A method, device, equipment and medium for building a threat intelligence sharing behavior group

Abstract

The present invention relates to a method, device, equipment and medium for constructing a threat intelligence sharing behavior group, wherein the threat intelligence sharing behavior group includes multiple sharing clusters, each sharing cluster includes a holder and a demander of threat intelligence, and the method includes: in response to determining that a Nash equilibrium solution is reached between a holder and a demander through a Nash equilibrium model, obtaining a sharing cluster including the holder and the demander; constructing a threat intelligence sharing behavior group through a preset relationship between a holder in one sharing cluster and a demander in another sharing cluster, so as to share threat intelligence between the holder and the demander. The present invention effectively simplifies the construction process of the threat intelligence sharing behavior group, shortens the construction time, improves the timeliness of intelligence sharing, and while maximizing the value of threat intelligence, it is more helpful to shorten the defense response cycle and assist defenders in responding to threats in the first place.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, device, equipment and medium for building a threat intelligence sharing behavior group. Background Art

[0002] Threat intelligence is a form of intelligence in the field of cyberspace confrontation. It forms threat intelligence elements, including threat indicators or action guidelines, by mining and analyzing valuable information in massive data. Threat intelligence sharing is the process of threat intelligence holders sharing threat intelligence with threat intelligence demanders. The establishment of threat intelligence sharing organizations helps to increase the speed of intelligence circulation and shorten the defense response cycle. At present, the formation of different threat intelligence holders and threat intelligence demanders involves many factors and the process is relatively complicated. The formation of sharing actors depends on the cost and expected benefits of intelligence sharing. The construction cycle of threat intelligence sharing behavior groups is extended due to the distrust relationship between different organizations and their different positions in the threat intelligence community. The identification of high-value threat intelligence holders urgently needs to simplify the process, which will help speed up the update of threat intelligence sharing behavior groups and improve the timeliness of intelligence sharing. Summary of the invention

[0003] In view of this, the present invention provides a method, device, equipment and medium for constructing a threat intelligence sharing behavior group, constructing a sharing cluster based on a threat intelligence holder and a demander that achieve a Nash equilibrium solution, and then constructing a threat intelligence sharing behavior group based on the sharing cluster, effectively simplifying the construction process of the threat intelligence sharing behavior group, shortening the construction time, improving the timeliness of intelligence sharing, shortening the defense response cycle, maximizing the value of threat intelligence, and at least partially solving the problems existing in the prior art.

[0004] The specific content of the invention is:

[0005] A method for constructing a threat intelligence sharing behavior group, the threat intelligence sharing behavior group comprising a plurality of sharing clusters, each sharing cluster comprising a holder and a demander of threat intelligence, the method comprising:

[0006] In response to determining that a Nash equilibrium solution is reached between the holder and the demander through the Nash equilibrium model, a shared cluster including the holder and the demander is obtained;

[0007] A threat intelligence sharing behavior group is constructed through a preset relationship between a holder in one sharing cluster and a demander in another sharing cluster, so as to share threat intelligence between the holder and the demander.

[0008] Furthermore, the method of determining the Nash equilibrium solution between the holder and the demander through the Nash equilibrium model includes:

[0009] Calculate the parameters of the holder and the demander through the Nash equilibrium model, determine the game benefits of the holder and the demander, and judge whether the game benefit relationship conforms to the preset judgment logic. If so, determine that the holder and the demander have reached a Nash equilibrium;

[0010] Among them, the parameters of the holder include at least one of the following: threat intelligence sharing cost, threat intelligence sharing value, and threat intelligence non-sharing loss; the parameters of the demander include at least one of the following: threat intelligence self-acquisition cost and threat intelligence learning cost.

[0011] Furthermore, through the preset relationship between the holder in one sharing cluster and the demander in another sharing cluster, a threat intelligence sharing behavior group is constructed, including:

[0012] In response to determining that a holder in the one sharing cluster and a demander in the other sharing cluster reach a Nash equilibrium solution, a threat intelligence sharing behavior group is constructed.

[0013] Furthermore, the preset relationship between the holder in one shared cluster and the demander in another shared cluster includes:

[0014] The preset relationship between the holder of the one sharing cluster and the demander in another sharing cluster within a preset range is determined in sequence to construct a threat intelligence sharing behavior group.

