Intelligence data processing method, device, electronic device, medium and program product

Abstract

The present disclosure provides a method for processing intelligence data, including: obtaining self-produced intelligence data from a self-developed data source; obtaining push data from a first client, the push data including a user identifier of a first user and third-party intelligence data; determining whether the first user has write permission based on the user identifier of the first user; generating intelligence data in a preset format based on the third-party intelligence data and the self-produced intelligence data when the first user has write permission; and writing the intelligence data into an intelligence repository. The present disclosure also provides an intelligence data processing device, electronic device, medium, and computer program product.

Description

Technical Field

[0001] The present disclosure relates to a method, device, electronic device, medium and program product for processing intelligence data. Background Art

[0002] Cyber ​​Threat Intelligent (CTI) is used to describe relevant information about network security or threats. It is a knowledge carrier that includes vulnerabilities, threats, features, lists, attributes, solutions, etc.

[0003] When exchanging cyber threat intelligence data (hereinafter referred to as intelligence data), the data being exchanged must comply with certain formats and protocols. When exchanging intelligence data, the data formats used by the parties involved in the exchange are not uniform, so they cannot be exchanged and shared uniformly. Summary of the invention

[0004] One aspect of the present disclosure provides a method for processing intelligence data, including: obtaining self-produced intelligence data from a self-developed data source; obtaining push data from a first client, the push data including a user identifier of a first user and third-party intelligence data; determining whether the first user has write permission based on the user identifier of the first user; if the first user has write permission, generating intelligence data in a preset format based on the third-party intelligence data and the self-produced intelligence data; and writing the intelligence data into an intelligence repository.

[0005] Optionally, the method is applied to an intelligence processing system, which includes a data exchange layer and a data distribution storage layer; obtaining the push data from the first client includes: obtaining the push data from the first client from a first data interface of the data exchange layer, and sending the push data to the data storage and distribution layer, wherein the first data interface supports a trusted automated exchange protocol for indicator information.

[0006] Optionally, the preset format includes a structured threat information expression; generating intelligence data in a preset format based on the third-party intelligence data and the self-generated intelligence data includes: obtaining the self-generated intelligence data from the data exchange layer, and sending the self-generated intelligence data to the data storage and distribution layer; parsing the self-generated data through the data storage and distribution layer to determine at least one first field, and parsing the third-party data to determine at least one second field; and merging the at least one first field with the at least one second field in a preset format to generate the intelligence data in the preset format.

[0007] Optionally, writing the intelligence data into the intelligence repository includes: acquiring the generated intelligence data from the data storage and distribution layer, and sending the generated intelligence data to the data processing layer; determining the business scenario of the intelligence data through the data processing layer; if there is an intelligence data set corresponding to the business scenario in the intelligence repository, writing the intelligence data into the intelligence data set; and if there is no intelligence data set corresponding to the business scenario in the intelligence repository, creating a new intelligence data set in the intelligence repository and writing the intelligence data into the new intelligence data set.

[0008] Optionally, the method also includes: receiving a pull request from a second client from the data exchange layer, wherein the pull request includes an identifier of a second user and a target intelligence data set requested by the second user, and determining whether the second client has access rights to the target intelligence data set based on the identifier of the second user; if the second user has access rights, the data exchange layer notifies the data processing layer so that the target intelligence data set is queried in the intelligence library through the data processing layer, and the queried target intelligence data set is sent to the data exchange layer; and the target intelligence data received from the data processing layer is sent to the second client through the data exchange layer.

[0009] Optionally, the method also includes: generating a management page through a data exchange layer; and displaying at least one of the following information through the management page: user information, user requests, data interface connection status, statistical data of the intelligence data set in the intelligence database, write records of the intelligence database, and access records of the intelligence database.

[0010] Another aspect of the present disclosure provides an intelligence data processing device, including: a self-produced data acquisition module, used to acquire self-produced intelligence data from a self-developed data source; a third-party data acquisition module, used to acquire push data from a first client, the push data including a user identifier of a first user and third-party intelligence data; an authentication module, used to determine whether the first user has write permission based on the user identifier of the first user; a data expression module, used to generate intelligence data in a preset format based on the third-party intelligence data and the self-produced intelligence data when the first user has write permission; and an intelligence writing module, used to write the intelligence data into an intelligence repository.

