Method, device, electronic device and medium for predicting black market attack trends

Abstract

The present disclosure provides a method for predicting the trend of black industry attacks, which can be applied to the field of information security technology. The method includes obtaining information published in at least one black industry trading platform to obtain M original black industry intelligence; processing the original black industry intelligence into structured black industry intelligence to be analyzed, wherein the M original black industry intelligence corresponds to the M black industry intelligence to be analyzed; classifying the M black industry intelligence to be analyzed based on predetermined rules to obtain at least one black industry intelligence category; sorting the at least one black industry intelligence category according to the number of black industry intelligence to be analyzed contained in each black industry intelligence category, so as to predict the attack trend of the black industry according to the sorting result. The present disclosure also provides a device, equipment, storage medium and program product for predicting the trend of black industry attacks.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and more specifically to a method, device, electronic device, medium, and program product for predicting black market attack trends. Background Art

[0002] Black industry refers to cyber black industry, which can include "hacking", "account theft", "phishing websites", etc. With the rapid development of mobile Internet technology, black industry poses a great threat to the information system security and business stability of all walks of life. At present, the measures for threat perception and risk prevention and control are mainly based on attack behavior identification and interception. However, when the attack behavior or external threat is implemented, it can only be discovered and identified, usually after data or economic losses have been caused. Summary of the invention

[0003] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for predicting black market attack trends, which can prevent attacks in advance before they are carried out.

[0004] According to the first aspect of the present disclosure, a method for predicting the trend of black industry attacks is provided. The method includes: obtaining information published in at least one black industry trading platform to obtain M original black industry intelligence, where M is an integer greater than 1; processing the original black industry intelligence into structured black industry intelligence to be analyzed, where the M original black industry intelligence corresponds to the M black industry intelligence to be analyzed; classifying the M black industry intelligence to be analyzed based on predetermined rules to obtain at least one black industry intelligence category; and sorting the at least one black industry intelligence category according to the number of black industry intelligence to be analyzed contained in each black industry intelligence category, so as to predict the attack trend of the black industry according to the sorting result.

[0005] According to an embodiment of the present disclosure, the classifying the M black industry intelligence to be analyzed based on predetermined rules to obtain at least one black industry intelligence category includes: clustering the M black industry intelligence to be analyzed to obtain S second categories, where S is an integer greater than or equal to 1; and obtaining the at least one black industry intelligence category based on the S second categories.

[0006] According to an embodiment of the present disclosure, obtaining the at least one black industry intelligence category based on the S second categories includes: classifying the M black industry intelligence to be analyzed into categories based on keywords set based on prior experience to obtain N first categories, where N is an integer greater than 1; merging the first categories and the second categories whose similarities meet a threshold condition into a third category; and obtaining the at least one black industry intelligence category based on the merged third category and the remaining first categories and the second categories that cannot be merged.

[0007] According to an embodiment of the present disclosure, merging the first category and the second category whose similarity meets a threshold condition into a third category includes: obtaining a first keyword set for the first category; obtaining at least one second keyword corresponding to the second category, wherein the at least one second keyword is at least one word with the highest frequency of occurrence in the second category; characterizing the similarity between the first category and the second category by the similarity between the first keyword and the at least one second keyword; and merging the first category and the second category to obtain the third category when the similarity meets the threshold condition.

[0008] According to an embodiment of the present disclosure, before merging the first category and the second category whose similarity meets the threshold condition into a third category, the method further includes: obtaining a word frequency statistical result by performing word frequency statistics on the information set consisting of all the black industry intelligence to be analyzed in each of the second categories; and selecting at least one word with the highest word frequency in the word frequency statistical result to obtain the at least one second keyword.

[0009] According to an embodiment of the present disclosure, after sorting the at least one black industry intelligence category according to the number of the black industry intelligence to be analyzed contained in each of the black industry intelligence categories, the method further includes: outputting information of a group of black industry intelligence categories that are ranked higher in the number of the black industry intelligence to be analyzed in the at least one black industry intelligence category.

[0010] According to an embodiment of the present disclosure, the output of information of a group of black industry intelligence categories in which the number of black industry intelligence to be analyzed is ranked top in at least one of the black industry intelligence categories includes: when the output black industry intelligence category is the first category, outputting the first keyword corresponding to the first category; when the output black industry intelligence category is the second category, outputting the at least one second keyword corresponding to the second category; and when the output black industry intelligence category is the third category, outputting the first keyword corresponding to the first category before being merged to obtain the third category, and the at least one second keyword corresponding to the second category before being merged.

[0011] According to an embodiment of the present disclosure, clustering the M pieces of black industry intelligence to be analyzed to obtain S second categories includes: converting each word in the black industry intelligence to be analyzed into a word vector; accumulating the word vectors corresponding to all words in each piece of black industry intelligence to be analyzed to obtain a text vector corresponding to the black industry intelligence to be analyzed; and clustering the M pieces of black industry intelligence to be analyzed based on the text vectors corresponding to each of the M pieces of black industry intelligence to be analyzed.

[0012] According to an embodiment of the present disclosure, the method of classifying the M pieces of black market intelligence to be analyzed based on a predetermined rule to obtain at least one black market intelligence category includes: classifying the M pieces of black market intelligence to be analyzed based on keywords set based on prior experience to obtain N first categories. Each of the first categories is regarded as a black market intelligence category.

[0013] According to an embodiment of the present disclosure, the method of classifying the M black market intelligence to be analyzed into categories based on the keywords set based on prior experience includes: obtaining N pre-set first keywords, where N is an integer greater than 1; and classifying the black market intelligence to be analyzed that matches each of the first keywords into the category corresponding to the first keyword.

[0014] According to an embodiment of the present disclosure, the processing of the original black industry intelligence into structured black industry intelligence to be analyzed includes: identifying the data type of the original black industry intelligence; using a processing method corresponding to the data type to obtain text information described in a natural language in the original black industry intelligence; and structuring the text information to obtain the black industry intelligence to be analyzed.

