Network threat intelligence sharing method and related device

Abstract

The invention belongs to the technical field of network space security, and discloses a network threat intelligence sharing method and related device.The method comprises the steps that network threat intelligence is obtained and encrypted to obtain an intelligence ciphertext, the intelligence ciphertext is stored in a local server, and a hash value of the intelligence ciphertext is obtained and stored in a private chain; and obtaining a keyword of the network threat intelligence, generating an intelligence keyword index by using a searchable encryption method according to the keyword of the network threat intelligence, and storing the intelligence keyword index to the alliance chain. The local security and privacy of the network threat intelligence are realized based on encrypted storage and the block chain, and the network threat intelligence is prevented from being tampered locally. Meanwhile, the information keyword index is stored in the alliance chain to achieve keyword sharing, specific content of the network threat information is not disclosed, and the retrievability, the safety, the privacy and the non-tampering performance of the network threat information in sharing are achieved.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security technology and relates to a method and related apparatus for sharing network threat intelligence. Background Technology

[0002] The cybersecurity landscape is becoming increasingly complex, with cyberattacks exhibiting characteristics such as complexity, persistence, and organization. Traditional passive defenses are no longer sufficient to meet the security protection needs of this complex cybersecurity environment. Cyber ​​Threat Intelligence (CTI), as a proactive defense mechanism, can effectively bridge the information asymmetry between attackers and defenders. A single individual cannot effectively and comprehensively perceive threats from multiple parties; therefore, sharing cyber threat intelligence is crucial. Cyber ​​threat intelligence sharing involves the collection, analysis, and sharing of data among multiple organizations to provide early warnings of potential cyberattacks and establish situational awareness among stakeholders.

[0003] However, sharing cyber threat intelligence presents certain challenges. Specifically, cyber threat intelligence is highly sensitive, and the entities involved in sharing operate within different trust boundaries. This leads to problems with existing cyber threat intelligence methods, such as fragmented intelligence, tampering with intelligence, a lack of trust in the sharing mechanism, insufficient access control, data leakage risks, and low sharing efficiency. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and related apparatus for sharing network threat intelligence.

[0005] To achieve the above objectives, the present invention employs the following technical solution:

[0006] In a first aspect, the present invention provides a method for sharing network threat intelligence, comprising: acquiring network threat intelligence and encrypting it to obtain ciphertext, storing the ciphertext on a local server, and acquiring the hash value of the ciphertext and storing it on a private blockchain; acquiring keywords of the network threat intelligence, generating an intelligence keyword index based on the keywords of the network threat intelligence using a searchable encryption method, and storing the intelligence keyword index on a consortium blockchain.

[0007] Optionally, the network threat intelligence includes business monitoring threat intelligence and / or attack trapping threat intelligence; the attack trapping threat intelligence is generated by a pre-deployed distributed honeynet based on the acquired attack event network behavior and host behavior logs.

[0008] Optionally, it also includes: randomly generating several symmetric keys, and using each symmetric key to encrypt network threat intelligence, to obtain encrypted network threat intelligence for each symmetric key; randomly selecting several nodes in the consortium blockchain as several verification objects, obtaining the public keys of several verification objects, and encrypting several symmetric keys respectively, to obtain encrypted symmetric keys for each symmetric key; sending the encrypted network threat intelligence and encrypted symmetric keys for each symmetric key to the corresponding verification object; wherein, the corresponding verification object is the verification object to which the public key used when encrypting the encrypted symmetric key belongs; wherein, the encrypted network threat intelligence is used to trigger the verification object to decrypt the encrypted symmetric key using its private key to obtain the symmetric key, and to decrypt the encrypted network threat intelligence using the symmetric key to obtain network threat intelligence, and to generate a rating result for the network threat intelligence based on a preset rating rule and store it in the consortium blockchain.