[0011] Another aspect of the present disclosure provides an electronic device, including: one or more processors; and a memory for storing one or more computer programs, wherein when the one or more computer programs are executed by the one or more processors, the one or more processors implement the method as described above.

[0012] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0013] Another aspect of the present disclosure provides a computer program, which includes computer executable instructions, and the instructions are used to implement the method described above when executed.

[0014] According to an embodiment of the present disclosure, by acquiring self-produced intelligence data of a self-developed data source and third-party intelligence data of a first client, and when the first user has write permission, intelligence data in a preset format is generated based on the third-party intelligence data and the self-produced intelligence data, and then the intelligence data is written into an intelligence repository, so that data from all parties can be stored in the intelligence repository in a unified format, facilitating subsequent sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] For a more complete understanding of the present disclosure and its advantages, reference will now be made to the following description taken in conjunction with the accompanying drawings, in which:

[0016] Figure 1A An exemplary system architecture to which the method for processing intelligence data according to an embodiment of the present disclosure can be applied is schematically shown;

[0017] Figure 1B An exemplary application scenario to which the method for processing intelligence data according to an embodiment of the present disclosure can be applied is schematically shown;

[0018] Figure 2 A flowchart schematically illustrates a method for processing intelligence data according to an embodiment of the present disclosure;

[0019] Figure 3 A flowchart schematically shows a method for processing intelligence data according to another embodiment of the present disclosure;

[0020] Figure 4 A flowchart schematically shows a method for processing intelligence data according to another embodiment of the present disclosure;

[0021] Figure 5 A schematic diagram of a management page according to an embodiment of the present disclosure is exemplarily shown;

[0022] Figure 6 A block diagram schematically shows an apparatus for processing intelligence data according to an embodiment of the present disclosure; and

[0023] Figure 7 A block diagram of a computer system suitable for implementing a method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0027] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some boxes or combinations thereof in the block diagrams and / or flow charts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that these instructions can create a device for implementing the functions / operations described in these block diagrams and / or flow charts when executed by the processor. The technology of the present disclosure can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). In addition, the technology of the present disclosure can take the form of a computer program product on a computer-readable storage medium storing instructions, which can be used by an instruction execution system or used in conjunction with an instruction execution system.

[0029] The embodiment of the present disclosure provides a method for processing intelligence data. The method includes obtaining self-produced intelligence data from a self-developed data source; obtaining push data from a first client, the push data including a user identifier of a first user and third-party intelligence data; determining whether the first user has write permission based on the user identifier of the first user; generating intelligence data in a preset format based on the third-party intelligence data and the self-produced intelligence data if the first user has write permission; and writing the intelligence data into an intelligence library.

[0030] Figure 1A The exemplary system architecture 100a to which the intelligence data processing method according to the embodiment of the present disclosure can be applied is schematically shown. It should be noted that: Figure 1A The examples shown are merely examples of system architectures to which the embodiments of the present disclosure may be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure may not be applied to other devices or systems.

[0031] The exemplary system architecture 100a may include, for example, a data storage and distribution layer 10, a data exchange layer 20, and a data processing layer 30. The data storage and distribution layer 10 is deployed on a cloud server and is responsible for the integration of intelligence data, including collecting, integrating, generating and storing intelligence data that complies with STIX expression from self-developed data sources and third-party data sources.

[0032] The data exchange layer 20 is used to complete data authentication, user registration, root service node data distribution and intelligence collection aggregation, as well as the implementation of various business interfaces. Among them, the business interface may include, for example, an intelligence set list query interface, a multi-intelligence object query interface, an intelligence object push interface, a status query interface, etc.

[0033] The data processing layer 30 may include a data synchronization module 31, a data import module 32, an intelligence query module 33 and an intelligence writing module 34, which are used to complete the entire data processing. At the same time, the interaction processing between the above modules is performed separately at different intelligence consumption ends.

[0034] Figure 1B The exemplary application scenario 100b to which the method for processing intelligence data according to the embodiment of the present disclosure can be applied is schematically shown. It should be noted that: Figure 1B The examples shown are merely examples of system architectures to which the embodiments of the present disclosure may be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure may not be used in other environments or scenarios.

[0035] like Figure 1B As shown, according to the embodiment, the application scenario 100b may include a device end 110 , a cloud end 120 and an intelligence library 130 .

[0036] Among them, the device side 110 is configured with a device side Stix Server (service) and related API (application programming interface), and the cloud side 120 is configured with a cloud side Stix Server.