[0015] Furthermore, after the threat intelligence sharing behavior group is constructed, the method further includes:

[0016] Undirected edges are formed between the shared clusters in the threat intelligence sharing behavior group according to the corresponding relationship that achieves the Nash equilibrium solution, and a shared cluster network is constructed to determine the importance of each shared cluster.

[0017] Furthermore, after the shared cluster network is constructed, the method further comprises:

[0018] The shared cluster network is calculated using a node influence algorithm to obtain the importance of each shared cluster in the threat intelligence sharing behavior group, and the shared clusters are sorted according to the importance to identify the target holder.

[0019] A device for constructing a threat intelligence sharing behavior group, the threat intelligence sharing behavior group includes multiple sharing clusters, each sharing cluster includes a holder and a demander of threat intelligence, and the device includes:

[0020] A shared cluster construction module is used to determine the Nash equilibrium solution between the holder and the demander through the Nash equilibrium model, and obtain a shared cluster including the holder and the demander;

[0021] The shared behavior group construction module is used to construct a threat intelligence sharing behavior group through a preset relationship between a holder in a sharing cluster and a demander in another sharing cluster, so as to share threat intelligence between the holder and the demander.

[0022] An electronic device, comprising: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside a space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program codes; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the above-mentioned method.

[0023] A computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above method.

[0024] A computer program product, when instructions in the computer program product are executed by a processor, performs the above method.

[0025] The beneficial effects of the present invention are embodied in:

[0026] The present invention constructs a sharing cluster based on threat intelligence holders and demanders that achieve Nash equilibrium solutions, and then constructs a threat intelligence sharing behavior group based on the sharing cluster, so that the threat intelligence sharing behavior group has high cohesion and improves the group value. At the same time, the present invention effectively simplifies the construction process of the threat intelligence sharing behavior group, shortens the construction time, and improves the timeliness of intelligence sharing. While maximizing the value of threat intelligence, it is also helpful to shorten the defense response cycle and assist defenders in responding to threats in the first place. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 A flowchart of a method for building a threat intelligence sharing behavior group according to an embodiment of the present invention;

[0029] Figure 2 A schematic diagram of a Nash equilibrium model according to an embodiment of the present invention;

[0030] Figure 3 This is another flow chart of a method for building a threat intelligence sharing behavior group according to an embodiment of the present invention;

[0031] Figure 4 This is a structural diagram of a device for building a threat intelligence sharing behavior group according to an embodiment of the present invention;

[0032] Figure 5 The figure is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0034] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0035] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0036] The present invention provides a method embodiment for building a threat intelligence sharing behavior group, such as Figure 1 As shown, the threat intelligence sharing behavior group includes multiple sharing clusters, each sharing cluster includes a holder and a demander of threat intelligence, and the method includes:

[0037] S11: in response to determining that a Nash equilibrium solution is reached between the holder and the demander through the Nash equilibrium model, obtaining a shared cluster including the holder and the demander;

[0038] S12: A threat intelligence sharing behavior group is constructed through a preset relationship between a holder in one sharing cluster and a demander in another sharing cluster, so as to share threat intelligence between the holder and the demander.

[0039] The sharing cluster described in the present invention can be regarded as composed of several individuals or organizations that have the intention or motivation to participate in threat intelligence sharing activities, including the providers of threat intelligence, namely the holders, and those who want to obtain threat intelligence, namely the demanders. The sharing cluster enables threat intelligence to flow at high speed in a small range. Based on the threat intelligence holders and demanders that have reached the Nash equilibrium solution, a sharing cluster is constructed, and then a threat intelligence sharing behavior group is constructed based on the sharing cluster, so that the threat intelligence sharing behavior group has high cohesion and improves the group value.

[0040] Preferably, the method of determining a Nash equilibrium solution between a holder and a demander through a Nash equilibrium model includes:

[0041] Calculate the parameters of the holder and the demander through the Nash equilibrium model, determine the game benefits of the holder and the demander, and judge whether the game benefit relationship conforms to the preset judgment logic. If so, determine that the holder and the demander have reached a Nash equilibrium;

[0042] Among them, the parameters of the holder include at least one of the following: threat intelligence sharing cost, threat intelligence sharing value, and threat intelligence non-sharing loss; the parameters of the demander include at least one of the following: threat intelligence self-acquisition cost and threat intelligence learning cost.

