A threat intelligence identification method, device, system and readable storage medium

Abstract

The present invention discloses a threat intelligence identification method, device, system and computer-readable storage medium, including sending a threat intelligence acquisition request to a target server, where the threat intelligence request includes threat intelligence information, so that the target server determines target threat intelligence data from its own threat intelligence database according to the threat intelligence information; receiving the target threat intelligence data returned by the target server, and determining each data item information according to the target threat intelligence data; the data item information includes a data item name and data item numerical information; obtaining a pre-established threat intelligence rule library corresponding to the target server, where the threat intelligence rule library includes the corresponding relationship of the data item names and the corresponding numerical conversion relationship; according to each data item information and the threat intelligence rule library, determining the original data item name corresponding to each data item information and the current numerical information corresponding to the original data item name; the identification efficiency is high, and the implementation method is simple and easy to maintain.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of threat intelligence, and particularly to a threat intelligence recognition method, device, system and computer-readable storage medium. Background Art

[0002] According to Gartner's definition of threat intelligence, threat intelligence is a kind of evidence-based knowledge, which is related to the existing or brewing threats or hazards faced by assets. From the perspective of security practitioners, it refers to some intrusion threat indicators that can be used to determine whether these indicators pose a security threat to the system.

[0003] Threat intelligence is a kind of evidence-based knowledge, and different organizations have different levels of reserves of this kind of knowledge. The quantity and quality of the reserves are one of the core competitiveness of the organization. For intelligence users, the exchange or collection of knowledge from different organizations may achieve the best utilization effect.

[0004] When threat intelligence is exchanged between organizations, the understanding of the intelligence is similar, but the presentation forms are different. In terms of data structure organization, their respective presentation forms are different. For example, the expression of "intelligence confidence level" can be represented by words such as "high / medium / low", or by levels such as "3 / 2 / 1", or by scores such as "100 / 60 / 10", etc. This leads to the need for different organizations to develop customized parsing programs for all other organizations that need to be connected at the access end during software development, and perform data conversion at the code level when realizing the exchange. As the number of organizations increases, the development workload increases, and the system complexity and the amount of redundant code also increase, making it difficult to maintain and consuming a large amount of human resources.

[0005] In view of this, how to provide a time-saving, labor-saving, efficient, easy-to-maintain threat intelligence recognition method, device, system and computer-readable storage medium has become a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0006] The purpose of the embodiments of the present invention is to provide a threat intelligence recognition method, device, system and computer-readable storage medium, which can improve the recognition efficiency when threat intelligence is exchanged between organizations during use, reduce the waste of human resources, and has a simple implementation method and is easy to maintain.

[0007] To solve the above technical problems, the embodiments of the present invention provide a threat intelligence recognition method, including:

[0008] Sending a threat intelligence acquisition request to a target server, where the threat intelligence request includes threat intelligence information, so that the target server determines target threat intelligence data from its own threat intelligence database according to the threat intelligence information;

[0009] Receive the target threat intelligence data returned by the target server, and determine various data item information according to the target threat intelligence data; the data item information includes a data item name and data item numerical information;

[0010] Obtain a pre-established threat intelligence rule library corresponding to the target server, where the threat intelligence rule library includes the corresponding relationship of data item names and the corresponding numerical conversion relationship;

[0011] According to each data item information and the threat intelligence rule library, determine the original data item name corresponding to each data item information and the current numerical information corresponding to the original data item name.

[0012] Optionally, the establishment process of the threat intelligence rule library corresponding to the target server is as follows:

[0013] Extract multiple threat intelligence samples from a pre-established threat intelligence sample library corresponding to its own server;

[0014] For each threat intelligence sample, generate an acquisition request according to the threat intelligence sample;

[0015] Send the acquisition request to the target server so that the target server can determine all threat intelligence response information from its own database according to the acquisition request information;

[0016] Receive the threat intelligence response information returned by the target server, and obtain the first data item name of each data item in the threat intelligence response information and the first numerical information corresponding to each data item name;

[0017] Extract all data items from the threat intelligence sample library, and determine all second data item names of each data item; the original data item name is included in each second data item name;

[0018] For each first data item name, compare all the second data item names with the first data item name one by one. When there is a second data item name that is the same as the first data item name, determine the original data item name corresponding to the first data item name, so as to establish the corresponding relationship of data item names between each original data item name and its corresponding first data item name;

[0019] According to the value corresponding to the original data item name and the value corresponding to the corresponding first data item name, determine the numerical conversion relationship between the data item values corresponding to the original data item name and the first data item name;

[0020] Establish a threat intelligence rule library corresponding to the target server according to the corresponding relationship of each data item name and the corresponding numerical conversion relationship.