[0037] The device-side Stix Server 110 can receive intelligence data (such as Stix files) from self-developed data sources through the intelligence import module, and receive third-party intelligence data from third-party data sources through corresponding interfaces. Then, the third-party intelligence data and self-generated intelligence data are integrated, normalized, cleaned, and written into the intelligence library.

[0038] The cloud-side Stix Server 120 periodically synchronizes data with the device-side Stix Server 110. The cloud-side Stix Server 120 integrates the aggregated STIX data into TAXII data services and distributes them through TAXII data services.

[0039] Figure 2 The flowchart schematically shows a method for processing intelligence data according to an embodiment of the present disclosure.

[0040] like Figure 2 As shown, the method includes operations S210 to S250.

[0041] In operation S210, self-generated intelligence data from a self-developed data source is acquired.

[0042] According to an embodiment of the present disclosure, operation S210 may include, for example, obtaining self-generated intelligence data of a self-developed data source at a predetermined time interval. The predetermined time interval may be set according to the efficiency of the self-developed data source in generating intelligence data. The higher the efficiency of the self-developed data source in generating intelligence data, the shorter the predetermined time interval.

[0043] In operation S220, push data from the first client is acquired.

[0044] The pushed data includes the user identification of the first user and third-party intelligence data.

[0045] According to an embodiment of the present disclosure, Trusted Automated eXchange of Indicator Information (TAXII) is a protocol for exchanging cyber threat intelligence (CTI) via HTTPS. A dedicated intelligence object push interface (i.e., a first application program interface) can be pre-configured based on the TAXII protocol for receiving push data from a client. Based on this, operation S220 can, for example, include receiving push data uploaded by a first client via a first application program interface.

[0046] According to an embodiment of the present disclosure, the push data may be actively uploaded by the first client or passively uploaded. Based on this, before operation S220, it may also include sending a data acquisition request to the first client, so that the first client responds to the data acquisition request and uploads the push data through the first application program interface.

[0047] In operation S230, it is determined whether the first user has write permission according to the user identification of the first user.

[0048] According to an embodiment of the present disclosure, the user identification is used to represent the user identity, and may include, for example, a user ID.

[0049] According to an embodiment of the present disclosure, intelligence data in the intelligence library is divided into different intelligence data sets according to different categories. In order to improve the security of data distribution, data access rights to each intelligence data set can be configured for each user.

[0050] For example, for intelligence dataset A, both ordinary users and administrators can access and write. For intelligence dataset B, except for the administrator, other users do not have write permissions, and except for the administrator, each user needs to have a clear authorization statement before accessing intelligence dataset B.

[0051] In operation S240, in the case where the first user has write permission, intelligence data in a preset format is generated according to the third-party intelligence data and the self-generated intelligence data.

[0052] According to an embodiment of the present disclosure, operation S240 may, for example, include parsing self-generated data to determine at least one first field; parsing third-party data to determine at least one second field; and merging at least one first field with at least one second field to generate intelligence data in a preset format.

[0053] According to an embodiment of the present disclosure, the preset format used by the intelligence data may include, for example, Structured Threat Information eXpression (STIX). STIX is a language and format for describing network threat intelligence (CTI), specifically in the form of xml, json, etc. According to the STIX format, the intelligence data may include, for example, fields such as type, ID, creation time, modification time, name, description, and tags.

[0054] For example, by parsing self-generated data, the type, ID, creation time, modification time, name, description, label and other information of each piece of intelligence in the self-generated data is determined, and this information is converted into fields in the intelligence data, namely the first field. By parsing third-party data, the type, ID, creation time, modification time, name, description, label and other information of each piece of intelligence in the third-party data is determined, and this information is converted into fields in the intelligence data, namely the second field. Then the first field and the second field are merged to form one or more pieces of intelligence data.

[0055] In operation S250, the intelligence data is written into the intelligence library to update the intelligence data in the intelligence library.

[0056] According to an embodiment of the present disclosure, operation S250 may, for example, include determining a business scenario of intelligence data; if there is an intelligence data set corresponding to the business scenario in the intelligence repository, writing the intelligence data into the intelligence data set corresponding to the business scenario in the intelligence repository; and if there is no intelligence data set corresponding to the business scenario in the intelligence repository, creating a new intelligence data set in the intelligence repository and writing the intelligence data into the new intelligence data set.