[0009] Optionally, it also includes: obtaining keywords for querying network threat intelligence, and generating a query intelligence search trapdoor using a searchable encryption method based on the keywords; sending the query intelligence search trapdoor to the consortium blockchain; wherein the query intelligence search trapdoor is used to trigger the consortium blockchain to search for whether there is an intelligence keyword index matching the query intelligence search trapdoor using a searchable encryption method, and when there is an intelligence keyword index matching the query intelligence search trapdoor, obtaining the shared source information of network threat intelligence corresponding to the intelligence keyword index matching the query intelligence search trapdoor, and feeding it back as the shared source information of the query network threat intelligence; receiving the shared source information of the query network threat intelligence fed back by the consortium blockchain, and obtaining the query network threat intelligence based on the shared source information of the query network threat intelligence.

[0010] Optionally, obtaining the query network threat intelligence based on the shared source information of the query network threat intelligence includes: determining the shared source of the query network threat intelligence based on the shared source information of the query network threat intelligence, and sending access information to the shared source of the query network threat intelligence; wherein, the access information is used to trigger the shared source of the query network threat intelligence to send the ciphertext of the network threat intelligence corresponding to the query network threat intelligence to the consortium blockchain, triggering the consortium blockchain to encrypt the ciphertext of the intelligence into a re-encrypted ciphertext using a proxy re-encryption method and send it back; receiving the re-encrypted ciphertext sent back by the consortium blockchain and decrypting it to obtain the query network threat intelligence.

[0011] In a second aspect, the present invention provides a network threat intelligence sharing system, comprising: a preprocessing module, configured to acquire network threat intelligence and encrypt it to obtain ciphertext, store the ciphertext on a local server, and acquire the hash value of the ciphertext and store it on a private blockchain; and a sharing module, configured to acquire keywords of network threat intelligence, generate an intelligence keyword index based on the keywords of network threat intelligence using a searchable encryption method, and store the intelligence keyword index on a consortium blockchain.

[0012] Optionally, the network threat intelligence includes business monitoring threat intelligence and / or attack trapping threat intelligence; the attack trapping threat intelligence is generated by a pre-deployed distributed honeynet based on the acquired attack event network behavior and host behavior logs.

[0013] Optionally, a rating module is also included, which is used to: randomly generate several symmetric keys and encrypt network threat intelligence using each symmetric key to obtain encrypted network threat intelligence for each symmetric key; randomly select several nodes in the consortium blockchain as several verification objects, obtain the public keys of several verification objects and encrypt several symmetric keys respectively to obtain encrypted symmetric keys for each symmetric key; send the encrypted network threat intelligence and encrypted symmetric keys of each symmetric key to the corresponding verification object; wherein, the corresponding verification object is the verification object to which the public key used when encrypting the encrypted symmetric key belongs; the encrypted network threat intelligence is used to trigger the verification object to decrypt the encrypted symmetric key using its private key to obtain the symmetric key, and to decrypt the encrypted network threat intelligence using the symmetric key to obtain network threat intelligence, and to generate a rating result of the network threat intelligence based on preset rating rules and store it in the consortium blockchain.

[0014] Optionally, the system obtains keywords for querying network threat intelligence and generates a query intelligence search trapdoor using a searchable encryption method based on these keywords. The query intelligence search trapdoor is then sent to the consortium blockchain. Specifically, the query intelligence search trapdoor triggers the consortium blockchain to search for a matching intelligence keyword index using a searchable encryption method. If a matching intelligence keyword index exists, the system obtains the shared source information of the network threat intelligence corresponding to that index and uses it as feedback. Finally, the system receives the shared source information of the query network threat intelligence from the consortium blockchain and obtains the query network threat intelligence based on this information.

[0015] Optionally, the query module is specifically used for: determining the shared source of the query network threat intelligence based on the shared source information, and sending access information to the shared source of the query network threat intelligence; wherein, the access information is used to trigger the shared source of the query network threat intelligence to send the encrypted intelligence of the network threat intelligence corresponding to the query network threat intelligence to the consortium blockchain, triggering the consortium blockchain to encrypt the encrypted intelligence into re-encrypted ciphertext using a proxy re-encryption method and send it back; receiving the re-encrypted ciphertext sent back by the consortium blockchain and decrypting it to obtain the query network threat intelligence.

[0016] In a third aspect, the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described network threat intelligence sharing method.