[0021] Optionally, the process of sending the acquisition request to the target server is as follows:

[0022] Obtain the interface definition information of the target server;

[0023] Send the acquisition request to the target server according to the interface definition information.

[0024] Optionally, the interface definition information includes:

[0025] Interface address, request parameter definition, request parameter example, and request header.

[0026] Optionally, the process of obtaining the interface definition information of the target server is as follows:

[0027] Obtain the interface definition information of the target server through the curl command.

[0028] Optionally, the process of generating an acquisition request according to the threat intelligence sample is as follows:

[0029] Extract the keywords of the threat intelligence sample and generate an acquisition request according to the keywords.

[0030] An embodiment of the present invention further provides a threat intelligence recognition device, including:

[0031] A sending module, configured to send a threat intelligence acquisition request to a target server, where the threat intelligence request includes threat intelligence information, so that the target server determines target threat intelligence data from its own threat intelligence database according to the threat intelligence information;

[0032] A receiving module, configured to receive the target threat intelligence data returned by the target server and determine each data item information according to the target threat intelligence data; the data item information includes a data item name and data item numerical information;

[0033] An acquisition module, configured to acquire a pre-established threat intelligence rule library corresponding to the target server, where the threat intelligence rule library includes the corresponding relationship of data item names and the corresponding numerical conversion relationship;

[0034] A matching module, configured to determine the original data item name corresponding to each data item information and the current numerical information corresponding to the original data item name according to each data item information and the threat intelligence rule library.

[0035] An embodiment of the present invention further provides a threat intelligence recognition system, including:

[0036] A memory for storing a computer program;

[0037] A processor for implementing the steps of the threat intelligence recognition method as described above when executing the computer program.

[0038] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the threat intelligence recognition method as described above are implemented.

[0039] An embodiment of the present invention provides a threat intelligence recognition method, device, system and computer-readable storage medium. In this method, the current server sends a threat intelligence acquisition request including threat intelligence information to the target server. The target server finds the corresponding target threat intelligence data from its own threat intelligence database according to the threat intelligence information, and then returns the target threat intelligence data. After receiving the target threat intelligence data, the current server determines each data item information, which includes a data item name and data item value information, and finds the original data item name and the corresponding numerical conversion relationship corresponding to each data item name according to the pre-established threat intelligence rule library corresponding to the target server. Then, according to the data item value information corresponding to each data item name, the current numerical information corresponding to the original data item name is determined; during the use of the present invention, the recognition efficiency during the threat intelligence exchange between organizations can be improved, the waste of human resources can be reduced, and the implementation method is simple and easy to maintain. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the prior art and the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0041] Figure 1 It is a schematic flowchart of a threat intelligence recognition method provided by an embodiment of the present invention;

[0042] Figure 2 It is a schematic structural diagram of a threat intelligence recognition device provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0043] An embodiment of the present invention provides a threat intelligence identification method, device, system, and computer-readable storage medium, which can improve the identification efficiency during the exchange of threat intelligence between organizations, reduce the waste of human resources, and have a simple implementation method and are easy to maintain during use.

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0045] Please refer to Figure 1 , Figure 1 which is a schematic flowchart of threat intelligence identification provided by an embodiment of the present invention. The method includes:

[0046] S110: Send a threat intelligence acquisition request to a target server. The threat intelligence request includes threat intelligence information, so that the target server can determine target threat intelligence data from its own threat intelligence database according to the threat intelligence information;

[0047] It should be noted that when exchanging threat intelligence between organizations, specifically when a certain organization needs to obtain threat intelligence information from another organization, a threat intelligence acquisition request can be sent to the target server of the other organization through the own server of the current organization. Specifically, the threat intelligence request can include threat intelligence information, specifically including information such as keywords of threat intelligence. After receiving the threat intelligence acquisition request, the target server filters out the target threat intelligence data that meets the requirements from its own threat intelligence database according to the threat intelligence information in the threat intelligence request, and then returns the target threat intelligence data.