[0057] According to the embodiments of the present disclosure, for each business scenario, there is a corresponding data collection, for example, a test collection is a test data collection used for docking testing. A basic collection is an intelligence data collection based on a data range. An open source intelligence collection is a collection of third-party subscription sources.

[0058] Exemplarily, in this embodiment, in addition to the test scenario, the open source data aggregation scenario, and the basic scenario, the business scenario may also include a specific attack type intelligence scenario, etc.

[0059] According to the embodiments of the present disclosure, the update of intelligence data in the intelligence library can adopt a full acquisition method, that is, all intelligence data generated by the self-developed data source and the client are obtained each time an update is made, or an incremental acquisition method can be adopted, that is, only the intelligence data newly added after the last update is obtained each time an update is made.

[0060] According to an embodiment of the present disclosure, by acquiring self-produced intelligence data of a self-developed data source and third-party intelligence data of a first client, and when the first user has write permission, intelligence data in a preset format is generated based on the third-party intelligence data and the self-produced intelligence data, and then the intelligence data is written into an intelligence repository, so that data from all parties can be stored in the intelligence repository in a unified format, facilitating subsequent sharing.

[0061] Figure 3 The flowchart schematically shows a method for processing intelligence data according to another embodiment of the present disclosure.

[0062] like Figure 3 As shown, in addition to operations S210 to S250, the method further includes operations S310 to S330. Operations S310 to S330 may be performed after operation S250, for example, but the present disclosure is not limited thereto.

[0063] In operation S310 , a pull request from a second client is received.

[0064] The pull request includes the identifier of the second user and the target intelligence data set requested by the second user.

[0065] According to an embodiment of the present disclosure, the first client and the second client may be the same client or different clients. The first user and the second user may be the same user or different users.

[0066] According to an embodiment of the present disclosure, a dedicated intelligence object query interface may be pre-configured based on the TAXII protocol to receive a pull request from a client.

[0067] In operation S320, it is determined whether the second client has access rights to the target intelligence data set according to the identifier of the second user.

[0068] In operation S330, if the second user has access rights, the target intelligence data set in the intelligence library is sent to the second client.

[0069] The intelligence data processing method according to the embodiment of the present disclosure realizes data sharing between different intelligence consumption ends and data sharing between the intelligence consumption ends and the intelligence center, which greatly improves the efficiency of data interaction and push.

[0070] Figure 4 The flowchart schematically shows a method for processing intelligence data according to another embodiment of the present disclosure.

[0071] like Figure 4 As shown, in addition to operations S210 to S250 and operations S310 to S330, the method further includes operations S410 to S420. Operations S410 to S420 may be performed after operation S330, for example, but the present disclosure is not limited thereto.

[0072] In operation S410, a management page is generated.

[0073] In operation S420, at least one of the following information is displayed through the management page: user information, user request, data interface connection status, statistical data of intelligence data sets in the intelligence database, writing records of the intelligence database, and access records of the intelligence database.

[0074] According to the embodiments of the present disclosure, it is possible to monitor various information of the intelligence source data configuration module, count the number of various intelligence sets, record data exchange audit information and data synchronization information, and visualize this information through the management page, thereby helping staff to understand the system status and facilitate data tracing and troubleshooting.

[0075] Figure 5 A schematic diagram of a management page according to an embodiment of the present disclosure is exemplarily shown.

[0076] like Figure 5 As shown, the management page may include, for example, TAXII Server Configuration, TAXII Services, and Intelligence Set Management modules. Among them, the TAXII Server Configuration module can be used to display the name of the cloud server, data distribution address, user name, and password. The TAXII Services module can be used to display the service type corresponding to different data sets for data distribution. The Intelligence Set Management module can be used to display the subscription (feed) status of the intelligence set.

[0077] According to the embodiments of the present disclosure, data distribution supports a variety of service types, such as management service type (collection management service), discovery type (discovery service), push type (inboxservice), pull type (poll service), etc. Among them, Collection Management Service is used for TAXII clients to obtain available data collections and request subscriptions from the server. Discovery Service is used to discover available TAXIIServices. Inbox Service is used for TAXII clients to push data to TAXII servers. Poll Service is used for TAXII clients to pull data from TAXII servers.

[0078] According to other embodiments of the present disclosure, the writing and querying operations of the intelligence library can also be recorded to generate data exchange audit information. The data exchange audit information is then displayed on the management page. In addition, the number of various intelligence data sets in the intelligence library can also be counted, and then these statistical data can be displayed on the management page.

