain target processing intelligence information includes:

[0163] Based on the target classification intelligence information, determining target intelligence traceability information; the target intelligence traceability information includes a number of first target traceability information;

[0164] Based on the target intelligence traceability information, determining target processing intelligence information.

[0165] It can be seen that implementing Figure 3 The described data processing device for intelligence data traceability analysis is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, thereby enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0166] In yet another alternative embodiment, as Figure 3 shown, based on the target classification intelligence information, determining target intelligence traceability information includes:

[0167] For any target intelligence data information, perform parsing processing on the target intelligence data information to obtain the intelligence data source information corresponding to the target intelligence data information;

[0168] Based on the intelligence data source information and the target intelligence data information, determine the first target traceability information corresponding to the target intelligence data information.

[0169] It can be seen that implementing Figure 3 the described data processing device for intelligence data traceability analysis is beneficial to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, thereby enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0170] In another optional embodiment, as Figure 3 shown, performing parsing processing on the target intelligence data information to obtain the intelligence data source information corresponding to the target intelligence data information includes:

[0171] Extract information from the target intelligence data information to obtain the intelligence feature information corresponding to the target intelligence data information;

[0172] Judge whether the information type corresponding to the target intelligence data information is a text type to obtain a type judgment result;

[0173] When the judgment result is yes, perform text standardization processing on the intelligence feature information to obtain the first intelligence text information corresponding to the target intelligence data information;

[0174] Perform vectorization processing on the first intelligence text information to obtain the second intelligence text information corresponding to the target intelligence data information;

[0175] Use the association calculation model to perform calculation processing on all the basic traceability text information in the second intelligence text information and the traceability candidate text information to obtain the first association value information corresponding to the target intelligence data information; the first association value information includes a number of first association values;

[0176] Among them, the association calculation model is:

[0177]

[0178] Among them, DYGLZ represents the first association value; SY1 and SY2 respectively represent the second intelligence text information and the basic traceability text information; xs1 and xs1 respectively represent the first calculation coefficient and the second calculation coefficient;

[0179] The basic traceability text information corresponding to the largest first association value in the first association value information is the target traceability text information corresponding to the target intelligence data information;

[0180] Determine the text source information corresponding to the target traceability text information as the intelligence data source information corresponding to the target intelligence data information;

[0181] When the judgment result is negative, detect and analyze the intelligence feature information to obtain the intelligence data source information corresponding to the target intelligence data information.

[0182] It can be seen that implementing Figure 3 The data processing device described for intelligence data traceability analysis is conducive to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, thereby enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0183] In another alternative embodiment, as Figure 3 shown, detecting and analyzing the intelligence feature information to obtain the intelligence data source information corresponding to the target intelligence data information includes:

[0184] Perform image mapping processing on the intelligence feature information to obtain the mapped intelligence data information corresponding to the target intelligence data information;

[0185] Extract the image texture features of the mapped intelligence data information to obtain the intelligence feature data information corresponding to the target intelligence data information;

[0186] Perform homology analysis on the intelligence feature data information to obtain the intelligence data source information corresponding to the target intelligence data information.

[0187] It can be seen that implementing Figure 3 The data processing device described for intelligence data traceability analysis is conducive to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, thereby enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0188] In another alternative embodiment, as Figure 3 shown, based on the intelligence data source information and the target intelligence data information, determine the first target traceability information corresponding to the target intelligence data information, including:

[0189] Use the intelligence association analysis model to perform data analysis on the target intelligence data information to obtain the intelligence association information corresponding to the target intelligence data information;

[0190] Fuse the information of the intelligence data source and the intelligence association information to obtain the first target traceability information corresponding to the target intelligence data information.

[0191] It can be seen that implementing Figure 3 The data processing device for intelligence data traceability analysis described above is conducive to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, thereby enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0192] In another alternative embodiment, as Figure 3 shown, classify the basic network intelligence data information to obtain the target classified intelligence information, including:

[0193] Perform word segmentation on the basic network intelligence data information to obtain the first processed intelligence information;

[0194] Perform vectorization on the first processed intelligence information to obtain the second processed intelligence information;

[0195] Perform normalization on the second processed intelligence information to obtain the third processed intelligence information;

[0196] Perform serialization on the third processed intelligence information to obtain the fourth processed intelligence information;

[0197] Perform identification on the fourth processed intelligence information to obtain the target classified intelligence information.

[0198] It can be seen that implementing Figure 3 The data processing device for intelligence data traceability analysis described above is conducive to improving the depth of network security intelligence data mining, enhancing the accuracy and efficiency of data analysis, thereby enhancing the data traceability analysis ability and information precise push ability, and improving the user experience of accurately obtaining network security data information.

[0199] Embodiment III

[0200] Please refer to Figure 4 , Figure 4 which is a schematic structural diagram of another data processing device for intelligence data traceability analysis disclosed in the embodiments of the present invention. Among them, Figure 4 The described device can be applied to a management system, such as a local server or a cloud server for management, etc., which is not limited in the embodiments of the present invention. As Figure 4 shown, the device may include:

[0201] A memory 301 storing executable program code;

[0202] A processor 302 coupled to the memory 301;

[0203] The processor 302 calls the executable program code stored in the memory 301 to execute the steps in the data processing method for intelligence data traceability analysis described in the first embodiment.

[0204] Embodiment 4

[0205] An embodiment of the present invention discloses a computer-readable storage medium that stores a computer program for electronic data exchange. The computer program causes a computer to execute the steps in the data processing method for intelligence data traceability analysis described in the first embodiment.

[0206] Embodiment 5

[0207] An embodiment of the present invention discloses a computer program product. The computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute the steps in the data processing method for intelligence data traceability analysis described in the first embodiment.