[0048] Among them, the interface definition information of the target server can be specifically obtained, and then the acquisition request can be sent to the target server according to the interface definition information; specifically, the interface definition information of the target server can be obtained through the curl command.

[0049] It is understood that a threat intelligence request can be sent to the target server via a pre-established HTTP interface service. The curl command line tool is a native HTTP request tool in the Linux operating system, and also in newer versions of Windows. Due to its universal and installation-free nature, the documentation provided by the HTTP interface provider provides the curl command as an example. Therefore, in the embodiments of the present invention, the interface definition information is obtained by parsing the curl command. The interface definition information may include the interface address, request parameter definitions, request parameter examples, and the request header.

[0050] S120: Receive target threat intelligence data returned by the target server, and determine information of each data item based on the target threat intelligence data; the data item information includes data item name and data item value information;

[0051] Specifically, after receiving the target threat intelligence data returned by the target server, each data item information is obtained according to the target threat intelligence data, wherein each data item information includes a data item name and data item value information.

[0052] For example, for the following curl command example:

[0053] curl -X POST "https: / / 127.0.0.1 / api / v1 / ioc_reputation" \

[0054] -H "Content-Type: application / json" \

[0055] -H "TIP-TOKEN: abcdefghijklmnopqrstuvwxyz123456" \

[0056] -d '{"only_malicious": false,"ioc": "wiknet.wikaba.com,172.67.211.246"}'

[0057] Among them, the request parameters are organized in JSON format, and '{"only_malicious": false, "ioc": "wiknet.wikaba.com,172.67.211.246"}' is the JSON data in the parameter area of the intelligence exchange interface. The JSON data contains two parameter keys (only_malicious and ioc) and their respective corresponding values (false and wiknet.wikaba.com,172.67.211.246). When conducting intelligence exchange, only the threat intelligence information to be queried needs to be filled into the IOC parameter value to obtain the corresponding target threat intelligence data. The code form of the target threat intelligence data is as follows:

[0058] {

[0059] "cost": 20,

[0060] "code": 1,

[0061] "message": "1 result obtained",

[0062] "data": {

[0063] "ioc": "wiknet.wikaba.com",

[0064] "malicious": true,

[0065] "threat_type": "C2",

[0066] "threat_subtype": "Trojan",

[0067] "confidence_level": 3,

[0068] "confidence_score": 8,

[0069] "risk_level": 4,

[0070] "tags": ["c2", "malware_Guildma"],

[0071] "is_apt": true,

[0072] "warn_name": "Ordinary Remote Control Trojan Activity Event",

[0073] "source_name": "Anheng Intelligence Source",

[0074] "create_time": 1629110670936,

[0075] "update_time": 1629110679304

[0076] }

[0077] }

[0078] The target threat intelligence data is in JSON format with a nested structure. After flattening the JSON data, it is beneficial to simplify the data structure for further analysis. JSON is essentially a tree-like structure, and a result can be represented by the path from the root node to the child node. Among them, array types are concatenated with the | identifier, and each level of nodes of other types can be separated by the English full stop ".", and the effect after flattening the target threat intelligence data is as follows:

[0079] cost = 20

[0080] code = 1

[0081] data.ioc = wiknet.wikaba.com

[0082] data.confidence_level = 3

[0083] data.source_name = Anheng Intelligence Source

[0084] message = 1 result obtained

[0085] data.warn_name = Ordinary Remote Control Trojan Activity Event

[0086] data.threat_type = C2

[0087] data.risk_level = 4

[0088] data.tags = c2|malware_Guildma

[0089] data.malicious = true

[0090] data.confidence_score = 8

[0091] data.threat_subtype = Trojan

[0092] data.is_apt = true

[0093] data.create_time = 1629110670936

[0094] data.update_time = 1629110679304

[0095] Among them, the left side of the equal sign is the data item name, and the right side of the equal sign is the data item value information.