[0015] In another aspect of the embodiments of the present disclosure, a device for predicting the trend of black industry attacks is provided. The device includes an acquisition module, a structured processing module, a category division module, and a sorting module. The acquisition module is used to acquire information published in at least one black industry trading platform to obtain M original black industry intelligence; wherein M is an integer greater than 1. The structured processing module is used to process the original black industry intelligence into structured black industry intelligence to be analyzed, wherein the M original black industry intelligence corresponds to the M black industry intelligence to be analyzed. The category division module is used to classify the M black industry intelligence to be analyzed based on predetermined rules to obtain at least one black industry intelligence category. The sorting module is used to sort the at least one black industry intelligence category according to the number of black industry intelligence to be analyzed contained in each black industry intelligence category, so as to predict the attack trend of the black industry according to the sorting result.

[0016] According to an embodiment of the present disclosure, the classification module includes a clustering submodule. The clustering submodule is used to cluster the M black market intelligence to be analyzed to obtain S second categories, where S is an integer greater than or equal to 1.

[0017] According to an embodiment of the present disclosure, the category division module also includes a matching submodule and a category integration submodule. The matching submodule is used to classify the M black market intelligence to be analyzed based on the keywords set by prior experience, and obtain N first categories, where N is an integer greater than 1. The category integration submodule is used to merge the first category and the second category whose similarity meets the threshold condition into a third category, and obtain the at least one black market intelligence category based on the third category obtained by the merger and the remaining first category and the second category that cannot be merged.

[0018] According to an embodiment of the present disclosure, the category classification module further includes an index submodule. The index submodule is used to obtain a word frequency statistical result by performing word frequency statistics on the information set consisting of all the black industry intelligence to be analyzed in each of the second categories, and select at least one word with the highest word frequency in the word frequency statistical result to obtain the at least one second keyword.

[0019] According to an embodiment of the present disclosure, the device further includes an output module. The output module is used to output information of a group of black industry intelligence categories with a higher ranking in the number of black industry intelligence to be analyzed in the at least one black industry intelligence category.

[0020] A third aspect of the present disclosure provides an electronic device. The electronic device includes: one or more processors, and a memory. The memory is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors execute the above method.

[0021] The fourth aspect of the present disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above method.

[0022] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above method when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0024] Figure 1 The following schematically shows an application scenario diagram of a method, device, electronic device, medium, and program product for predicting a black market attack trend according to an embodiment of the present disclosure;

[0025] Figure 2 A flowchart of a method for predicting a black market attack trend according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 3 A flowchart of structured processing of original black market intelligence in a method according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 4 Schematically illustrates various rules for classifying M pieces of black market intelligence to be analyzed in the method according to an embodiment of the present disclosure;

[0028] Figure 5 A flowchart schematically shows a method of classifying M black market intelligence to be analyzed according to prior experience according to an embodiment of the present disclosure;

[0029] Figure 6 A flowchart of clustering M black market intelligence to be analyzed according to an embodiment of the present disclosure is schematically shown;

[0030] Figure 7 A flowchart for classifying M pieces of black market intelligence to be analyzed according to an embodiment of the present disclosure is schematically shown;

[0031] Figure 8 A schematic diagram schematically shows a category of outputting black market intelligence according to an embodiment of the present disclosure;

[0032] Fig. 9 The structure block diagram of the device for predicting the trend of black market attacks according to an embodiment of the present disclosure is schematically shown;

[0033] Fig.10 The structural block diagram of the category classification module in the device for predicting the trend of black market attacks according to an embodiment of the present disclosure is schematically shown;

[0034] Fig.11 The structure block diagram of a device for predicting black market attack trends according to another embodiment of the present disclosure is schematically shown;

[0035] Fig.12 Schematically shows Fig.11 A structural block diagram of a black market intelligence extraction module in the device shown;

[0036] Fig.13 Schematically shows Fig.11 A structural block diagram of a black industry intelligence analysis module in the device shown;

[0037] Fig.14 Schematically showing the use of Fig.11 A flowchart of using the device shown to predict the trend of black market attacks; and

[0038] Fig.15 A block diagram of an electronic device suitable for implementing a method for predicting a trend of black market attacks according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0039] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0040] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0041] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0042] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0043] Currently, the threat perception and risk prevention and control of financial enterprises are mainly based on account and transaction dimensions. They can only be discovered and identified after attacks or external threats occur, which usually causes data or economic losses.

[0044] In the process of long-term work related to information security in the financial field, the inventor discovered that some black industry businesses have formed a black trading industry chain in the real world. For example, some criminals will develop black industry tools, some criminals will buy these black industry tools to carry out attacks, and some criminals will steal data and then buy and sell data. These criminals often publish transaction information and conduct transactions in some black industry trading platforms (for example, forums, or social network chat groups) through some covert means (for example, agreed black industry terms). Based on this discovery, the inventor imagines that if it is possible to connect to these black industry trading platforms, obtain the information published in these black industry trading platforms in a timely manner, and analyze and process this information to obtain the current black industry attack trend characteristics, it is possible to predict the next black industry behavior trend, identify the attack purpose and attack method that criminals may master, so as to guide users to strengthen their perception of potential attacks, timely make up for the possible loopholes in the system, and control before the attack is implemented.

[0045] In view of this, the embodiments of the present disclosure provide a method, device, system, medium and program product for predicting the trend of black industry attacks. The method includes first obtaining information published in at least one black industry trading platform to obtain M original black industry intelligence. Then the original black industry intelligence is processed into structured black industry intelligence to be analyzed, wherein the M original black industry intelligence corresponds to M black industry intelligence to be analyzed. Next, the M black industry intelligence to be analyzed are classified based on predetermined rules to obtain at least one black industry intelligence category. Thereafter, at least one black industry intelligence category is sorted according to the number of black industry intelligence to be analyzed contained in each black industry intelligence category, so as to predict the attack trend of the black industry according to the sorting result. In this way, threat perception of the black industry intelligence dimension is introduced, and attack prediction is performed from the black industry intelligence dimension, and possible attack targets and / or attack methods are identified and predicted, so that prevention and response can be carried out before the attack behavior is implemented.