[0079] According to an embodiment of the present disclosure, Figure 2 to Figure 4 The method shown can be applied to an intelligence processing system and executed by a program module of the intelligence processing system. Exemplarily, in this embodiment, the intelligence processing system is provided with at least three program modules: a data storage and distribution layer, a data exchange layer, and a data processing layer.

[0080] Among them, the data storage and distribution layer can be deployed on the cloud server, which is responsible for the integration of intelligence data, including the collection and integration of self-developed data sources and third-party data sources, and the generation and storage of intelligence data that conforms to STIX expression.

[0081] The data exchange layer can be deployed on the device side to perform data authentication, user registration, data distribution of root service nodes, and aggregation of intelligence sets, and provide various business interfaces to the outside world, such as intelligence set list query interface, multi-intelligence object query interface, intelligence object push interface, status query interface, etc.

[0082] The data processing layer can be deployed on the device side, including a data synchronization module, an intelligence import module, an intelligence query module, and an intelligence writing module. Among them, the data synchronization module can be used to synchronize data with the cloud. The intelligence import module can be used to import intelligence. The intelligence query module can be used to query the corresponding intelligence from the intelligence library according to the query request. The intelligence writing module can be used to write intelligence into the intelligence library.

[0083] By deploying the data storage and distribution layer on the cloud server and setting the data exchange layer and data processing layer on the device side, the cloud side and the device side are combined, which facilitates data sharing between different intelligence consumption ends and data sharing between the intelligence consumption end and the cloud side.

[0084] The interaction process between the layers is further described below in conjunction with specific embodiments.

[0085] According to an embodiment of the present disclosure, self-produced intelligence data from a self-developed data source can be obtained from the data exchange layer, and push data uploaded from the first client through the intelligence object push interface can be obtained from the data exchange layer, and the push data includes the user identifier of the first user and third-party intelligence data. Then, the data exchange layer determines whether the first user has write permission based on the user identifier of the first user. In the case where the first user has write permission, the self-produced intelligence data and the third-party intelligence data are sent from the data exchange layer to the data storage and distribution layer. Then, the data storage and distribution layer generates intelligence data in a preset format based on the third-party intelligence data and the self-produced intelligence data, and sends the generated intelligence data to the data processing layer. Among them, the preset format may, for example, include a structured threat information expression. Next, the intelligence data is written into the intelligence library through the data processing layer.

[0086] According to another embodiment of the present disclosure, a pull request received from a second client through an intelligence object query interface can also be obtained from the data exchange layer, wherein the pull request includes an identifier of the second user and a target intelligence data set requested by the second user. The data exchange layer then determines whether the second client has access rights to the target intelligence data set based on the identifier of the second user. If the second user has access rights, the data processing layer queries the target intelligence data set in the intelligence library, and sends the queried target intelligence data set to the data exchange layer. Next, the target intelligence data set received from the data processing layer is sent to the second client through the data exchange layer.

[0087] According to another embodiment of the present disclosure, user information, user requests, data interface connection status, statistical data of the intelligence data set in the intelligence database, write records of the intelligence database, and access records of the intelligence database, etc. can also be obtained through the data processing layer and sent to the data exchange layer, and a management page is generated through the data exchange layer. The management page is used to display user information, user requests, data interface connection status, statistical data of the intelligence data set in the intelligence database, write records of the intelligence database, and access records of the intelligence database, etc.

[0088] Figure 6 The block diagram schematically shows a device for processing intelligence data according to an embodiment of the present disclosure.

[0089] like Figure 6 As shown, the intelligence data processing device 600 includes a self-produced data acquisition module 610, a third-party data acquisition module 620, an authentication module 630, a data expression module 640 and an intelligence writing module 650. The intelligence data processing device 600 can execute the above reference Figure 2 to Figure 5 Describe the method.

[0090] Specifically, the self-produced data acquisition module 610 is used to obtain self-produced intelligence data from a self-developed data source.

[0091] The third-party data acquisition module 620 is used to acquire push data from the first client, where the push data includes the user identifier of the first user and third-party intelligence data.

[0092] The authentication module 630 is used to determine whether the first user has the write permission according to the user identification of the first user.

[0093] The data expression module 640 is used to generate intelligence data in a preset format based on third-party intelligence data and self-generated intelligence data when the first user has write permission.