[0043] In the above preferred scheme, the threat intelligence sharing cost is the necessary price spent by the holder to share intelligence with the demander; the threat intelligence sharing value is the benefit brought to the holder by the threat intelligence sharing process; the threat intelligence non-sharing loss is the loss of benefit caused by the holder giving up sharing intelligence; the threat intelligence self-acquisition cost is the cost for the demander to obtain threat intelligence from channels other than the holder; the threat intelligence learning cost is the necessary price spent by the demander to obtain intelligence from the holder; the game benefit is the benefit of the holder and the demander after the cost and benefit confrontation between the holder and the demander. The game benefit must comply with the preset judgment logic to determine whether the corresponding holder and the demander have reached a Nash equilibrium. The preset judgment logic must be calculated and set according to the specific scenario requirements, and the result must ensure the balance of cost and benefit confrontation. Accordingly, examples are as follows:

[0044] Based on the above preferred solution, an example of the Nash equilibrium model between the threat intelligence holder H and the threat intelligence demander R is given. The schematic diagram of the Nash equilibrium model is as follows: Figure 2 The meaning of each symbol is shown in the following table:

[0045]

[0046] Correspondingly, the calculation of the game benefits between the threat intelligence demander R and the threat intelligence holder H is shown in the following table:

[0047]

[0048] Correspondingly, the Nash equilibrium of the threat intelligence demand body R and the threat intelligence holder H is calculated to obtain two sets of equilibrium solutions, which are:

[0049] a) When e>P>v+w and k∈[v / Q, 1-v / Q], the costs and benefits of H and R are in antagonistic equilibrium;

[0050] b) When P>e>v+w and k∈[v / P, (ew) / P], the costs and benefits of H and R are in antagonistic equilibrium;

[0051] That is, when the game benefits of the demand entity R and the holder H result in a) or b), the demand entity R and the holder H reach a Nash equilibrium solution and form a shared cluster.

[0052] Preferably, a threat intelligence sharing behavior group is constructed through a preset relationship between a holder in one sharing cluster and a demander in another sharing cluster, including:

[0053] In response to determining that the holder in the one sharing cluster and the demander in the other sharing cluster have reached a Nash equilibrium solution, a threat intelligence sharing behavior group is constructed. The calculation method of the process includes: using the Nash equilibrium model, traversing and calculating the Nash equilibrium between the threat intelligence sharing clusters, when the threat intelligence holder in one threat intelligence sharing cluster and the threat intelligence demander in another threat intelligence sharing cluster reach a Nash equilibrium solution, or when the threat intelligence demander in one threat intelligence sharing cluster and the threat intelligence holder in another threat intelligence sharing cluster reach a Nash equilibrium solution, it is determined that the two threat intelligence sharing clusters have reached a Nash equilibrium solution, and the two threat intelligence sharing clusters are added to the same threat intelligence sharing behavior group until the traversal calculation is completed to obtain the final threat intelligence sharing behavior group.

[0054] To further illustrate the above preferred embodiment, the following examples are given:

[0055] The Nash equilibrium model is used to traverse and calculate the Nash equilibrium between the shared clusters. When the holder Hi in the shared cluster Ci and the demand body Rj in the shared cluster Cj reach a Nash equilibrium solution, or the demand body Ri in the shared cluster Ci and the holder Hj in the shared cluster Cj reach a Nash equilibrium solution, the shared clusters Ci and Cj join the same threat intelligence sharing behavior group to form Clu{C1, C2, ..., C i , …, C j , …, C n}={(H1, R1), (H2, R2),…, (H i , R i ),…,(H j , R j), …, C n}, {i,j}∈{1,2,…,n}.

[0056] Preferably, through the preset relationship between the holder in one sharing cluster and the demander in another sharing cluster, it includes: determining the preset relationship between the holder of the one sharing cluster and the demander in another sharing cluster within a preset range in turn to construct a threat intelligence sharing behavior group.