[0046] Figure 1 The application scenario diagram of the method, device, electronic device, medium and program product for predicting the trend of black market attacks according to an embodiment of the present disclosure is schematically shown.

[0047] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a terminal device 101, an external website server 102, a background server 103, and a user terminal 104. The background server 103 may be connected to the terminal device 101 and / or the external website server 102 through a network (e.g., the Internet). In addition, the background server 103 may also be connected to the user terminal 104 through a network (e.g., an intranet).

[0048] The backend server 103 can execute the method of the embodiment of the present disclosure, obtain the original black industry intelligence from the corresponding black industry trading platform through the communication connection with the terminal device 101 and / or the external website server 102, and then output the result of the processing and analysis of the original black industry intelligence to the user terminal 104 to display it to the user 105. Among them, the terminal device 101 and the user terminal 105 can be the same or different terminals.

[0049] The backend server 103 can obtain the original black market transaction intelligence through communication with the terminal device 101. For example, the terminal device 101 can be used to log in to a forum, social network chat group, or website page where black market transactions are conducted, and then crawl information from it. For example, the login qualification of the forum, social network chat group, or website page where black market transactions are conducted can be obtained by identity disguise, and then the login can be performed on the terminal device 101. After logging in, when messages are posted on these black market transaction platforms, the messages can be crawled and sent to the backend server 103 for processing.

[0050] The backend server 103 can also obtain the original black market transaction intelligence by communicating with the external website server 102. For example, the external website server 102 can be a website server of some social networking sites. After long-term research and tracking by information security personnel, it is found that some forums or social groups involve black market transaction information. Or, for example, the external website server 102 can be some websites that provide servers specifically for black market transactions, which are found after long-term tracking by information security personnel. The backend server 103 can be connected to the external website server 102 by means of some robots or API interfaces, and crawl the information published in the black market transaction platform from some specific services or programs in the website server 102.

[0051] The method for predicting the black market attack trend provided by the embodiment of the present disclosure can generally be executed by the background server 103. Accordingly, the apparatus, electronic device, medium and program product for predicting the black market attack trend provided by the embodiment of the present disclosure can generally be set in the background server 103.

[0052] Understandably, Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0053] It should be noted that the method, device, electronic device, medium and program product for predicting black market attack trends determined in the embodiments of the present disclosure can be used in the financial field, and can also be used in any field other than the financial field. The present disclosure does not limit the application field.

[0054] In addition, in the technical solution disclosed in the present invention, the acquisition, storage and application of user personal information involved all comply with the provisions of relevant laws and regulations, take necessary confidentiality measures, and do not violate public order and good morals.

[0055] The following will be based on Figure 1 The scene described by Figure 2 to Figure 8 The method for predicting the trend of black market attacks in the disclosed embodiment is described in detail.

[0056] Figure 2 The flowchart of the method for predicting the trend of black market attacks according to an embodiment of the present disclosure is schematically shown.

[0057] like Figure 2 As shown, the method for predicting the trend of black market attacks in this embodiment may include operations S210 to S240, and the method may be executed by the server 103.

[0058] First, in operation S210, obtain the information published in at least one black industry trading platform to obtain M original black industry intelligence, where M is an integer greater than 1. The source of information generally includes black industry trading platforms in social media platforms such as forums, QQ groups, WeChat groups, and telegram (for example, posts or group discussions on specific topics, etc.). The information published mainly includes but is not limited to black industry attack tools, sensitive information trading, donkey (Money Mule) account trading, money laundering, drainage and water injection, etc. The information published in these black industry trading platforms can be obtained by using crawlers, robots, API interfaces and other methods, such as using QQ group robots, telegram robots, forum crawlers and other tools to collect original black industry intelligence for threat analysis.

[0059] Then in operation S220, the original black industry intelligence is processed into structured black industry intelligence to be analyzed, wherein M pieces of original black industry intelligence correspond to M pieces of black industry intelligence to be analyzed.

[0060] The original black market intelligence usually contains a large amount of information such as pictures, icons, symbols, or XML structures. According to the embodiments of the present disclosure, regular matching, key identifier replacement, OCR image and text recognition, XML tag extraction, etc. can be used to filter out interference data such as symbols and pictures, so as to obtain effective natural language text information. Then, the natural text information is structured to obtain the black market intelligence to be analyzed.

[0061] Next, in operation S230, the M black industry intelligence to be analyzed are classified based on a predetermined rule to obtain at least one black industry intelligence category. For example, the classification can be performed according to the attack target, attack means, attack channel, and / or the business type involved. Alternatively, the M black industry intelligence to be analyzed can be automatically classified or clustered using natural language processing technology.

[0062] Then, in operation S240, at least one black industry intelligence category is sorted according to the number of black industry intelligence to be analyzed contained in each black industry intelligence category, so as to predict the attack trend of the black industry according to the sorting result.

[0063] After the acquired black industry intelligence is classified, it is sorted according to the number of intelligence in each category. The black industry intelligence categories with higher rankings belong to the categories with higher popularity in the current black industry industry chain. According to the attack targets, attack methods, attack channels, etc. of these black industry intelligence categories with higher rankings, the current hot attack trends of the black industry can be reflected, so as to guide users to timely check the vulnerabilities in their own systems and take precautions and respond before the attack behavior is implemented.

[0064] According to the embodiments of the present disclosure, by actively detecting the information released in the black market trading platform to discover potential threats from the black market, users can find risk vulnerabilities before the black market attacks, and make rectification and investigation and other processing actions accordingly, thereby improving the threat perception and response and protection capabilities against black market attacks.

[0065] Figure 3 The flowchart of operation S220 for structured processing of original black market intelligence in the method according to an embodiment of the present disclosure is schematically shown.