[0094] The intelligence writing module 650 is used to write intelligence data into the intelligence database.

[0095] According to an embodiment of the present disclosure, by acquiring self-produced intelligence data of a self-developed data source and third-party intelligence data of a first client, and when the first user has write permission, intelligence data in a preset format is generated based on the third-party intelligence data and the self-produced intelligence data, and then the intelligence data is written into an intelligence repository, so that data from all parties can be stored in the intelligence repository in a unified format, facilitating subsequent sharing.

[0096] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0097] For example, any multiple of the self-produced data acquisition module 610, the third-party data acquisition module 620, the authentication module 630, the data expression module 640, and the intelligence writing module 650 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the self-produced data acquisition module 610, the third-party data acquisition module 620, the authentication module 630, the data expression module 640, and the intelligence writing module 650 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the self-produced data acquisition module 610, the third-party data acquisition module 620, the authentication module 630, the data expression module 640 and the intelligence writing module 650 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is executed.

[0098] Figure 7 The block diagram of a computer system suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. Figure 7 The computer system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0099] like Figure 7 As shown, the computer system 700 includes a processor 710 and a computer-readable storage medium 720. The computer system 700 can execute the method according to the embodiment of the present disclosure.

[0100] Specifically, the processor 710 may include, for example, a general-purpose microprocessor, an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 710 may also include an onboard memory for cache purposes. The processor 710 may be a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0101] The computer-readable storage medium 720 may be, for example, a non-volatile computer-readable storage medium, and specific examples include but are not limited to: a magnetic storage device, such as a magnetic tape or a hard disk (HDD); an optical storage device, such as a compact disk (CD-ROM); a memory, such as a random access memory (RAM) or flash memory; and the like.

[0102] The computer-readable storage medium 720 may include a computer program 721, which may include code / computer-executable instructions, which when executed by the processor 710 causes the processor 710 to perform a method according to an embodiment of the present disclosure or any variation thereof.

[0103] The computer program 721 may be configured to have, for example, a computer program code including a computer program module. For example, in an example embodiment, the code in the computer program 721 may include one or more program modules, for example, including 721A, module 721B, ... It should be noted that the division method and number of modules are not fixed, and those skilled in the art may use appropriate program modules or program module combinations according to actual conditions, and when these program module combinations are executed by the processor 710, the processor 710 may execute the method according to the embodiment of the present disclosure or any variation thereof.

[0104] According to an embodiment of the present invention, at least one of the self-produced data acquisition module 610, the third-party data acquisition module 620, the authentication module 630, the data expression module 640 and the intelligence writing module 650 can be implemented as a reference. Figure 7 The computer program modules described herein, when executed by the processor 710, can implement the corresponding operations described above.

[0105] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0106] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0107] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0108] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0109] Although the present disclosure has been shown and described with reference to specific exemplary embodiments of the present disclosure, it should be understood by those skilled in the art that various changes in form and details may be made to the present disclosure without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents. Therefore, the scope of the present disclosure should not be limited to the above-mentioned embodiments, but should be determined not only by the appended claims, but also by the equivalents of the appended claims.

Claims

1. A method for processing intelligence data, the method being applied to an intelligence processing system, the intelligence processing system comprising a data storage and distribution layer, a data exchange layer and a data processing layer; the data storage and distribution layer is deployed in the cloud and is used for the integration of intelligence data; the data exchange layer and the data processing layer are arranged at a device end, and the data exchange layer is used for data distribution and the aggregation of intelligence sets; The data processing layer is used for data processing and business interaction processing, and the method includes: Acquire, from the data exchange layer, self-generated intelligence data from a self-developed data source and push data from the first client, wherein the push data includes a user identifier of the first user and third-party intelligence data; Determining, according to the user identifier of the first user, whether the first user has write permission; In the case where the first user has write permission, intelligence data in a preset format is generated according to the third-party intelligence data and the self-produced intelligence data through the data storage and distribution layer; wherein, generating intelligence data in a preset format according to the third-party intelligence data and the self-produced intelligence data comprises: obtaining the self-produced intelligence data from the data exchange layer, and sending the self-produced intelligence data to the data storage and distribution layer; parsing the self-produced intelligence data through the data storage and distribution layer to determine at least one first field, and parsing the third-party intelligence data to determine at least one second field; and merging the at least one first field with the at least one second field according to a preset format to generate the intelligence data in the preset format; The intelligence data is written into an intelligence data set corresponding to a business scenario in the intelligence library or into a newly created intelligence data set through the data processing layer, wherein the business scenario includes a test scenario, an open source data aggregation scenario, a basic scenario, and a specific attack type intelligence scenario; Obtaining a pull request from a second client from the data exchange layer, wherein the pull request includes an identifier of a second user and a target intelligence data set requested by the second user, and determining whether the second client has access rights to the target intelligence data set according to the identifier of the second user; In the case where the second user has access rights, querying the target intelligence data set in the intelligence library through the data processing layer, and sending the queried target intelligence data set to the data exchange layer; and The target intelligence data set received from the data processing layer is sent to the second client through the data exchange layer.