[0057] The preset range described in the above preferred scheme can be set according to specific needs. For example, if the threat intelligence has obvious geographical location attributes, the preset range is set according to the geographical location, such as a country, a city, etc. The holder of a shared cluster at the geographical location is judged in turn with the preset relationship of the demand body in another shared cluster at the same geographical location to build a threat intelligence sharing behavior group corresponding to the geographical location; if the threat intelligence has obvious field attributes, the preset range is set according to the specific field, such as the chemical field, information security field, mechanical field, etc. The holder of a shared cluster in the field is judged in turn with the preset relationship of the demand body in another shared cluster in the same field to build a threat intelligence sharing behavior group corresponding to the field. It can be understood that in addition to the geographical location and field exemplified in the present invention, the preset range can also be set in other ways according to specific needs.

[0058] The preset relationship described in the above preferred scheme can be set according to specific needs. The aforementioned holder in one shared cluster and the demander in another shared cluster reach a Nash equilibrium solution, which is only a preferred scheme. In addition to achieving a Nash equilibrium solution, the preset relationship can also be the same domain attributes, the existence of historical threat intelligence sharing records, etc.

[0059] Preferably, after building the threat intelligence sharing behavior group, the method further includes:

[0060] Undirected edges are formed between the shared clusters in the threat intelligence sharing behavior group according to the corresponding relationship that achieves the Nash equilibrium solution, and a shared cluster network is constructed to determine the importance of each shared cluster.

[0061] Preferably, after constructing the shared cluster network, the method further comprises:

[0062] The shared cluster network is calculated using the node influence algorithm to obtain the importance of each shared cluster in the threat intelligence sharing behavior group, and the shared clusters are sorted according to the importance to identify the target holder. This process is generally implemented using an optimized K-shell algorithm to distinguish the importance of each shared cluster in the threat intelligence sharing behavior group and sort them according to the importance, so as to achieve the purpose of identifying high-value holders and solve the problem that the existing technology is difficult to identify high-value holders and the identification process is cumbersome.

[0063] To further illustrate the present invention, the present invention provides another method embodiment for building a threat intelligence sharing behavior group, such as Figure 3 As shown, including:

[0064] S31: Calculate the parameters of the holder and the demander through the Nash equilibrium model to determine the game benefits of the holder and the demander; wherein the parameters of the holder include at least one of the following: threat intelligence sharing cost, threat intelligence sharing value, and threat intelligence non-sharing loss; the parameters of the demander include at least one of the following: threat intelligence self-acquisition cost and threat intelligence learning cost;

[0065] S32: Determine whether the game benefit relationship conforms to the preset judgment logic. If so, enter S33; be responsible for returning to S31:

[0066] S33: Determine that the holder and the demander reach a Nash equilibrium, and obtain a shared cluster including the holder and the demander;

[0067] S34: performing traversal calculation on the Nash equilibrium between the shared clusters through the Nash equilibrium model;

[0068] S35: When a threat intelligence holder in one threat intelligence sharing cluster and a threat intelligence demander in another threat intelligence sharing cluster reach a Nash equilibrium solution, the two threat intelligence sharing clusters are added to the same threat intelligence sharing behavior group;

[0069] S36: Determine whether the traversal calculation is completed, if so, go to S37; otherwise, return to S34;

[0070] S37: Get the final threat intelligence sharing behavior group;

[0071] S38: forming undirected edges between shared clusters in the threat intelligence sharing behavior group according to the corresponding relationship of achieving Nash equilibrium solutions, and constructing a shared cluster network;

[0072] S39: Calculate the shared cluster network using a node influence algorithm to obtain the importance of each shared cluster in the threat intelligence sharing behavior group, and sort the shared clusters according to the importance to identify the target holder.

[0073] Figure 3 The embodiment constructs a shared cluster based on the threat intelligence holder and the demand body that achieve the Nash equilibrium solution, and then constructs a threat intelligence sharing behavior group based on the shared cluster that achieves the Nash equilibrium solution, so that the threat intelligence sharing behavior group has high cohesion and improves the group value. After obtaining the threat intelligence sharing behavior group, the shared clusters in the group are sorted according to their importance to achieve the purpose of identifying high-value holders, solving the problem that the existing technology is difficult to identify high-value holders and the identification process is cumbersome. Figure 3 The embodiment is based on Figure 1 The preferred solution of the embodiment is obtained, so Figure 3 The description of the above embodiment is relatively simple. Please refer to the corresponding part. Figure 1 The embodiment described.