[0017] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described network threat intelligence sharing method.

[0018] Compared with the prior art, the present invention has the following beneficial effects:

[0019] This invention discloses a method for sharing network threat intelligence. During the localization of network threat intelligence processing, the encrypted intelligence is stored on a local server, and its hash value is obtained and stored on a private blockchain. This encrypted storage and blockchain technology ensure the security and privacy of the network threat intelligence locally, preventing tampering. Furthermore, during network threat intelligence sharing, a searchable encryption method is first used to generate an intelligence keyword index based on the keywords of the network threat intelligence. This keyword index is then stored on a consortium blockchain to achieve keyword sharing, without disclosing the specific content of the network threat intelligence. This ensures the searchability, security, privacy, and immutability of the shared network threat intelligence. Attached Figure Description

[0020] Figure 1 This is a flowchart of a network threat intelligence sharing method according to an embodiment of the present invention.

[0021] Figure 2 This is a block diagram of the network threat intelligence sharing system according to an embodiment of the present invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] The present invention will now be described in further detail with reference to the accompanying drawings:

[0025] See Figure 1 In one embodiment of the present invention, a network threat intelligence sharing method is provided to overcome the problems of data leakage risk and low sharing efficiency in existing network threat intelligence sharing methods, improve the controllability, security and real-time performance of sharing, fully integrate network threat intelligence, and enhance the overall collaborative defense capabilities of the industry.

[0026] Specifically, the network threat intelligence sharing method of the present invention includes the following steps:

[0027] S1: Obtain network threat intelligence and encrypt it to obtain ciphertext, store the ciphertext on a local server, and obtain the hash value of the ciphertext and store it on a private blockchain.

[0028] S2: Obtain keywords of network threat intelligence, generate an intelligence keyword index using a searchable encryption method based on the keywords of network threat intelligence, and store the intelligence keyword index to the consortium blockchain.

[0029] This invention discloses a method for sharing network threat intelligence. During the localization of network threat intelligence processing, the encrypted intelligence is stored on a local server, and its hash value is obtained and stored on a private blockchain. This encrypted storage and blockchain technology ensure the security and privacy of the network threat intelligence locally, preventing tampering. Furthermore, during network threat intelligence sharing, a searchable encryption method is first used to generate an intelligence keyword index based on the keywords of the network threat intelligence. This keyword index is then stored on a consortium blockchain to achieve keyword sharing, without disclosing the specific content of the network threat intelligence. This ensures the searchability, security, privacy, and immutability of the shared network threat intelligence.

[0030] Explained, blockchain is a distributed digital ledger for storing electronic data, characterized by decentralization and tamper-resistance. Blockchain can establish reliable trust relationships between multiple unrelated parties. The blockchain structure includes four parts: block header, block body, timestamp, and signature. There are three types of blockchains: public blockchains, consortium blockchains, and private blockchains. Public blockchains allow anyone to participate, with completely open and transparent data, offering the highest degree of decentralization. Private blockchains are controlled by a single institution, with access permissions and node joining entirely determined internally, suitable for internal enterprise use and offering strong privacy. Consortium blockchains are jointly managed by multiple organizations, with access permissions only open to nodes joining the consortium, balancing openness and privacy, suitable for industry collaboration. Enterprises across various industries can conduct user registration, threat intelligence uploading, verification, and threat intelligence trading on the blockchain network.

[0031] Explanatoryly, each enterprise possesses an independent server and private blockchain. The server stores encrypted intelligence, while the private blockchain stores the hash value of the encrypted intelligence. Multiple enterprises create and jointly manage a consortium blockchain, storing an index of intelligence keywords for cyber threat intelligence. Enterprises intending to join the cyber threat intelligence sharing blockchain can submit a registration request. A specially established review body is responsible for reviewing and issuing enterprise identifiers. Employees within an enterprise can apply to their company, and upon approval, the review body directly issues unique employee identifiers. Each enterprise generates a private key based on its own attribute set. Registered enterprises are both sharers and consumers of cyber threat intelligence.