[0066] like Figure 3 As shown, according to this embodiment, the process of structuring the original black market intelligence in operation S220 may include operations S301 to S303.

[0067] First, in operation S301, the data type of the original black market intelligence is identified. For example, the data type of the original black market intelligence is identified by the suffix name, including but not limited to pictures, text, XML tag language, etc.

[0068] Then, in operation S302, a processing method corresponding to the data type is used to obtain text information described in natural language in the original black industry intelligence. For example, if the data type is a picture, the text information in the picture can be extracted through OCR image and text recognition. For another example, if the data type is text, special symbols and icons can be removed through regular matching. For example, if the data type is a tag language such as XML (for example, crawled web page data), the tag language can be extracted and the text information can be retained.

[0069] Then in operation S303, the text information is structured to obtain the black market intelligence to be analyzed.

[0070] In one embodiment, the structured features of the black industry intelligence to be analyzed may include field information such as the time when the message was sent, the name of the sending account, the detailed content of the message, and the links contained in the message. For example, when the black industry intelligence to be segmented is recorded in a table, a black industry intelligence to be analyzed can form a record in the table, and each field in the record corresponds to each field in the structured features of the black industry intelligence to be analyzed. Among them, each original black industry intelligence forms a record. For example, when crawling information from a group chat, a speech is an original black industry intelligence, which is processed into a record accordingly. When a large amount of original black industry intelligence is crawled, a large number of records can be obtained accordingly after processing by operation S220, that is, a series of black industry intelligence to be analyzed.

[0071] Figure 4 The diagram schematically shows various rules for classifying M pieces of black market intelligence to be analyzed in operation S230 in the method according to an embodiment of the present disclosure.

[0072] like Figure 4 As shown, according to the embodiment of the present disclosure, in operation S230, M black market intelligence to be analyzed can be classified through one of operation S231, operation S232, or operation S233, wherein the rules for classifying in operation S231, operation S232, or operation S233 are different.

[0073] Specifically, in operation S231, the M black market intelligence to be analyzed can be classified based on the keywords set by prior experience, and the intelligence to be analyzed that matches the keywords are put together to obtain N first categories, where N is an integer greater than 1. In one embodiment, each first category can be used as a black market intelligence category obtained in operation S230.

[0074] In operation S232, M black market intelligence to be analyzed may be clustered to obtain S second categories, where S is an integer greater than or equal to 1. In one embodiment, each second category may be used as a black market intelligence category obtained in operation S230.

[0075] In practical applications, different classification rules in operation S231 and operation S232 can be selected based on whether the classification results are controllable and whether they are helpful in discovering new risks.

[0076] Specifically, when the classification is performed based on the keywords set based on prior experience in operation S231, the classification results can be artificially guided by the setting of keywords. For example, the potential attacked object that the user is concerned about (for example, the name of the organization where the user is located and its alternative words) can be used as a keyword, so that the attack trend against the potential attacked object can be known after classification.

[0077] The categories formed by clustering in operation S232 are helpful to discover potential, unknown attack risks. Since the categories are formed by clustering, it is possible to avoid manual intervention and omission of attack trend information. In this way, the current overall attack trend of the entire black industry chain can be known. However, if the current hot attack target in the black industry chain is not a potential target of attack that the user is concerned about, clustering can easily filter out a large amount of black industry intelligence that the user is not concerned about.

[0078] It can be seen that both the classification based on prior experience in operation S231 and the classification by clustering in operation S232 have their own advantages and disadvantages, and can be selected as needed in actual use. Alternatively, in other embodiments, these two methods can also be used in combination, such as operation S233.

[0079] In operation S233, on the one hand, the M black industry intelligence to be analyzed can be classified based on the keywords set by prior experience to obtain N first categories; on the other hand, the M black industry intelligence to be analyzed can be clustered to obtain S second categories; then the N first categories and the S second categories are deduplicated and integrated, for example, similar categories in the categories divided by two different rules are merged together, and dissimilar categories are retained, so as to obtain the integrated categories, thereby obtaining at least one black industry intelligence category in operation S230. In this way, in operation S233, the classification results can be guided according to prior experience, and new risks can be discovered through clustering.

[0080] Figure 5 The flowchart schematically shows the classification of M black market intelligence to be analyzed based on prior experience according to an embodiment of the present disclosure.

[0081] like Figure 5 As shown, according to this embodiment, the process of performing category division based on prior experience in operation S231 may include operations S501 to S502.

[0082] In operation S501, N pre-set first keywords are obtained, where N is an integer greater than 1. The first keywords may be, for example, attack-specific terms, target objects of black industry attacks, names of black industry attack channels, and types of black industry crimes. Assuming that it is necessary to detect whether black industry attacks a certain bank system, the target object of the black industry attack may be the name, code, or code of the bank; the name of the black industry attack channel may be, for example, mobile banking, e-commerce platform, or online banking; the types of black industry crimes may be, for example, credit card fraud, deduction of money, and buying and selling of facial information.

[0083] In operation S502, the black market intelligence to be analyzed that matches each first keyword is divided into a category corresponding to the first keyword. When a first keyword can match one or more black market intelligence to be analyzed, these black market intelligence to be analyzed can be regarded as belonging to a category, wherein the first keyword can reflect the attack trend of the category, for example, as an index of the category.

[0084] Since different first keywords reflect different attack trends, different first keywords may be matched to the black market intelligence to be analyzed. For example, when performing classification, one first keyword is used to match M black market intelligence to be analyzed each time.

[0085] Figure 6 The flowchart of clustering M black market intelligence to be analyzed according to an embodiment of the present disclosure is schematically shown.

[0086] like Figure 6 As shown, according to this embodiment, the clustering process in operation S232 may include operations S601 to S603.

[0087] First, in operation S601, each word in the black market intelligence to be analyzed is converted into a word vector. For example, the text in the black market intelligence to be analyzed can be segmented and then fed into a word2vec model to obtain a vector space representation of each word.

