Threat handling method and device

Abstract

The present invention discloses a threat handling method and device, which relate to the field of network security technology and mainly aim to improve the efficiency and accuracy of threat handling. The main technical scheme includes: based on preset threat analysis items, extracting threat intelligence information corresponding to clues to be handled from at least one threat intelligence library, wherein the threat analysis items are used to extract threat intelligence information that meets corresponding conditions; and determining corresponding intelligence handling suggestions based on intelligence keywords in the extracted threat intelligence information.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a threat handling method and device. Background Art

[0002] In recent years, the cybersecurity landscape has become increasingly challenging, with cybersecurity confrontations escalating. Addressing threats based on clues has become a crucial task for security analysts. Currently, this approach is typically based on manual analysis by security analysts. This manual analysis is not only inefficient, but also relies heavily on experience. Any deviations in this experience can compromise the accuracy of threat management. Summary of the Invention

[0003] In view of this, the present invention proposes a threat handling method and apparatus, the main purpose of which is to improve the efficiency and accuracy of threat handling.

[0004] In order to achieve the above object, the present invention mainly provides the following technical solutions:

[0005] In a first aspect, the present invention provides a threat handling method, the method comprising:

[0006] Extracting threat intelligence information corresponding to clues to be handled from at least one threat intelligence repository based on preset threat analysis items, wherein the threat analysis items are used to extract threat intelligence information that meets corresponding conditions;

[0007] Determine corresponding intelligence handling suggestions based on intelligence keywords in the extracted threat intelligence information.

[0008] In a second aspect, the present invention provides a threat handling device, the device comprising:

[0009] An extraction unit is configured to extract threat intelligence information corresponding to clues to be handled from at least one threat intelligence repository based on preset threat analysis items, wherein the threat analysis items are configured to extract threat intelligence information that meets corresponding conditions;

[0010] The determination unit is used to determine corresponding intelligence handling suggestions based on intelligence keywords in the extracted threat intelligence information.

[0011] In a third aspect, the present invention provides a computer-readable storage medium, wherein the storage medium includes a stored program, wherein when the program is run, the device where the storage medium is located is controlled to execute the threat handling method described in the first aspect.

[0012] In a fourth aspect, the present invention provides a storage management device, comprising: a memory for storing a program; and a processor coupled to the memory for running the program to execute the threat handling method described in the first aspect.

[0013] By means of the above technical solution, the threat handling method and device provided by the present invention, when it is necessary to handle clues to be handled, first extracts the threat intelligence information corresponding to the clues from the threat intelligence library according to the preset threat analysis items, and then determines the corresponding intelligence handling suggestions based on the intelligence keywords in the extracted threat intelligence information. It can be seen that the solution provided by the present invention can combine the preset threat analysis and the threat intelligence library to conduct line-of-sight analysis on the clues, and give corresponding intelligence handling suggestions based on the threat intelligence information extracted by the line-of-sight analysis. The clue-of-sight analysis process and the determination process of the intelligence handling suggestions do not require human intervention. Therefore, the solution provided by the present invention can improve the efficiency and accuracy of threat handling.

[0014] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 A flowchart of a threat handling method provided by an embodiment of the present invention is shown;

[0017] Figure 2 A schematic structural diagram of a threat handling device provided by another embodiment of the present invention is shown;

[0018] Figure 3 A schematic structural diagram of a threat handling device provided by another embodiment of the present invention is shown. DETAILED DESCRIPTION

[0019] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0020] With the increasingly severe cybersecurity situation and escalating cybersecurity confrontations, threat analysis based on clues has become a crucial task for security analysts. This approach not only allows for timely analysis of existing attacks but also effectively predicts future threats and guides users in making effective security decisions. Therefore, threat analysis based on clues is crucial for protecting the security of user network infrastructure.

[0021] Currently, threat handling based on clues is typically performed manually by security analysts. This manual approach is not only inefficient, but also relies heavily on human experience. Any deviation from this experience can affect the accuracy of threat handling.

[0022] In order to improve the efficiency and accuracy of threat handling, embodiments of the present invention provide a threat handling method and apparatus for automatically handling threats on clues. The threat handling method and apparatus provided by embodiments of the present invention are described in detail below.