[0032] Interpretive searchable encryption, proposed in 2000, is a technology that allows users to perform search operations on encrypted data while ensuring the privacy and security of the data in its uncracked state. This includes the encryption, trapdoor generation, retrieval, and decryption processes. In this invention, intelligence sharers use searchable encryption technology to generate an intelligence keyword index based on keywords in network threat intelligence and upload it to a consortium blockchain.

[0033] In one possible implementation, the network threat intelligence includes business monitoring threat intelligence and / or attack trapping threat intelligence; the attack trapping threat intelligence is generated by a pre-deployed distributed honeynet based on acquired attack event network behavior and host behavior logs.

[0034] Interpretive cyber threat intelligence typically includes two types. One type, known as business monitoring threat intelligence, originates from internal company situational awareness and security management platforms. This includes IoCs, firewall logs, network logs, router logs, IDS, suspicious event response records, and vulnerability scans. The other type is self-generated attack intelligence captured by distributed honeypots, known as attack trapping threat intelligence. This includes covert attacks, APT attacks, and zero-day vulnerabilities.

[0035] Explained, distributed honeynets are deployed among enterprises participating in the sharing of cyber threat intelligence to proactively capture valuable cyber threat intelligence. For example, a distributed honeynet is deployed in a three-tiered architecture of honeypots, sites, and an aggregation center, including a honeypot monitoring module, a site correlation analysis module, and an aggregation analysis and display module. Specifically, honeypots attract attackers, and cyber threat intelligence is obtained by monitoring and recording attack behavior. The honeypots then upload this cyber threat intelligence to the sites, which analyze and assess it before uploading it to the aggregation center.

[0036] Explained, a honeypot is a proactive network defense technique that uses tools to lure attackers, allowing security personnel to observe their behavior. A honeynet is a simulated network composed of multiple honeypots that can proactively capture high-value threat intelligence. This invention is based on a distributed network deception architecture, employing a three-tiered structure to build a multi-layered, collaborative, distributed honeynet system, achieving precise targeting and intelligence extraction of network attacks.

[0037] Interpretive methods are employed, using distributed honeypot nodes to construct simulated decoy environments to induce attackers to engage in interactive behaviors. Honeypot nodes sense and collect network communication information and host behavior data generated during the attack, transmitting this data to local site nodes. Site nodes extract high-confidence attack signatures and unknown threat intelligence from the captured data, uploading identified attack events and intelligence metadata to a central aggregation center. The aggregation center collects cross-site network threat intelligence, providing a data source for subsequent network threat intelligence sharing.

[0038] For example, the honeypot monitoring module is deployed on the gateway and honeypot nodes of the honeypot site, supporting distributed deployment across honeypot sites in different locations. The honeypot monitoring module includes two sub-modules: network detection and host monitoring, which respectively collect network behavior and host behavior logs for attack events based on intrusion detection and host monitoring technologies. The site correlation analysis module is deployed on the site management node, enabling the aggregation and automatic correlation analysis of network logs and host behavior logs within a single honeypot site, filtering invalid network alarms, and generating alarms for known and unknown attack events. The aggregation analysis and display module mainly collects and statistically analyzes known and unknown attack events captured by all subordinate honeypot sites and displays the attack scenarios of the events. Specifically, the honeypot monitoring module and the site correlation analysis module are distributed across each honeypot site, while the aggregation analysis and display module is centrally deployed.

[0039] For example, in this embodiment, the STIX standard format is used to uniformly model the two types of threat intelligence. STIX is a structured expression language for network threat intelligence proposed by the MITRE organization, supporting semantic descriptions of various threat information components such as observable data, attack indicators, security events, attack activities, and threat actors. By constructing attack trapping intelligence and business monitoring intelligence collected from distributed honeypots into standardized STIX objects, it provides support for organizations to share network threat intelligence in a consistent and machine-readable manner.