2. According to the method of claim 1, the acquiring of push data from the first client comprises: The push data from the first client is acquired from the first data interface of the data exchange layer, and the push data is sent to the data storage and distribution layer, wherein the first data interface supports a trusted automated exchange protocol for indicator information.

3. The method according to claim 2, wherein: The preset format includes a structured threat information expression.

4. The method according to claim 3, wherein: The step of writing the intelligence data into an intelligence data set corresponding to the business scenario in the intelligence database or into a newly created intelligence data set includes: Acquire the generated intelligence data from the data storage distribution layer, and send the generated intelligence data to the data processing layer; Determining the business scenario of the intelligence data through the data processing layer; If there is an intelligence data set corresponding to the business scenario in the intelligence database, writing the intelligence data into the intelligence data set; and In the case that the intelligence data set corresponding to the business scenario does not exist in the intelligence library, a new intelligence data set is created in the intelligence library, and the intelligence data is written into the newly created intelligence data set.

5. The method according to claim 1, further comprising: Generate management pages through the data exchange layer; as well as At least one of the following information is displayed on the management page: User information, user requests, data interface connection status, statistical data of intelligence data sets in the intelligence library, write records of the intelligence library and access records of the intelligence library.

6. A device for processing intelligence data, the device is applied to an intelligence processing system, the intelligence processing system comprises a data storage and distribution layer, a data exchange layer and a data processing layer; the data storage and distribution layer is deployed in the cloud and is used for the integration of intelligence data; the data exchange layer and the data processing layer are arranged on the device side, the data exchange layer is used for data distribution and the aggregation of intelligence collection; The data processing layer is used for data processing and business interaction processing, and the device includes: Self-produced data acquisition module, used to obtain self-produced intelligence data from self-developed data sources from the data exchange layer; A third-party data acquisition module, used to acquire push data from the first client from the data exchange layer, wherein the push data includes a user identifier of the first user and third-party intelligence data; an authentication module, configured to determine whether the first user has write permission according to the user identification of the first user; A data expression module, used for generating, through the data storage and distribution layer, intelligence data in a preset format according to the third-party intelligence data and the self-produced intelligence data, when the first user has write permission; wherein, generating the intelligence data in a preset format according to the third-party intelligence data and the self-produced intelligence data comprises: acquiring the self-produced intelligence data from the data exchange layer, and sending the self-produced intelligence data to the data storage and distribution layer; parsing the self-produced intelligence data through the data storage and distribution layer to determine at least one first field, and parsing the third-party intelligence data to determine at least one second field; and merging the at least one first field with the at least one second field according to a preset format to generate the intelligence data in the preset format; an intelligence writing module, used to write the intelligence data into an intelligence data set corresponding to a business scenario in the intelligence library or into a newly created intelligence data set through the data processing layer, wherein the business scenario includes a test scenario, an open source data aggregation scenario, a basic scenario, and a specific attack type intelligence scenario; and Obtaining a pull request from a second client from the data exchange layer, wherein the pull request includes an identifier of a second user and a target intelligence data set requested by the second user, and determining whether the second client has access rights to the target intelligence data set according to the identifier of the second user; In the case where the second user has access rights, querying the target intelligence data set in the intelligence library through the data processing layer, and sending the queried target intelligence data set to the data exchange layer; The target intelligence data set received from the data processing layer is sent to the second client through the data exchange layer.

7. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, When one or more computer programs are executed by one or more processors, the one or more processors are caused to implement the method of any one of claims 1 to 5.

8. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to implement the method of any one of claims 1 to 5.

9. A computer program product, comprising computer executable instructions, wherein the instructions are used to implement the method according to any one of claims 1 to 5 when executed.

Images