[0023] like Figure 1 As shown, an embodiment of the present invention provides a threat handling method, which mainly includes:

[0024] 101. Based on a preset threat analysis item, extract threat intelligence information corresponding to a clue to be handled from at least one threat intelligence repository. The threat analysis item is used to extract threat intelligence information that meets corresponding conditions.

[0025] Clues for threat resolution are information indicating anomalies requiring threat resolution. These clues can be obtained by collecting network traffic and log information from security monitoring points, extracting network features from these traffic and log information, and then, if the extracted network features are determined to be abnormal, obtaining clues for threat resolution based on the abnormal network features. Abnormal network features describe unusual network behavior.

[0026] For example, the following network feature is present in the network traffic and log information of a security monitoring point: "IP: 111.122.101.120" requested the address "122.122.101.120." Analysis shows that "122.122.101.120" is a remote server controlled by the APT (Advanced Persistent Threat) group AA. This network feature is determined to be abnormal. The clue to the threat response is determined to be: "IP: 111.122.101.120" requested a remote server controlled by the APT group AA.

[0027] After determining the clue to be handled, it is necessary to select the preset threat analysis items required for threat handling of the clue, and use the preset threat analysis items to perform line analysis and judgment analysis on the clue. Before extracting the threat intelligence information corresponding to the clue to be handled from at least one threat intelligence library based on the preset threat analysis items in step 101, the following steps 1 and 2 may also be included:

[0028] Step 1: Select a threat resolution report template based on the clue type.

[0029] Clues usually involve specific customers. After threat disposal is performed on the clues, a threat disposal report needs to be generated based on the threat disposal. The threat disposal report is provided to the customers involved in the clues to guide users in specifying effective security protection strategies.

[0030] In actual applications, clues have different types, and the threat analysis items used for different types of clues are slightly different. Therefore, when handling threats for clues, it is necessary to determine the type of clue and select a threat handling report template based on the type of clue, so as to perform targeted analysis on the clue based on the threat handling items included in the selected threat handling report template.

[0031] The clue type is determined based on the specific information included. There are three types of clues: IP, sample, and domain. The sample type describes the value of a characteristic of the controlled object, such as the MD5 hash of the controlled object.

[0032] For example, the clue to be handled is: "IP: 111.122.101.120" requested a remote server controlled by the APT group AA. If the clue type is determined to be IP type, a threat handling report template corresponding to the IP type is selected for it.

[0033] Step 2: Determine the threat analysis items included in the threat disposal report template as preset threat analysis items.

[0034] The threat analysis items in the threat handling report templates for different lead types vary. These items are used to extract threat intelligence information that meets the corresponding criteria and then analyze the leads using this extracted threat intelligence information. The specific threat analysis items in the threat handling report templates for each lead type can be determined based on business needs and are not specifically limited in this embodiment. For example, threat analysis items may include, but are not limited to, geographic information, family-based attack techniques, attack behavior, and advanced persistent threats.

[0035] After the threat disposal report is selected, the threat analysis items included in the selected threat disposal report are determined as preset threat analysis items, so as to utilize the preset threat risk items in combination with the threat intelligence library to extract clues for analysis and judgment of threat intelligence information.

[0036] It should be noted that in order to improve the applicability of the threat disposal report template to threat disposal clues, after selecting the threat disposal report template corresponding to the clue, the threat analysis items of the selected threat disposal report template can be provided to the analysis and judgment personnel, so that the analysis and judgment personnel can add, delete, modify, etc. the threat analysis items based on specific business needs.

[0037] Once the threat analysis item is added, deleted, or modified by the analyst, or after receiving a confirmation instruction from the analyst for a threat analysis item, the threat analysis item included in the threat resolution report template will be determined as the preset threat analysis item. The confirmation instruction is issued by the analyst without modifying the threat analysis item.

[0038] After selecting a preset threat analysis item, based on the preset threat analysis item, threat intelligence information corresponding to the clue to be handled is extracted from at least one threat intelligence repository. Methods for extracting threat intelligence information corresponding to the clue to be handled from at least one threat intelligence repository based on the preset threat analysis item include at least two of the following:

[0039] The first method involves extracting threat intelligence information corresponding to clues to be handled from at least one threat intelligence repository based on preset threat analysis items, and includes the following steps 101A to 101B:

[0040] 101A. Extract network features corresponding to threat analysis items from clues.