[0040] In one possible implementation, the network threat intelligence sharing method further includes: randomly generating several symmetric keys, and encrypting network threat intelligence using each symmetric key to obtain encrypted network threat intelligence for each symmetric key; randomly selecting several nodes in the consortium blockchain as several verification objects, obtaining the public keys of several verification objects, and encrypting several symmetric keys respectively to obtain encrypted symmetric keys for each symmetric key; sending the encrypted network threat intelligence and encrypted symmetric keys for each symmetric key to the corresponding verification object; wherein, the corresponding verification object is the verification object to which the public key used when encrypting the encrypted symmetric key belongs; the encrypted network threat intelligence is used to trigger the verification object to decrypt the encrypted symmetric key using its private key to obtain the symmetric key, and to decrypt the encrypted network threat intelligence using the symmetric key to obtain the network threat intelligence, and to generate a rating result for the network threat intelligence based on a preset rating rule and store it in the consortium blockchain.

[0041] Explanatoryly, only through the active sharing of cyber threat intelligence by various enterprises can the value of cyber threat intelligence sharing be maximized. Therefore, to prevent free-riding by some enterprises, it is necessary to rate cyber threat intelligence, and then determine the quality of intelligence sharers based on the rating results. Rewards can be issued to high-quality intelligence sharers or their information can be made public for intelligence consumers to reference. For example, based on the level and quantity of cyber threat intelligence shared by enterprises, each enterprise can be ranked in terms of reputation within the sharing ecosystem. Higher reputations mean access to higher-value cyber threat intelligence, and enterprises with high reputations are more likely to be trusted by other intelligence consumers, who will then purchase their cyber threat intelligence to accumulate rewards. Furthermore, intelligence sharers can use their rewards to directly purchase cyber threat intelligence from other intelligence sharers.

[0042] For example, the intelligence sharer randomly selects three verifiers from a pre-defined expert pool. These verifiers are experts who assess the value of cyber threat intelligence from multiple perspectives to ensure its quality. The intelligence sharer randomly selects three keys as symmetric keys to encrypt the cyber threat intelligence, encrypts the symmetric keys using the verifiers' public keys, and uploads the encrypted cyber threat intelligence and the encrypted symmetric keys together to the public blockchain for distribution to the verifiers. The verifiers decrypt the encrypted symmetric keys using their private keys, and then decrypt the encrypted cyber threat intelligence using the symmetric keys. The verifiers then generate a rating result for the cyber threat intelligence using pre-defined rating rules, such as rating the quality of the cyber threat intelligence based on accuracy, availability, timeliness, and industry relevance indicators, and submit a report to the consortium blockchain. The final rating result for the cyber threat intelligence can be obtained by averaging the rating results from the three verifiers.

[0043] In one possible implementation, the network threat intelligence sharing method further includes: acquiring keywords for querying network threat intelligence, and generating a query intelligence search trapdoor using a searchable encryption method based on the keywords; sending the query intelligence search trapdoor to a consortium blockchain; wherein the query intelligence search trapdoor is used to trigger the consortium blockchain to search for the existence of an intelligence keyword index matching the query intelligence search trapdoor using a searchable encryption method, and when an intelligence keyword index matching the query intelligence search trapdoor exists, acquiring shared source information of network threat intelligence corresponding to the intelligence keyword index matching the query intelligence search trapdoor, and feeding it back as shared source information of the query network threat intelligence; receiving the shared source information of the query network threat intelligence fed back by the consortium blockchain, and acquiring the query network threat intelligence based on the shared source information of the query network threat intelligence.

[0044] For example, when an intelligence consumer wants to query relevant cyber threat intelligence, it first obtains the keywords for the query. Then, based on these keywords, it generates a query intelligence search trapdoor and sends it to the consortium blockchain. The consortium blockchain nodes run a search algorithm to verify whether there is a keyword index that matches the query intelligence search trapdoor. If the search is successful, the index-related information is returned to the intelligence consumer.

[0045] In one possible implementation, obtaining the query network threat intelligence based on the shared source information of the query network threat intelligence includes: determining the shared source of the query network threat intelligence based on the shared source information of the query network threat intelligence, and sending access information to the shared source of the query network threat intelligence; wherein, the access information is used to trigger the shared source of the query network threat intelligence to send the ciphertext of the network threat intelligence corresponding to the query network threat intelligence to the consortium blockchain, triggering the consortium blockchain to encrypt the ciphertext of the intelligence into a re-encrypted ciphertext using a proxy re-encryption method and send it back; receiving the re-encrypted ciphertext sent back by the consortium blockchain and decrypting it to obtain the query network threat intelligence.