[0088] Then, in operation S602, the word vectors corresponding to all words in each black industry intelligence to be analyzed are accumulated to obtain the text vector corresponding to the black industry intelligence to be analyzed. For example, after word segmentation, the black industry intelligence n1 to be analyzed contains k words, which are recorded as w1, w2, ..., wk. The vector representations of these words are recorded as v1, v2, ..., vk respectively. Then the text vector of the black industry intelligence n1 to be analyzed can be expressed as v1+v2+...+vk.

[0089] Then in operation S603, based on the text vectors corresponding to the M black market intelligence to be analyzed, the M black market intelligence to be analyzed are clustered. A clustering algorithm, such as a neighbor propagation clustering algorithm, is used to divide the M black market intelligence to be analyzed into different attack trend clusters (ie, the second category).

[0090] After operation S603, the word frequency statistics can be performed on the information set consisting of all the black industry intelligence to be analyzed in each second category to obtain the word frequency statistics results, and then at least one word with the highest word frequency in the word frequency statistics results can be selected to obtain at least one second keyword. The at least one second keyword can reflect the attack trend of the second category, and can be used as an index and regarded as the attack trend keyword of the cluster. In one embodiment, the three words with the highest frequency in each cluster can be selected as the attack trend keywords of the cluster, and the attack trend keywords are used as indexes.

[0091] Figure 7 The flowchart schematically shows a process of classifying M pieces of black market intelligence to be analyzed according to an embodiment of the present disclosure.

[0092] like Figure 7 As shown, according to this embodiment, the process of performing category classification in operation S233 may include operation S231, operation S232, and operations S703 to S704.

[0093] Specifically, in operation S233, firstly, the categories are divided according to different rules through operation S231 and operation S232 to obtain N first categories and S second categories, and then the categories obtained by the two different rules are deduplicated and integrated through operation S703 to operation S704. Figure 5 and Figure 6 Related description.

[0094] In operation S703, the first category and the second category whose similarity meets the threshold condition are merged into a third category. In the merging process, only one of the same black market intelligence to be analyzed in the first category and the second category can be retained, so as to avoid the impact of the repeated black market intelligence to be analyzed in the merging on the amount of intelligence in the merged category, and reduce the negative impact on the sorting in operation S240.

[0095] When merging, each first category can be compared with all other second categories one by one. When the similarity meets the threshold condition, the corresponding first category and second category are merged. Then, the remaining first categories are compared with all other remaining second categories one by one. And so on, until all first categories are traversed.

[0096] When making a specific comparison, for example, you can obtain the first keyword set for the first category and at least one second keyword corresponding to the second category (that is, at least one word with the highest frequency of occurrence in the second category). Then, the similarity between the first keyword and the at least one second keyword is used to characterize the similarity between the first category and the second category. For example, assuming that there are 3 second keywords corresponding to the second category, when calculating the similarity, the first keyword and the 3 second keywords can be vectorized separately (for example, through the word2vec model), and then the similarity between the first keyword and the 3 second keywords can be calculated separately (for example, cosine similarity), and sim1, sim2, and sim3 are obtained, and then the mean sim is calculated as follows:

[0097]

[0098] The mean sim can be used to measure the similarity between the first category and the second category. When the mean sim is greater than a threshold (e.g., 0.9), it is considered that the similarity between the first category and the second category meets the threshold condition and belongs to the same category. In this way, the intelligence to be analyzed can be merged and integrated to obtain a third category, and the amount of intelligence in the third category is updated accordingly.

[0099] In operation S704, at least one black industry intelligence category is obtained based on the third category obtained by merging and the remaining first category and second category that cannot be merged. As described above, the at least one black industry intelligence category obtained in this way can guide the classification results based on prior experience classification, and can also discover new risks through clustering.

[0100] Figure 8 A schematic diagram of outputting black market intelligence categories according to an embodiment of the present disclosure is schematically shown.

[0101] refer to Figure 8 , and combined with Figure 1 According to an embodiment of the present disclosure, after sorting according to the number of intelligence contained in each black industry intelligence category in operation S240, information of a group of black industry intelligence categories with a higher ranking in the number of black industry intelligence to be analyzed in at least one black industry intelligence category can also be output, for example, information of the 10 black industry intelligence categories with the largest number of intelligence can be output.

[0102] When outputting the black industry intelligence category, the attack trend keywords reflecting each black industry intelligence category can be output accordingly as an index. Figure 8When the output black industry intelligence category is the first category, the first keyword corresponding to the first category can be output accordingly. When the output black industry intelligence category is the second category, at least one second keyword corresponding to the second category can be output accordingly. When the output black industry intelligence category is the third category, the first keyword corresponding to the first category before merging to obtain the third category and at least one second keyword corresponding to the second category before merging can be output accordingly.

[0103] In this way, after outputting a group of black industry intelligence categories with the highest intelligence quantity according to the sorting results, users can quickly determine the current attack trends of the black industry based on the results. For example, they can understand the information of potential hot attack targets, hot attack methods or channels of the black industry. It can also help users to discover the possible unrecognized loopholes in their systems as early as possible, plug the loopholes in time, or destroy the attack actions that the criminals are going to carry out as early as possible.

[0104] Based on the method for predicting the trend of black market attacks introduced above, the embodiment of the present disclosure also provides a device for predicting the trend of black market attacks. Figure 8 and Fig. 9 The device is described in detail.

[0105] Fig. 9 The structural block diagram of the device for predicting the trend of black market attacks according to an embodiment of the present disclosure is schematically shown.

[0106] like Fig. 9 As shown, the apparatus 900 for predicting the trend of black market attacks in this embodiment may include an acquisition module 910, a structured processing module 920, a classification module 930, and a sorting module 940. According to other embodiments of the present disclosure, the apparatus 900 may further include an output module 950. The apparatus 900 may be used to implement a reference Figure 2 to Figure 8 The method described.