[0041] For example, the clue is: "IP: 111.122.101.120" requested a remote server controlled by APT group AA. The determined threat analysis item is a geographic information item, and its corresponding network feature is "IP: 111.122.101.120." The determined threat analysis item is an advanced persistent threat item, and its corresponding network feature is "remote server controlled by APT group AA."

[0042] 101B. Based on the network features corresponding to the threat analysis item, extract corresponding threat intelligence information from the threat intelligence library corresponding to the threat analysis item.

[0043] In actual applications, at least one threat intelligence library can be preset in advance to use the intelligence information in these threat intelligence libraries to provide evidence for threat handling clues. The at least one threat intelligence library includes at least one of the following: a geographic information intelligence library, a family attack method intelligence library, an attack behavior intelligence library, and an advanced persistent threat intelligence library. The geographic information intelligence library is used to provide intelligence information related to the IP geographic location. The family attack method intelligence library is used to provide intelligence information related to family attack methods. The attack behavior intelligence library is used to provide intelligence information related to attack behavior. The advanced persistent threat intelligence library is used to provide intelligence information related to advanced persistent threats.

[0044] There is a correspondence between threat analysis items and threat intelligence repositories. For example, the threat intelligence repositories corresponding to geographic information items are geographic information intelligence repositories, the threat intelligence repositories corresponding to family attack techniques items are family attack techniques intelligence repositories, the threat intelligence repositories corresponding to attack behavior items are attack behavior intelligence repositories, and the threat intelligence repositories corresponding to advanced persistent threats items are advanced persistent threat intelligence repositories.

[0045] The threat intelligence database contains a correspondence between threat intelligence information and network features. Therefore, for each threat analysis item, the corresponding threat intelligence information is extracted from the threat intelligence database corresponding to the threat analysis item based on the network features corresponding to the threat analysis item.

[0046] For example, the network feature of the geographic information item is "IP: 111.122.101.120", then in the corresponding geographic information intelligence database, the geographical location, country and other details of "IP: 111.122.101.120" are extracted.

[0047] For example, if the network feature of the advanced persistent threat item is "remote server controlled by APT group AA", then the corresponding advanced persistent threat intelligence database will extract the organizational information details, activity characteristics, TTP (Tactics, Techniques, and Procedures) of the APT group AA, as well as the attack methods and common attack techniques that the organization is good at, as well as the countries targeted for targeted attacks, and the industries involved in the attacking organization, such as science and technology, education, government, foreign trade, scientific research, basic communications, transportation, etc., to facilitate subsequent clue tracing and tracking.

[0048] The second method involves extracting threat intelligence information corresponding to clues to be handled from at least one threat intelligence repository based on preset threat analysis items, and includes steps 101C to 101E:

[0049] 101C. Determine the ranking of threat analysis items.

[0050] The order of threat analysis items is determined based on their dependencies. For any two adjacent threat analysis items in the order, the use of the latter threat analysis item must be based on the threat intelligence information extracted using the preceding threat analysis item. If the threat intelligence information extracted using the preceding threat analysis item does not contain the threat signature corresponding to the latter threat analysis item, it indicates that there is no basis for extracting threat intelligence information for the latter threat analysis item, and intelligence information cannot be extracted for the latter threat analysis item.

[0051] When determining the ranking of threat analysis items, if two or more threat analysis items need to be ranked the same, these threat analysis items are assigned a tied ranking position. For a threat analysis item in the ranking, if two or more threat analysis items are tied for the position immediately preceding it, these tied threat analysis items are all the same as the threat analysis item immediately preceding it.

[0052] 101D. For the threat analysis item ranked first, extract the network features corresponding to the threat analysis item from the clue, and extract corresponding threat intelligence information from at least one threat intelligence library based on the network features.

[0053] The threat analysis item ranked first is the first threat analysis item for threat intelligence information extraction. Therefore, it is necessary to extract its corresponding network features from the clues, and use the extracted network features as the basis for extracting threat intelligence information.