[0046] Explained, proxy re-encryption is a key conversion mechanism between ciphertexts that simplifies data sharing and avoids data leaks and security risks. A proxy server converts ciphertext encrypted by a user with their public key into ciphertext that another user can decrypt with their private key, without revealing the user's private key or plaintext information.

[0047] For example, an intelligence consumer requests access from an intelligence sharer. If the intelligence consumer's attribute set satisfies the intelligence sharer's access policy, the intelligence sharer sends the corresponding encrypted intelligence to the consortium blockchain. The consortium blockchain node uses a proxy re-encryption key to re-encrypt the encrypted intelligence, making it decryptable by the intelligence consumer. It then generates and returns re-encrypted ciphertext to the intelligence consumer. Finally, the intelligence consumer decrypts the re-encrypted ciphertext using its private key to obtain the original network threat intelligence, completing the entire network threat intelligence query process.

[0048] In summary, this invention proactively captures and shares valuable cyber threat intelligence by deploying a distributed honeynet among sharing enterprises. Each sharing enterprise possesses an independent server and private blockchain, while creating and jointly managing a consortium blockchain. The local server stores the encrypted intelligence ciphertext, the private blockchain stores the hash value of the ciphertext, and the consortium blockchain stores the intelligence keyword index, ensuring the security and privacy of the cyber threat intelligence. Secondly, validators are set up to assess the level of cyber threat intelligence, and incentive strategies can be configured. Then, secure searching of cyber threat intelligence is achieved based on searchable encryption technology, and secure sharing is achieved based on proxy re-encryption technology.

[0049] It innovatively integrates distributed honeynets, consortium blockchains, and encryption technologies to solve problems such as the fragmentation of network threat intelligence, lack of trust in sharing mechanisms, and insufficient access control capabilities in existing network threat intelligence sharing. At the same time, it overcomes the risks of data leakage and low sharing efficiency, realizing secure collection, trusted sharing, and privacy protection of network threat intelligence, and improving the quality, efficiency, and security of network threat intelligence sharing.

[0050] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0051] See Figure 2 In another embodiment of the present invention, a network threat intelligence sharing system is provided, which can be used to implement the above-mentioned network threat intelligence sharing method. Specifically, the network threat intelligence sharing system includes a preprocessing module and a sharing module.

[0052] The preprocessing module is used to acquire network threat intelligence and encrypt it to obtain ciphertext, store the ciphertext on a local server, and acquire the hash value of the ciphertext and store it on a private blockchain. The sharing module is used to acquire keywords of network threat intelligence, generate an intelligence keyword index based on the keywords of network threat intelligence using a searchable encryption method, and store the intelligence keyword index on a consortium blockchain.

[0053] In one possible implementation, the network threat intelligence includes business monitoring threat intelligence and / or attack trapping threat intelligence; the attack trapping threat intelligence is generated by a pre-deployed distributed honeynet based on acquired attack event network behavior and host behavior logs.

[0054] In one possible implementation, a rating module is further included, which is used to: randomly generate several symmetric keys and encrypt network threat intelligence using each symmetric key to obtain encrypted network threat intelligence for each symmetric key; randomly select several nodes in the consortium blockchain as several verification objects, obtain the public keys of several verification objects and encrypt several symmetric keys respectively to obtain encrypted symmetric keys for each symmetric key; send the encrypted network threat intelligence and encrypted symmetric keys for each symmetric key to the corresponding verification object; wherein, the corresponding verification object is the verification object to which the public key used when encrypting the encrypted symmetric key belongs; the encrypted network threat intelligence is used to trigger the verification object to decrypt the encrypted symmetric key using its private key to obtain the symmetric key, and to decrypt the encrypted network threat intelligence using the symmetric key to obtain network threat intelligence, and to generate a rating result for the network threat intelligence based on preset rating rules and store it in the consortium blockchain.