[0107] The acquisition module 910 is used to acquire information published in at least one black market trading platform to obtain M original black market intelligence, where M is an integer greater than 1. In one embodiment, the acquisition module 910 can be used to perform the operation S210 described above.

[0108] The structured processing module 920 is used to process the original black market intelligence into structured black market intelligence to be analyzed, wherein M original black market intelligence corresponds to M black market intelligence to be analyzed. In one embodiment, the structured processing module 920 can be used to perform the operation S220 described above.

[0109] The classification module 930 is used to classify the M black market intelligence to be analyzed based on a predetermined rule to obtain at least one black market intelligence category. In one embodiment, the classification module 930 can be used to perform the operation S230 described above.

[0110] The sorting module 940 is used to sort at least one black industry intelligence category according to the amount of black industry intelligence to be analyzed contained in each black industry intelligence category, so as to predict the attack trend of the black industry according to the sorting result. In one embodiment, the sorting module 940 can be used to perform the operation S240 described above.

[0111] The output module 950 is used to output information of a group of black industry intelligence categories with the highest number of black industry intelligence to be analyzed in at least one black industry intelligence category. In one embodiment, the output module 950 can be as follows: Figure 8 Information of the black industry intelligence category is output in the manner shown.

[0112] Fig.10 The structural block diagram of the category classification module 930 in the device 900 for predicting the trend of black market attacks according to an embodiment of the present disclosure is schematically shown.

[0113] like Fig.10 As shown, the category division module 930 may include a clustering submodule 931 , a matching submodule 932 , a category integration submodule 933 , and an indexing submodule 934 .

[0114] The clustering submodule 931 is used to cluster the M black market intelligence to be analyzed to obtain S second categories, where S is an integer greater than or equal to 1. In one embodiment, the clustering submodule 931 can be used to perform the operation S232 described above.

[0115] The matching submodule 932 is used to classify the M black market intelligence to be analyzed based on the keywords set by prior experience, and obtain N first categories, where N is an integer greater than 1. In one embodiment, the matching submodule 932 can be used to perform the operation S231 described above.

[0116] The category integration submodule 933 is used to merge the first category and the second category whose similarity meets the threshold condition into a third category, and to obtain at least one black market intelligence category based on the merged third category and the remaining first category and second category that cannot be merged. In one embodiment, the category integration submodule 933 can be used to perform operations S703 to S704 described above.

[0117] The index submodule 934 is used to obtain the word frequency statistics results by performing word frequency statistics on the information set consisting of all the black industry intelligence to be analyzed in each second category, and select at least one word with the highest word frequency in the word frequency statistics results to obtain at least one second keyword. Among them, for the second category obtained by clustering, the at least one second keyword can be used to represent the attack trend of the second category. The index submodule 934 can also be used for each first category, using the first keyword set for the first category as an index to characterize the attack trend of the first category.

[0118] Based on the method for predicting the trend of black market attacks described above, another embodiment of the present disclosure further provides a device for predicting the trend of black market attacks. Figure 11 to Figure 14 The device is described in detail. It should be noted that Figure 11 to Figure 14 The described device and its use process are merely exemplary applications and do not constitute a limitation to the present disclosure.

[0119] Fig.11 The structural block diagram of a device 1100 for predicting black market attack trends according to another embodiment of the present disclosure is schematically shown.

[0120] like Fig.11 As shown, according to this embodiment, the device 1100 for predicting the trend of black market attacks may include a black market intelligence extraction module 1 and a black market intelligence analysis module 2.

[0121] The black industry intelligence extraction module 1 is used to obtain the original black industry intelligence, clean and extract features from the intelligence data, and obtain the black industry intelligence features and intelligence elements.

[0122] The black industry intelligence analysis module 2 is used to perform big data allocation and rule matching on the cleaned black industry intelligence data and output the investigation results.

[0123] Fig.12 Schematically shows Fig.11 The structural block diagram of the black market intelligence extraction module 1 in the device shown.

[0124] like Fig.12 As shown, the black industry intelligence extraction module 1 may include a black industry intelligence crawling unit 101 and a black industry intelligence cleaning unit 102. The main function of the black industry intelligence crawling unit 101 is to collect original black industry intelligence. The main function of the black industry intelligence cleaning unit 102 is to pre-process and clean the original black industry intelligence, remove non-critical information in the black industry intelligence, and after obtaining the cleaned data, transmit the data to the black industry intelligence analysis module 2 for analysis.

[0125] Black industry intelligence crawling unit 101: The main function is to obtain original black industry intelligence information. The information source generally includes black industry information released in forums, QQ groups, WeChat groups, telegram and other social media platforms, mainly including but not limited to black industry upstream attack tools, sensitive information trading, donkey account trading, money laundering, drainage and water injection and other information. Use crawlers, robots and API interfaces to obtain black industry intelligence information from the above channels, such as using QQ group robots, telegram robots, forum crawlers and other tools to collect black industry intelligence information for threat analysis.

[0126] Black industry intelligence cleaning unit 102: Mainly responsible for cleaning the collected original black industry intelligence data, removing interference information and invalid information in the data, so as to more effectively mine the threat intelligence. In most cases, the original black industry intelligence obtained contains a large amount of information such as pictures, icons, symbols, XML structures, etc. Regular matching, key identifier replacement, OCR image and text recognition, XML tag extraction, etc. are used to filter out interference data such as symbols and pictures, so as to obtain effective natural language text information. The unit first determines the black industry intelligence data type by the suffix name, including but not limited to pictures, text, XML tag language, etc.; if the data type is a picture, OCR image and text recognition is performed to extract the text information in the picture. If the data type is text, the data is read in to remove special symbols and icons. If the data type is a tag language such as XML, the tag language is extracted and the text information is retained.

[0127] Fig.13 Schematically shows Fig.11 The structural block diagram of the black industry intelligence analysis module 2 in the device shown.