[0208] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without creative labor.

[0209] Through the specific descriptions of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solutions, in essence, or the parts that contribute to the prior art can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, and the storage medium includes read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc memories, magnetic disk memories, tape memories, or any other computer-readable medium that can be used to carry or store data.

[0210] Finally, it should be noted that: what is disclosed in a data processing method and device for intelligence data traceability analysis disclosed in the embodiments of the present invention is only the preferred embodiments of the present invention, and is only used to illustrate the technical solutions of the present invention, rather than limiting it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data processing method for intelligence data source tracing analysis, characterized in that: The method comprises: Obtaining basic network intelligence data information; the basic network intelligence data information includes H first network intelligence data information; Classify the basic network intelligence data information to obtain target classification intelligence information; the target classification intelligence information includes M target network intelligence data information; each of the target network intelligence data information includes N target category intelligence information; each of the target category intelligence information includes L target intelligence data information; the target intelligence data information corresponds to the first network intelligence data information; L is an integer not less than 0; The target classification intelligence information is analyzed and processed to obtain target processing intelligence information.

2. The data processing method for intelligence data source tracing analysis according to claim 1 is characterized in that: The analyzing and processing the target classification intelligence information to obtain target processing intelligence information includes: Based on the target classification intelligence information, target intelligence tracing information is determined; the target intelligence tracing information includes a plurality of first target tracing information; Based on the target intelligence tracing information, target processing intelligence information is determined.

3. The data processing method for intelligence data source tracing analysis according to claim 2 is characterized in that: Determining target intelligence tracing information based on the target classification intelligence information includes: For any of the target intelligence data information, the target intelligence data information is parsed and processed to obtain intelligence data source information corresponding to the target intelligence data information; Based on the intelligence data source information and the target intelligence data information, first target tracing information corresponding to the target intelligence data information is determined.

4. The data processing method for intelligence data source tracing analysis according to claim 3 is characterized in that: The step of parsing the target intelligence data information to obtain intelligence data source information corresponding to the target intelligence data information includes: Extracting information from the target intelligence data to obtain intelligence feature information corresponding to the target intelligence data; Determine whether the information type corresponding to the target intelligence data information is a text type, and obtain a type determination result; When the judgment result is yes, performing text standardization processing on the intelligence feature information to obtain first intelligence text information corresponding to the target intelligence data information; Performing vectorization processing on the first intelligence text information to obtain second intelligence text information corresponding to the target intelligence data information; Using the association calculation model, the second intelligence text information and all the basic source tracing text information in the source tracing candidate text information are calculated and processed to obtain the first association value information corresponding to the target intelligence data information; the first association value information includes a plurality of first association values; Wherein, the association calculation model is: Among them, DYGLZ represents the first association value; SY1 and SY2 represent the second intelligence text information and the basic traceability text information respectively; xs1 and xs2 represent the first calculation coefficient and the second calculation coefficient respectively; The basic tracing text information corresponding to the largest first correlation value in the first correlation value information is used as the target tracing text information corresponding to the target intelligence data information; Determine the text source information corresponding to the target traceability text information as the intelligence data source information corresponding to the target intelligence data information; When the judgment result is no, the intelligence feature information is detected and analyzed to obtain the intelligence data source information corresponding to the target intelligence data information.

5. The data processing method for intelligence data source tracing analysis according to claim 4 is characterized in that: The detecting, analyzing and processing the intelligence feature information to obtain the intelligence data source information corresponding to the target intelligence data information includes: Performing image mapping processing on the intelligence feature information to obtain mapped intelligence data information corresponding to the target intelligence data information; Performing image texture feature extraction on the mapped intelligence data information to obtain intelligence feature data information corresponding to the target intelligence data information; Perform homology analysis on the intelligence feature data information to obtain intelligence data source information corresponding to the target intelligence data information.

6. The data processing method for intelligence data source tracing analysis according to claim 3 is characterized in that: The determining, based on the intelligence data source information and the target intelligence data information, first target source tracing information corresponding to the target intelligence data information includes: Using the intelligence association analysis model to perform data analysis on the target intelligence data information, to obtain intelligence association information corresponding to the target intelligence data information; The intelligence data source information and the intelligence association information are fused to obtain the first target tracing information corresponding to the target intelligence data information.

7. The data processing method for intelligence data source tracing analysis according to claim 1 is characterized in that: The classifying and processing the basic network intelligence data information to obtain target classification intelligence information includes: Performing word segmentation processing on the basic network intelligence data information to obtain first processed intelligence information; Performing vectorization processing on the first processing intelligence information to obtain second processing intelligence information; performing normalization processing on the second processing intelligence information to obtain third processing intelligence information; Serializing the third processing intelligence information to obtain fourth processing intelligence information; The fourth processed intelligence information is identified and processed to obtain target classification intelligence information.

8. A data processing device for intelligence data source tracing analysis, characterized in that: The device comprises: An acquisition module, used to acquire basic network intelligence data information; the basic network intelligence data information includes H first network intelligence data information; A first processing module is used to classify the basic network intelligence data information to obtain target classification intelligence information; the target classification intelligence information includes M target network intelligence data information; each of the target network intelligence data information includes N target category intelligence information; each of the target category intelligence information includes L target intelligence data information; the target intelligence data information corresponds to the first network intelligence data information; L is an integer not less than 0; The second processing module is used to analyze and process the target classification intelligence information to obtain target processing intelligence information.

9. A data processing device for intelligence data source tracing analysis, characterized in that: The device comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the data processing method for intelligence data tracing and analysis as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, which, when called, are used to execute the data processing method for intelligence data tracing and analysis as described in any one of claims 1 to 7.

Images