[0054] For example, the clue is: "IP: 111.122.101.120" requested a remote server controlled by the APT group AA. The threat analysis items "geographic information item and advanced persistent threat item" are ranked first, and the network feature corresponding to the geographic information item is determined to be "IP: 111.122.101.120." The network feature corresponding to the advanced persistent threat item is determined to be "a remote server controlled by the APT group AA." The network feature of the geographic information item is "IP: 111.122.101.120," then the geographic location, country, and other details of "IP: 111.122.101.120" are extracted from the corresponding geographic information intelligence database. The network feature of the advanced persistent threat item is "a remote server controlled by the APT group AA," then the organizational information details, activity characteristics, and TTP (Tactics, Techniques, and Procedures) of the APT group AA are extracted from the corresponding advanced persistent threat intelligence database.

[0055] 101E. For threat analysis items that are not ranked first, traverse according to the ranking: if the threat intelligence information of the threat analysis item in the previous position contains the threat feature corresponding to the threat analysis item currently traversed, extract the corresponding threat intelligence information from at least one threat intelligence library based on the threat feature; if the threat intelligence information of the threat analysis item in the previous position does not contain the threat feature corresponding to the threat analysis item currently traversed, terminate the traversal operation.

[0056] Threat signatures are features used to extract threat intelligence information. The threat intelligence information extracted based on them is further evidence used to conduct threat analysis on clues.

[0057] If the threat intelligence information for the previous threat analysis item contains the threat signature corresponding to the currently traversed threat analysis item, further threat assessment evidence can be extracted for the clue. Therefore, based on the threat signature, the corresponding threat intelligence information is extracted from at least one threat intelligence repository. The threat intelligence repository maintains a correspondence between threat intelligence information and threat signatures. Therefore, for each threat analysis item, the corresponding threat intelligence information is extracted from the corresponding threat intelligence repository based on the threat signature corresponding to the threat analysis item.

[0058] If the threat intelligence information of the previous threat analysis item does not contain the threat feature corresponding to the currently traversed threat analysis item, it means that the collection of threat analysis evidence for the clue has been completed, so the traversal operation can be ended.

[0059] For example, the threat analysis item ranked first is the "geographic information item and advanced persistent threat item" ranked first in parallel, and the extracted threat intelligence information is: "the geographical location, country, and other details of the IP: 111.122.101.120" and "the organizational information details, activity characteristics, and TTP (Tactics, Techniques, and Procedures) of the APT group AA". The second item in the ranking is the "attack behavior item". The threat intelligence information of the threat analysis item ranked second contains the threat feature "APT group AA" corresponding to the currently traversed threat analysis item "attack behavior item". Based on the threat feature "APT group AA", the corresponding threat intelligence information "attack methods and common attack techniques that the APT group AA is good at, as well as targeted attack countries, etc., and the industries involved in the attack organization, such as science and technology, education, government, foreign trade, scientific research, basic communications, transportation, and other industry information, are extracted from the threat intelligence library "attack behavior intelligence library" to facilitate subsequent clue tracing and tracking.

[0060] 102. Determine corresponding intelligence handling suggestions based on intelligence keywords in the extracted threat intelligence information.

[0061] In order to facilitate guiding users to make effective security decisions, after extracting threat intelligence information, it is necessary to extract intelligence keywords from the threat intelligence information to determine the corresponding intelligence disposal suggestions through the intelligence keywords.

[0062] Intelligence keywords describe the main anomalies present in the clues and are key information for determining intelligence disposition recommendations. Intelligence keywords can be determined by segmenting the extracted threat intelligence information and then inputting it into an intelligence keyword determination model, which then identifies the intelligence keywords. The intelligence keyword determination model is a pre-trained model designed to identify intelligence keywords.

[0063] For example, the extracted threat intelligence information contains keywords such as: APT group AA, BB attack method. This means that APT group AA used the BB attack method to carry out the attack. Therefore, the intelligence disposal suggestion corresponding to the keywords is selected. This intelligence disposal suggestion is the solution for APT group AA's BB attack method.

[0064] The threat handling method provided by the embodiment of the present invention, when it is necessary to handle clues to be handled, first extracts the threat intelligence information corresponding to the clues from the threat intelligence library based on the preset threat analysis items, and then determines the corresponding intelligence handling suggestions based on the intelligence keywords in the extracted threat intelligence information. It can be seen that the solution provided by the embodiment of the present invention can combine the preset threat analysis and the threat intelligence library to conduct line-of-sight analysis on the clues, and provide corresponding intelligence handling suggestions based on the threat intelligence information extracted by the line-of-sight analysis. The clue analysis process and the determination process of the intelligence handling suggestions involved do not require human intervention. Therefore, the solution provided by the embodiment of the present invention can improve the efficiency and accuracy of threat handling.