[0128] like Fig.13 As shown, the black market intelligence analysis module 2 may include an intelligence feature structuring unit 201 , an intelligence information matching unit 202 , an algorithm analysis unit 203 and a risk output unit 204 .

[0129] The intelligence feature structuring unit 201 is used to receive the data type extracted by the black industry intelligence cleaning unit 102 and perform structured processing to obtain the black industry intelligence to be analyzed. For example: the XML data structure of the intelligence feature structuring unit 201 cannot be directly calculated by the algorithm and needs to be converted into structured data. According to the needs of the upstream intelligence analysis of the black industry, the XML semi-structured data is converted into structured data. The structural features include the message sending time, the sending account name (for example, the first-priority sending account name, the second-priority sending account name for message forwarding, etc.), the message details and the links contained in the message, etc., for subsequent modeling.

[0130] Intelligence information matching unit 202: responsible for receiving and processing the black industry intelligence to be analyzed output after the structured processing of the intelligence feature structuring unit 201, and matching and screening the black industry intelligence to be analyzed according to the keywords preset by prior experience (for example, setting a white list composed of the first keyword). For example, the black industry intelligence categories such as specific attack-specific terms, target enterprises of black industry attacks, channel names of black industry attacks, and types of black industry crimes can be screened by setting the first keyword. This can be used to quickly identify risk targets and attack trends from massive data. The obtained black industry intelligence category is then passed to the risk output unit 204.

[0131] The algorithm analysis unit 203 is responsible for converting the black industry intelligence to be analyzed generated by the intelligence feature extraction unit 201 into a text vector representation, and classifying the black industry attack words with high similarity through a clustering algorithm. Specifically, the intelligence after word segmentation by the feature extraction unit 201 is sent to the word2vec model to obtain the vector space representation of each word, and the vector representations of each word in the intelligence are added to obtain the vector representation of the intelligence. For example, after word segmentation, intelligence n1 contains k words, w1, w2, ..., wk, and their vector representations are recorded as v1, v2, ..., vk respectively, then the vector representation of n1 is v1+v2+...+vk. Subsequently, a clustering algorithm, such as a neighbor propagation clustering algorithm, is used to divide the intelligence into different attack trend clusters, and then the word frequency statistics of the intelligence in each attack cluster are performed, and the three words with the highest frequency of occurrence in each cluster (i.e., the three second keywords) are selected as the attack trend keywords of the cluster, and the attack trend keywords are used as indexes to pass the total amount of intelligence in each attack cluster to the risk output unit 204 for analysis.

[0132] The risk output unit 204 is responsible for analyzing and integrating the first keywords such as the attack-specific terms, target enterprises of black market attacks, channel names of black market attacks, and types of black market crimes obtained from the intelligence information matching unit 202 and the attack trend keywords (i.e., the second keywords) obtained by the algorithm analysis unit 203 and the total amount of intelligence, outputting high-frequency black market words and judging the attack trends.

[0133] During the integration process, the similarity sim between the first keyword and the three attack trend keywords in each cluster can be calculated first (for example, as shown in formula (1)). If the similarity sim is greater than 0.9, the two categories are classified as the same category, the intelligence in them is merged and integrated, and the total intelligence is updated. Then, the intelligence in each category can be sorted according to the number of intelligence, and the top 10 black industry intelligence categories are selected for output display.

[0134] Fig.14 Schematically showing the use of Fig.11 The flowchart of the device shown is used to predict the trend of black market attacks.

[0135] like Fig.14 As shown, the process of using the device 1100 to predict the trend of black market attacks can be roughly divided into the following steps S01 to S04.

[0136] Step S01: Use robots or web crawlers to collect original intelligence data published on black market trading platforms;

[0137] Step S02: Preprocess the original information, remove irregular characters, expressions, and pictures, and extract the specified text file.

[0138] Step S03: Perform rule matching and natural language analysis on the cleaned intelligence data, conduct word frequency and part-of-speech analysis, and screen the most frequent attacking public opinions.

[0139] Step S04: Output and analyze the high-frequency words and key information matching results to determine the attack trend.

[0140] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 910, the structured processing module 920, the category division module 930, the sorting module 940, the output module 950, the black industry intelligence extraction module 1, and the black industry intelligence analysis module 2 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 910, the structured processing module 920, the category division module 930, the sorting module 940, the output module 950, the black industry intelligence extraction module 1, and the black industry intelligence analysis module 2 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the acquisition module 910, the structured processing module 920, the category classification module 930, the sorting module 940, the output module 950, the black market intelligence extraction module 1, and the black market intelligence analysis module 2 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is executed.

[0141] Fig.15 A block diagram of an electronic device 1500 suitable for implementing a method for predicting a trend of black market attacks according to an embodiment of the present disclosure is schematically shown.

[0142] like Fig.15As shown, the electronic device 1500 according to an embodiment of the present disclosure includes a processor 1501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1502 or a program loaded from a storage part 1508 into a random access memory (RAM) 1503. The processor 1501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1501 may also include an onboard memory for caching purposes. The processor 1501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0143] In RAM 1503, various programs and data required for the operation of electronic device 1500 are stored. Processor 1501, ROM 1502 and RAM 1503 are connected to each other via bus 1504. Processor 1501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1502 and / or RAM 1503. It should be noted that the program can also be stored in one or more memories other than ROM 1502 and RAM 1503. Processor 1501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0144] According to an embodiment of the present disclosure, the electronic device 1500 may further include an input / output (I / O) interface 1505, which is also connected to the bus 1504. The electronic device 1500 may further include one or more of the following components connected to the I / O interface 1505: an input portion 1506 including a keyboard, a mouse, etc.; an output portion 1507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1508 including a hard disk, etc.; and a communication portion 1509 including a network interface card such as a LAN card, a modem, etc. The communication portion 1509 performs communication processing via a network such as the Internet. A drive 1510 is also connected to the I / O interface 1505 as needed. A removable medium 1511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1510 as needed, so that a computer program read therefrom is installed into the storage portion 1508 as needed.