[0055] In one possible implementation, a query module is further included, which is configured to: obtain keywords for querying network threat intelligence, and generate a query intelligence search trapdoor using a searchable encryption method based on the keywords; send the query intelligence search trapdoor to the consortium blockchain; wherein the query intelligence search trapdoor is used to trigger the consortium blockchain to search for the existence of an intelligence keyword index matching the query intelligence search trapdoor using a searchable encryption method, and when an intelligence keyword index matching the query intelligence search trapdoor exists, obtain the shared source information of the network threat intelligence corresponding to the intelligence keyword index matching the query intelligence search trapdoor, and provide feedback as the shared source information of the query network threat intelligence; receive the shared source information of the query network threat intelligence fed back by the consortium blockchain, and obtain the query network threat intelligence based on the shared source information of the query network threat intelligence.

[0056] In one possible implementation, the query module is specifically used to: determine the shared source of the query network threat intelligence based on the shared source information, and send access information to the shared source of the query network threat intelligence; wherein, the access information is used to trigger the shared source of the query network threat intelligence to send the ciphertext of the network threat intelligence corresponding to the query network threat intelligence to the consortium blockchain, triggering the consortium blockchain to encrypt the ciphertext of the intelligence into a re-encrypted ciphertext using a proxy re-encryption method and send it back; receive the re-encrypted ciphertext sent back by the consortium blockchain and decrypt it to obtain the query network threat intelligence.

[0057] All relevant content of each step involved in the aforementioned embodiments of the network threat intelligence sharing method can be referenced to the functional description of the corresponding functional module of the network threat intelligence sharing system in the embodiments of the present invention, and will not be repeated here.

[0058] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0059] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of a network threat intelligence sharing method.

[0060] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the network threat intelligence sharing method in the above embodiments.

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for sharing network threat intelligence, characterized in that, include: The system acquires network threat intelligence and encrypts it to obtain ciphertext, stores the ciphertext on a local server, and acquires the hash value of the ciphertext and stores it on a private blockchain. The system acquires keywords for cyber threat intelligence, generates an intelligence keyword index using searchable encryption methods based on these keywords, and stores the intelligence keyword index on a consortium blockchain.

2. The network threat intelligence sharing method according to claim 1, characterized in that, The network threat intelligence includes business monitoring threat intelligence and / or attack trapping threat intelligence; the attack trapping threat intelligence is generated by a pre-deployed distributed honeynet based on the acquired attack event network behavior and host behavior logs.

3. The network threat intelligence sharing method according to claim 1, characterized in that, Also includes: Several symmetric keys are randomly generated, and network threat intelligence is encrypted using each symmetric key to obtain encrypted network threat intelligence for each symmetric key. Randomly select several nodes in the consortium blockchain as several verification objects, obtain the public keys of several verification objects and encrypt several symmetric keys respectively, to obtain the encrypted symmetric keys of each symmetric key; The encrypted network threat intelligence and encrypted symmetric key of each symmetric key are sent to the corresponding verification object. The corresponding verification object is the verification object to which the public key used to encrypt the encrypted symmetric key belongs. The encrypted network threat intelligence is used to trigger the verification object to decrypt the encrypted symmetric key with the private key to obtain the symmetric key, and to decrypt the encrypted network threat intelligence with the symmetric key to obtain the network threat intelligence. The network threat intelligence rating result is generated based on the preset rating rules and stored in the consortium blockchain.

4. The network threat intelligence sharing method according to claim 1, characterized in that, Also includes: Obtain keywords for querying network threat intelligence, and generate a search trapdoor for query intelligence using searchable encryption methods based on the keywords; The query intelligence search trap is sent to the consortium blockchain. The query intelligence search trap is used to trigger the consortium blockchain to search for whether there is an intelligence keyword index that matches the query intelligence search trap through a searchable encryption method. When there is an intelligence keyword index that matches the query intelligence search trap, the consortium blockchain obtains the shared source information of network threat intelligence corresponding to the intelligence keyword index that matches the query intelligence search trap and feeds it back as the shared source information of query network threat intelligence. It receives shared source information of query network threat intelligence from the consortium blockchain and obtains query network threat intelligence based on the shared source information of query network threat intelligence.