[0074] The present invention provides an embodiment of a device for building a threat intelligence sharing behavior group, such as Figure 4 As shown, the threat intelligence sharing behavior group includes multiple sharing clusters, each sharing cluster includes a holder and a demander of threat intelligence, and the device includes:

[0075] A shared cluster construction module 41 is used to determine a Nash equilibrium solution between a holder and a demander through a Nash equilibrium model, and obtain a shared cluster including the holder and the demander;

[0076] The shared behavior group construction module 42 is used to construct a threat intelligence sharing behavior group through a preset relationship between a holder in one sharing cluster and a demander in another sharing cluster, so as to share threat intelligence between the holder and the demander.

[0077] Preferably, the method of determining a Nash equilibrium solution between a holder and a demander through a Nash equilibrium model includes:

[0078] Calculate the parameters of the holder and the demander through the Nash equilibrium model, determine the game benefits of the holder and the demander, and judge whether the game benefit relationship conforms to the preset judgment logic. If so, determine that the holder and the demander have reached a Nash equilibrium;

[0079] Among them, the parameters of the holder include at least one of the following: threat intelligence sharing cost, threat intelligence sharing value, and threat intelligence non-sharing loss; the parameters of the demander include at least one of the following: threat intelligence self-acquisition cost and threat intelligence learning cost.

[0080] Preferably, a threat intelligence sharing behavior group is constructed through a preset relationship between a holder in one sharing cluster and a demander in another sharing cluster, including:

[0081] In response to determining that a holder in the one sharing cluster and a demander in the other sharing cluster reach a Nash equilibrium solution, a threat intelligence sharing behavior group is constructed.

[0082] Preferably, through the preset relationship between the holder in one sharing cluster and the demander in another sharing cluster, it includes: determining the preset relationship between the holder of the one sharing cluster and the demander in another sharing cluster within a preset range in turn to construct a threat intelligence sharing behavior group.

[0083] Preferably, after the threat intelligence sharing behavior group is constructed, the shared behavior group construction module 42 is further used to:

[0084] Undirected edges are formed between the shared clusters in the threat intelligence sharing behavior group according to the corresponding relationship that achieves the Nash equilibrium solution, and a shared cluster network is constructed to determine the importance of each shared cluster.

[0085] Preferably, after constructing the shared cluster network, the shared behavior group construction module 42 is further used to:

[0086] The shared cluster network is calculated using a node influence algorithm to obtain the importance of each shared cluster in the threat intelligence sharing behavior group, and the shared clusters are sorted according to the importance to identify the target holder.

[0087] Some processes of the device embodiment of the present invention are similar to those of the method embodiment. The description of the device embodiment is relatively simple, and please refer to the method embodiment for the corresponding parts.

[0088] The embodiment of the present invention further provides an electronic device, such as Figure 5 As shown, the present invention can be implemented Figure 1 , 3 According to the process of the embodiment shown, the electronic device includes: a housing 51, a processor 52, a memory 53, a circuit board 54 and a power supply circuit 55, wherein the circuit board 54 is arranged inside the space enclosed by the housing 51, and the processor 52 and the memory 53 are arranged on the circuit board 54; the power supply circuit 55 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 53 is used to store executable program codes; the processor 52 runs the program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method described in the above-mentioned embodiment.

[0089] For details on the specific execution process of the above steps by the processor 52 and the steps further executed by the processor 52 by running the executable program code, please refer to the present invention. Figure 1 , 3 The description of the illustrated embodiment will not be repeated here.

[0090] This electronic device exists in many forms, including but not limited to:

[0091] (1) Mobile communication devices: These devices are characterized by having mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

[0092] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.

[0093] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0094] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0095] (5) Other electronic devices with data interaction functions.

[0096] An embodiment of the present invention further provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the method described in the above embodiment.

[0097] The embodiment of the present invention further provides a computer program product, comprising: when the instructions in the computer program product are executed by a processor, the present invention is executed. Figure 1 , 3 For details of the process of the embodiment shown, please refer to the present invention Figure 1 , 3 The description of the illustrated embodiment will not be repeated here.

[0098] The present invention constructs a sharing cluster based on threat intelligence holders and demanders that achieve Nash equilibrium solutions, and then constructs a threat intelligence sharing behavior group based on the sharing cluster, so that the threat intelligence sharing behavior group has high cohesion and improves the group value. At the same time, the present invention effectively simplifies the construction process of the threat intelligence sharing behavior group, shortens the construction time, and improves the timeliness of intelligence sharing. While maximizing the value of threat intelligence, it is also helpful to shorten the defense response cycle and assist defenders in responding to threats in the first place.