[0096] S130: Obtain a pre-established threat intelligence rule base corresponding to the target server. The threat intelligence rule base includes the corresponding relationship of data item names and the corresponding numerical conversion relationship;

[0097] It should be noted that after receiving the target threat intelligence data, a pre-established threat intelligence rule base corresponding to the target server is obtained from the database of its own server. Specifically, the threat intelligence rule base corresponding to the target server can be retrieved through the ID of the target server. The threat intelligence rule base includes the corresponding relationship of data item names and the corresponding numerical conversion relationship. For example, the data item name for identity information in the threat intelligence information of the target server is ID card, while the data item name for identity information in the threat intelligence information of the current server is ID, both representing the same data item. Then the corresponding relationship of data item names can be ID card corresponding to ID, and the numerical conversion relationship between the data item value 35 and thirty-five is to convert Arabic numerals into Chinese numerals for representation.

[0098] S140: Determine the original data item name corresponding to each data item information and the current numerical information corresponding to the original data item name according to each data item information and the threat intelligence rule base.

[0099] Specifically, for the data item names of each data item information in the target threat intelligence data, the original data item name corresponding to the data item name can be determined from the corresponding relationship between the data item names. The original data item name is the naming for the same type of data item in its own server. After determining the original data item name, find the corresponding numerical conversion relationship. According to the corresponding data item value information in the target threat intelligence data and the numerical conversion relationship, convert the corresponding value into a value in the expression form of the threat intelligence information that conforms to its own server, and use this value as the current numerical information. Thus, the data item name and the corresponding data item value in the target server can be converted into the original data item name and the corresponding current numerical information in the expression form of the threat intelligence information that conforms to its own server.

[0100] Furthermore, the establishment process of the above-mentioned threat intelligence rule base corresponding to the target server can specifically be:

[0101] Extract multiple threat intelligence samples from a pre-established threat intelligence sample library corresponding to its own server; among them, the so-called threat intelligence can be simply understood as whether a domain name or IP is malicious. For example, www.baidu.com is non-malicious, while the domain name or IP used by the backend of a Trojan virus is malicious. For some popular and typical domain names or IPs, different organizations have strong consistency in their understanding of them. For example, they all think it is a Trojan virus and they all think it has a high degree of danger. Therefore, the confidence level of the threat intelligence information in the threat intelligence sample library in the embodiments of the present invention should be greater than a preset value, the popularity should also be greater than a preset popularity value, and it should have diversity.

[0102] For each threat intelligence sample, generate an acquisition request according to the threat intelligence sample; specifically, the keywords of the threat intelligence sample can be extracted, and then the acquisition request can be generated according to the keywords.

[0103] Send the acquisition request to the target server so that the target server can determine all threat intelligence response information from its own database according to the acquisition request information; among them, the interface definition information can be obtained first through the curl command, and then the acquisition request can be sent to the target server according to the interface definition information.

[0104] Receive the threat intelligence response information returned by the target server, and obtain the first data item name of each data item in the threat intelligence response information and the first numerical information corresponding to each data item name; specifically, the threat intelligence response information can be flattened to obtain the first data item name of each data item and the corresponding first numerical information.

[0105] Extract all data items from the threat intelligence sample library, and determine all second data item names of each data item; the second data item names include the original data item names.

[0106] For each first data item name, compare all the second data item names with the first data item name respectively. When there is a second data item name that is the same as the first data item name, determine the original data item name corresponding to the first data item name, so as to establish the corresponding relationship between each original data item name and its corresponding first data item name.

[0107] Specifically, in terms of names, for the same type of data item, different organizations may use different names. For example, for the "threat type" data item, some data item names may be threat_type, or they may also be category, judgment, etc. All possible names of this data item can be used to form each second data item name. Among them, the name used in the threat intelligence information of its own server is used as the original data item name. For each first data item name, search among all the second data item names. If the same name is retrieved, then the original data item name corresponding to this second data item name and the corresponding first data item name are made to correspond to each other, and the corresponding relationship is established.

[0108] Based on the value corresponding to the original data item name and the value corresponding to the corresponding first data item name, determine the numerical conversion relationship between the data item values corresponding to the original data item name and the first data item name;

[0109] Specifically, in terms of values, the values of the same data item may be expressed differently in different organizations. For example, if the "threat type" is C2, other expression methods may be C&C, or directly expressed in Chinese as "remote control". All possible value expression methods of this data item can be used. Therefore, after determining the corresponding relationship between the above group of original data item names and the corresponding first data item names, the numerical information corresponding to the original data item name and the numerical information corresponding to the first data item name can be obtained, and then the numerical conversion relationship is determined based on the two numerical information.