[0145] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0146] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1502 and / or RAM 1503 described above and / or one or more memories other than ROM 1502 and RAM 1503.

[0147] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method for predicting the trend of black market attacks provided by the embodiment of the present disclosure.

[0148] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0149] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1509, and / or installed from the removable medium 1511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0150] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1509, and / or installed from the removable medium 1511. When the computer program is executed by the processor 1501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0151] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0152] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0153] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0154] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for predicting a trend of a black market attack, comprising: Obtain information published on at least one black market trading platform to obtain M pieces of original black market intelligence, where M is an integer greater than 1; Processing the original black industry intelligence into structured black industry intelligence to be analyzed, wherein M pieces of the original black industry intelligence correspond to M pieces of the black industry intelligence to be analyzed; Classify the M black industry intelligence to be analyzed into categories based on a predetermined rule to obtain at least one black industry intelligence category; and Sorting the at least one black industry intelligence category according to the number of the black industry intelligence to be analyzed contained in each black industry intelligence category, so as to predict the attack trend of the black industry according to the sorting result; The method of classifying the M pieces of black market intelligence to be analyzed based on a predetermined rule to obtain at least one black market intelligence category includes: Clustering the M black market intelligence to be analyzed to obtain S second categories, where S is an integer greater than or equal to 1; Based on the keywords set by prior experience, the M black market intelligence to be analyzed are classified into categories to obtain N first categories, where N is an integer greater than 1; Merge the first category and the second category whose similarity meets the threshold condition into a third category, wherein only one of the first category and the second category of the same black market intelligence to be analyzed is retained during the merging process; and Based on the third category obtained by merging and the remaining first category and second category that cannot be merged, the at least one black industry intelligence category is obtained.

2. The method according to claim 1, wherein: The step of merging the first category and the second category whose similarity meets the threshold condition into a third category comprises: Obtaining a first keyword set for the first category; Acquire at least one second keyword corresponding to the second category, wherein the at least one second keyword is at least one word with the highest frequency of occurrence in the second category; Characterizing the similarity between the first category and the second category by the similarity between the first keyword and the at least one second keyword; and When the similarity satisfies the threshold condition, the first category and the second category are merged to obtain the third category.

3. The method according to claim 2, wherein: Before merging the first category and the second category whose similarities satisfy the threshold condition into a third category, the method further includes: By performing word frequency statistics on the information set consisting of all the black market intelligence to be analyzed in each of the second categories, a word frequency statistical result is obtained; and At least one word with the highest word frequency in the word frequency statistics result is selected to obtain the at least one second keyword.

4. The method according to claim 3, wherein: After sorting the at least one black industry intelligence category according to the number of the black industry intelligence to be analyzed contained in each black industry intelligence category, the method further includes: Output information of a group of black industry intelligence categories whose quantity of the black industry intelligence to be analyzed is ranked top among the at least one black industry intelligence category.

5. The method according to claim 4, wherein: The outputting of information of a group of black industry intelligence categories with the highest order of the black industry intelligence to be analyzed in the at least one black industry intelligence category includes: When the outputted black market intelligence category is the first category, outputting the first keyword corresponding to the first category; When the outputted black market intelligence category is the second category, outputting the at least one second keyword corresponding to the second category; and When the output black market intelligence category is the third category, the first keyword corresponding to the first category before being merged to obtain the third category and the at least one second keyword corresponding to the second category before being merged are output.

6. The method according to any one of claims 1 to 5, wherein: The clustering of the M black market intelligence to be analyzed to obtain S second categories includes: Convert each word in the black market intelligence to be analyzed into a word vector; Accumulate the word vectors corresponding to all words in each of the black industry intelligence to be analyzed to obtain the text vector corresponding to the black industry intelligence to be analyzed; and Based on the text vectors corresponding to each of the M black market intelligence to be analyzed, the M black market intelligence to be analyzed are clustered.

7. The method according to claim 1, wherein: The keywords set based on prior experience to classify the M black market intelligence to be analyzed include: Obtaining N preset first keywords, where N is an integer greater than 1; The black market intelligence to be analyzed that matches each of the first keywords is classified into a category corresponding to the first keyword.

8. The method according to claim 1, wherein: The processing of the original black industry intelligence into structured black industry intelligence to be analyzed includes: Identify the data type of the original black market intelligence; Using a processing method corresponding to the data type to obtain text information described in natural language in the original black industry intelligence; and The text information is structured to obtain the black market intelligence to be analyzed.

9. A device for predicting a trend of a black market attack, comprising: An acquisition module, used to acquire information published in at least one black market trading platform, and obtain M original black market intelligence; wherein M is an integer greater than 1; A structured processing module, used for processing the original black industry intelligence into structured black industry intelligence to be analyzed, wherein M pieces of the original black industry intelligence correspond to M pieces of the black industry intelligence to be analyzed; A classification module, used to classify the M black market intelligence to be analyzed based on a predetermined rule to obtain at least one black market intelligence category; A sorting module, used to sort the at least one black industry intelligence category according to the number of the black industry intelligence to be analyzed contained in each black industry intelligence category, so as to predict the attack trend of the black industry according to the sorting result; Wherein, the category division module includes a clustering submodule, a matching submodule and a category integration submodule; The clustering submodule is used to cluster the M black market intelligence to be analyzed to obtain S second categories, where S is an integer greater than or equal to 1; The matching submodule is used to classify the M black market intelligence to be analyzed into categories based on the keywords set by prior experience, and obtain N first categories, where N is an integer greater than 1; The category integration submodule is used to: merge the first category and the second category whose similarity meets the threshold condition into a third category, wherein during the merging process, only one of the first category and the second category of the same black industry intelligence to be analyzed is retained; and obtain the at least one black industry intelligence category based on the merged third category and the remaining first category and second category that cannot be merged.

10. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 8.

Images