[0099] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for constructing a threat intelligence sharing behavior group, wherein the threat intelligence sharing behavior group includes a plurality of sharing clusters, each sharing cluster includes a holder and a demander of threat intelligence, characterized in that: The method comprises: In response to determining that a Nash equilibrium solution is reached between the holder and the demander through the Nash equilibrium model, a shared cluster including the holder and the demander is obtained; A threat intelligence sharing behavior group is constructed through a preset relationship between a holder in a sharing cluster and a demander in another sharing cluster, so as to share threat intelligence between the holder and the demander; The method of determining the Nash equilibrium solution between the holder and the demander through the Nash equilibrium model includes: calculating the parameters of the holder and the demander through the Nash equilibrium model, determining the game benefits of the holder and the demander, and judging whether the game benefit relationship conforms to the preset judgment logic. If so, determining that the holder and the demander have reached a Nash equilibrium; wherein the parameters of the holder include at least one of the following: the cost of sharing threat intelligence, the value of sharing threat intelligence, and the loss of not sharing threat intelligence, and the parameters of the demander include at least one of the following: the cost of self-acquisition of threat intelligence and the cost of learning threat intelligence; The method of constructing a threat intelligence sharing behavior group through a preset relationship between a holder in one sharing cluster and a demander in another sharing cluster includes: constructing a threat intelligence sharing behavior group in response to determining that a Nash equilibrium solution is reached between a holder in one sharing cluster and a demander in another sharing cluster.

2. The method according to claim 1, characterized in that Through the preset relationship between the holder in one shared cluster and the demander in another shared cluster, including: The preset relationship between the holder of the one sharing cluster and the demander in another sharing cluster within a preset range is determined in sequence to construct a threat intelligence sharing behavior group.

3. The method according to claim 2, characterized in that After the threat intelligence sharing behavior group is constructed, the method further includes: Undirected edges are formed between the shared clusters in the threat intelligence sharing behavior group according to the corresponding relationship that achieves the Nash equilibrium solution, and a shared cluster network is constructed to determine the importance of each shared cluster.

4. The method according to claim 3, characterized in that After the shared cluster network is constructed, the method further includes: The shared cluster network is calculated using a node influence algorithm to obtain the importance of each shared cluster in the threat intelligence sharing behavior group, and the shared clusters are sorted according to the importance to identify the target holder.

5. A device for constructing a threat intelligence sharing behavior group, the threat intelligence sharing behavior group comprising a plurality of sharing clusters, each sharing cluster comprising a holder and a demander of threat intelligence, characterized in that: The device comprises: A shared cluster construction module is used to determine the Nash equilibrium solution between the holder and the demander through the Nash equilibrium model, and obtain a shared cluster including the holder and the demander; A shared behavior group construction module, used to construct a threat intelligence sharing behavior group through a preset relationship between a holder in a sharing cluster and a demander in another sharing cluster, so as to share threat intelligence between the holder and the demander; The method of determining the Nash equilibrium solution between the holder and the demander through the Nash equilibrium model includes: calculating the parameters of the holder and the demander through the Nash equilibrium model, determining the game benefits of the holder and the demander, and judging whether the game benefit relationship conforms to the preset judgment logic. If so, determining that the holder and the demander have reached a Nash equilibrium; wherein the parameters of the holder include at least one of the following: the cost of sharing threat intelligence, the value of sharing threat intelligence, and the loss of not sharing threat intelligence, and the parameters of the demander include at least one of the following: the cost of self-acquisition of threat intelligence and the cost of learning threat intelligence; The method of constructing a threat intelligence sharing behavior group through a preset relationship between a holder in one sharing cluster and a demander in another sharing cluster includes: constructing a threat intelligence sharing behavior group in response to determining that a Nash equilibrium solution is reached between a holder in one sharing cluster and a demander in another sharing cluster.

6. An electronic device, characterized in that: The electronic device comprises: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program codes; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute any method described in claims 1-4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method described in any one of claims 1-4.

8. A computer program product, characterized in that include: When the instructions in the computer program product are executed by a processor, the method according to any one of claims 1 to 4 is performed.

Images