[0110] Based on the corresponding relationship of each data item name and the corresponding numerical conversion relationship, establish a threat intelligence rule library corresponding to the target server. Specifically, make the threat intelligence rule library correspond to the ID of the target server.

[0111] It can be seen that in the embodiment of the present invention, the current server sends a threat intelligence request including threat intelligence information to the target server. The target server finds the corresponding target threat intelligence data from its own threat intelligence database based on this threat intelligence information, and then returns the target threat intelligence data. After receiving the target threat intelligence data, the current server determines each data item information, and this data item information includes the data item name and the data item numerical information. Then, according to the pre-established threat intelligence rule library corresponding to the target server, find the original data item name corresponding to each data item name and the corresponding numerical conversion relationship, and then determine the current numerical information corresponding to the corresponding original data item name based on the data item numerical information corresponding to each data item name; The present invention can improve the recognition efficiency during the exchange of threat intelligence between organizations, reduce the waste of human resources during use, and has a simple implementation method and is easy to maintain.

[0112] Based on the above embodiments, an embodiment of the present invention further provides a threat intelligence recognition device. Specifically, please refer to Figure 2 , and the device includes:

[0113] A sending module 21, configured to send a threat intelligence acquisition request to a target server. The threat intelligence request includes threat intelligence information, so that the target server can determine target threat intelligence data from its own threat intelligence database according to the threat intelligence information;

[0114] A receiving module 22, configured to receive the target threat intelligence data returned by the target server, and determine each data item information according to the target threat intelligence data; the data item information includes a data item name and data item numerical information;

[0115] An acquisition module 23, configured to acquire a pre-established threat intelligence rule library corresponding to the target server. The threat intelligence rule library includes the corresponding relationship of data item names and the corresponding numerical conversion relationship;

[0116] A matching module 24, configured to determine the original data item name corresponding to each data item information and the current numerical information corresponding to the original data item name according to each data item information and the threat intelligence rule library.

[0117] It should be noted that the threat intelligence recognition device in the embodiment of the present invention has the same beneficial effects as the threat intelligence recognition method mentioned in the above embodiments. For the specific introduction of the threat intelligence recognition method involved in the embodiment of the present invention, please refer to the above embodiments, and the present invention will not be elaborated herein.

[0118] Based on the above embodiments, an embodiment of the present invention further provides a threat intelligence recognition system, including:

[0119] A memory, configured to store a computer program;

[0120] A processor, configured to implement the steps of the threat intelligence recognition method as described above when executing the computer program.

[0121] For example, the processor in the embodiments of the present invention can be specifically used to send a threat intelligence request to a target server, where the threat intelligence request includes threat intelligence information, so that the target server can determine target threat intelligence data from its own threat intelligence database according to the threat intelligence information; receive the target threat intelligence data returned by the target server, and determine various data item information according to the target threat intelligence data; the data item information includes a data item name and data item numerical value information; obtain a pre-established threat intelligence rule library corresponding to the target server, where the threat intelligence rule library includes the corresponding relationship of the data item names and the corresponding numerical conversion relationship; according to each data item information and the threat intelligence rule library, determine the original data item name corresponding to each data item information and the current numerical information corresponding to the original data item name.

[0122] Based on the above embodiments, the embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above threat intelligence recognition method are implemented.

[0123] The computer-readable storage medium may include: various media such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disc that can store program codes.

[0124] The various embodiments in this specification are described in a progressive manner. The key point of each embodiment is the difference from other embodiments. The same or similar parts among the various embodiments can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method part.

[0125] It should also be noted that in this specification, terms such as "including", "comprising", or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article, or device. Without further limitation, an element defined by the statement "including a..." does not exclude the existence of another identical element in the process, method, article, or device including the said element.