5. The network threat intelligence sharing method according to claim 4, characterized in that, The process of obtaining network threat intelligence based on shared source information includes: The shared source for querying network threat intelligence is determined based on the shared source information for querying network threat intelligence, and access information is sent to the shared source for querying network threat intelligence. The access information is used to trigger the shared source for querying network threat intelligence to send the encrypted intelligence text of the network threat intelligence corresponding to the query to the consortium blockchain, and trigger the consortium blockchain to use the proxy re-encryption method to encrypt the intelligence encrypted text into re-encrypted ciphertext and send it back. Receive and decrypt the re-encrypted ciphertext from the consortium blockchain to obtain query network threat intelligence.

6. A network threat intelligence sharing system, characterized in that, include: The preprocessing module is used to acquire network threat intelligence and encrypt it to obtain ciphertext, store the ciphertext on a local server, and acquire the hash value of the ciphertext and store it on a private chain. The shared module is used to obtain keywords of network threat intelligence, generate an intelligence keyword index based on the keywords of network threat intelligence using a searchable encryption method, and store the intelligence keyword index to the consortium blockchain.

7. The network threat intelligence sharing system according to claim 6, characterized in that, The network threat intelligence includes business monitoring threat intelligence and / or attack trapping threat intelligence; the attack trapping threat intelligence is generated by a pre-deployed distributed honeynet based on the acquired attack event network behavior and host behavior logs.

8. The network threat intelligence sharing system according to claim 6, characterized in that, It also includes a rating module, which is used for: Several symmetric keys are randomly generated, and network threat intelligence is encrypted using each symmetric key to obtain encrypted network threat intelligence for each symmetric key. Randomly select several nodes in the consortium blockchain as several verification objects, obtain the public keys of several verification objects and encrypt several symmetric keys respectively, to obtain the encrypted symmetric keys of each symmetric key; The encrypted network threat intelligence and encrypted symmetric key of each symmetric key are sent to the corresponding verification object. The corresponding verification object is the verification object to which the public key used to encrypt the encrypted symmetric key belongs. The encrypted network threat intelligence is used to trigger the verification object to decrypt the encrypted symmetric key with the private key to obtain the symmetric key, and to decrypt the encrypted network threat intelligence with the symmetric key to obtain the network threat intelligence. The network threat intelligence rating result is generated based on the preset rating rules and stored in the consortium blockchain.

9. The network threat intelligence sharing system according to claim 6, characterized in that, It also includes a query module, which is used for: Obtain keywords for querying network threat intelligence, and generate a search trapdoor for query intelligence using searchable encryption methods based on the keywords; The query intelligence search trap is sent to the consortium blockchain. The query intelligence search trap is used to trigger the consortium blockchain to search for whether there is an intelligence keyword index that matches the query intelligence search trap through a searchable encryption method. When there is an intelligence keyword index that matches the query intelligence search trap, the consortium blockchain obtains the shared source information of network threat intelligence corresponding to the intelligence keyword index that matches the query intelligence search trap and feeds it back as the shared source information of query network threat intelligence. It receives shared source information of query network threat intelligence from the consortium blockchain and obtains query network threat intelligence based on the shared source information of query network threat intelligence.

10. The network threat intelligence sharing system according to claim 9, characterized in that, The query module is specifically used for: The shared source for querying network threat intelligence is determined based on the shared source information for querying network threat intelligence, and access information is sent to the shared source for querying network threat intelligence. The access information is used to trigger the shared source for querying network threat intelligence to send the encrypted intelligence text of the network threat intelligence corresponding to the query to the consortium blockchain, and trigger the consortium blockchain to use the proxy re-encryption method to encrypt the intelligence encrypted text into re-encrypted ciphertext and send it back. Receive and decrypt the re-encrypted ciphertext from the consortium blockchain to obtain query network threat intelligence.

11. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the network threat intelligence sharing method as described in any one of claims 1 to 5.

12. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the network threat intelligence sharing method as described in any one of claims 1 to 5.

Images