[0126] The foregoing description of the disclosed embodiments enables those skilled in the art to practice or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A threat intelligence identification method, characterized in that, Including: Sending a threat intelligence request to a target server of another organization through the current server of the current organization, where the threat intelligence request includes threat intelligence information, so that the target server determines target threat intelligence data from its own threat intelligence database according to the threat intelligence information; Receiving the target threat intelligence data returned by the target server and determining various data item information according to the target threat intelligence data; the data item information includes a data item name and data item numerical value information; Obtaining a pre-established threat intelligence rule base corresponding to the target server, where the threat intelligence rule base includes the corresponding relationship of data item names and the corresponding numerical conversion relationship; According to each of the data item information and the threat intelligence rule base, determining the original data item name corresponding to each of the data item information and the current numerical value information corresponding to the original data item name; where: The establishment process of the threat intelligence rule base corresponding to the target server is: Extracting a plurality of threat intelligence samples from a pre-established threat intelligence sample library corresponding to its own server; For each of the threat intelligence samples, generating an acquisition request according to the threat intelligence sample; Sending the acquisition request to the target server so that the target server determines all threat intelligence response information from its own database according to the acquisition request information; Receiving the threat intelligence response information returned by the target server and obtaining the first data item name of each data item in the threat intelligence response information and the first numerical value information corresponding to each of the data item names; Extracting all data items from the threat intelligence sample library and determining all second data item names of each of the data items; each of the second data item names includes an original data item name; For each of the first data item names, comparing all of the second data item names with the first data item name respectively. When there is a second data item name that is the same as the first data item name, determining the original data item name corresponding to the first data item name to establish the corresponding relationship of data item names between each original data item name and its corresponding first data item name; According to the value corresponding to the original data item name and the value corresponding to the corresponding first data item name, determining the numerical conversion relationship between the data item numerical values corresponding to the original data item name and the first data item name; Establishing a threat intelligence rule base corresponding to the target server according to the corresponding relationship of each data item name and the corresponding numerical conversion relationship.

2. The threat intelligence identification method according to claim 1, wherein, The process of sending the acquisition request to the target server is: Obtaining the interface definition information of the target server; Sending the acquisition request to the target server according to the interface definition information.

3. The threat intelligence identification method according to claim 2, wherein, The interface definition information includes: Interface address, request parameter definition, request parameter example, and request header.

4. The threat intelligence identification method according to claim 2, wherein The process of obtaining the interface definition information of the target server is: Obtaining the interface definition information of the target server through the curl command.

5. The threat intelligence identification method according to claim 1, characterized in that The process of generating an acquisition request based on the threat intelligence sample is as follows: Extract the keywords of the threat intelligence sample and generate an acquisition request based on the keywords.

6. A threat intelligence identification device, characterized in that, It includes: A sending module, configured to send a threat intelligence acquisition request to a target server of another organization through the current server of the current organization. The threat intelligence request includes threat intelligence information, so that the target server determines target threat intelligence data from its own threat intelligence database according to the threat intelligence information; A receiving module, configured to receive the target threat intelligence data returned by the target server and determine information on each data item according to the target threat intelligence data; The data item information includes a data item name and data item numerical value information; An acquisition module, configured to acquire a pre-established threat intelligence rule library corresponding to the target server. The threat intelligence rule library includes the corresponding relationship of the data item names and the corresponding numerical conversion relationship; A matching module, configured to determine the original data item name corresponding to each data item information and the current numerical value information corresponding to the original data item name according to each data item information and the threat intelligence rule library; where: The process of establishing the threat intelligence rule library corresponding to the target server is as follows: Extract multiple threat intelligence samples from a pre-established threat intelligence sample library corresponding to its own server; For each threat intelligence sample, generate an acquisition request according to the threat intelligence sample; Send the acquisition request to the target server, so that the target server determines all threat intelligence response information from its own database according to the acquisition request information; Receive the threat intelligence response information returned by the target server and obtain the first data item name of each data item in the threat intelligence response information and the first numerical value information corresponding to each data item name; Extract all data items from the threat intelligence sample library and determine all second data item names of each data item; each of the second data item names includes an original data item name; For each first data item name, compare all the second data item names with the first data item name respectively. When there is a second data item name that is the same as the first data item name, determine the original data item name corresponding to the first data item name, so as to establish the corresponding relationship of the data item names between each original data item name and its corresponding first data item name; According to the value corresponding to the original data item name and the value corresponding to the corresponding first data item name, determine the numerical conversion relationship between the data item numerical values corresponding to the original data item name and the first data item name; Establish a threat intelligence rule library corresponding to the target server according to the corresponding relationship of each data item name and the corresponding numerical conversion relationship.

7. A threat intelligence identification system, characterized in that, It includes: A memory, configured to store a computer program; A processor, configured to implement the steps of the threat intelligence recognition method according to any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the threat intelligence identification method according to any one of claims 1 to 5 are implemented.

Images