[0065] In some embodiments, to enrich the evidence for threat handling, after extracting threat intelligence information corresponding to the clue to be handled from at least one threat intelligence repository based on the preset threat analysis items in step 101, the threat handling method may further include the following steps 201 to 202:

[0066] 201. Determine whether there is an associated keyword in the extracted threat intelligence information, where the associated keyword is used to extract associated clue information related to the threat intelligence information in which it is located; if so, execute step 202; otherwise, execute step 102.

[0067] Relevance keywords are used to extract relevant clues related to the threat intelligence information they contain. This clue information is then used to enrich the corresponding threat intelligence information. Any keyword in the threat intelligence information that can be further refined can be used as a relevance keyword.

[0068] The associated keywords may be determined by segmenting the extracted threat intelligence information, inputting the associated keywords, and using an associated keyword determination model to identify the associated keywords. The associated keyword determination model is a pre-trained model for identifying associated keywords.

[0069] For example, the threat intelligence information includes details such as the geographic location and country of "IP: 111.122.101.120". The IP: 111.122.101.120 and the geographic location and country can be determined as associated keywords.

[0070] For example, the threat intelligence information includes: APT group AA, BB attack method, and the APT group AA, BB attack method is determined as a related keyword.

[0071] 202. Extract associated clue information corresponding to the associated keyword from at least one associated clue library, and incorporate the associated clue information into the corresponding threat intelligence information.

[0072] After the associated keywords are determined, associated clue information corresponding to the associated keywords is extracted from the associated clue library.

[0073] For example, the associated keywords are: IP: 111.122.101.120 and its geographical location and country. Based on the above keywords in the associated clue library, the domain name of the IP address, the company information after the domain name, etc. can be reversed.

[0074] For example, the associated keywords are: APT group AA, BB attack method, then based on the above keywords in the associated clue library, other attack methods associated with BB attack method, attack families to which APT group AA belongs, etc. can be retrieved.

[0075] After extracting the associated clue information, the associated clue information is incorporated into the corresponding threat intelligence information, thereby enriching the threat analysis information.

[0076] In some embodiments, to enrich the evidence in the threat handling report, after extracting threat intelligence information corresponding to the clue to be handled from at least one threat intelligence repository based on the preset threat analysis items in step 101, the threat handling method may further include the following steps 301 to 302:

[0077] 301. Extract historical attack information from at least one attack information database, where the historical attack information is used to perform attack trend analysis on clues.

[0078] The specific types of historical attack information are not limited in this embodiment. Historical attack information includes the following two types: one is information related to the victim involved in the clue; for example, the historical attack information is the number of times "IP: 111.122.101.120" requested the remote server controlled by the APT group AA within a month, and the time of each request. The other is information related to the attack method involved in the clue. For example, the historical information is: the attack range involved in the attacks carried out by the APT group AA using the BB attack method within a month, and the location distribution information of the victims within the attack range.

[0079] 302. Generate historical attack trend information corresponding to the clue based on the historical attack information.

[0080] Historical attack trend information is of guiding significance for determining intelligence handling recommendations. Therefore, it is necessary to generate historical attack trend information corresponding to clues based on historical attack information.

[0081] For example, historical attack information includes the number of requests made by IP: 111.122.101.120 to a remote server controlled by APT group AA within a month, as well as the time of each request. Historical attack trend information can include the total number of requests in a month, as well as the time period with the most requests.

[0082] Furthermore, if a threat resolution report is required for the clue, historical attack trend information is added to the threat analysis item in the threat resolution report template. This information is added to the threat analysis item in the threat resolution report template so that users can view it in the threat resolution report and easily specify the corresponding security protection strategy.

[0083] In some embodiments, in order to continuously improve the intelligence information in the threat intelligence library, after the above 101 extracts the threat intelligence information corresponding to the clue to be threatened and handled from at least one threat intelligence library based on the preset threat analysis item, the threat handling method may also include the following steps: if the threat intelligence information corresponding to the clue does not exist in the first target threat intelligence library in the at least one threat intelligence library, a prompt to add threat intelligence information is issued to the first target threat intelligence library.

[0084] If the threat intelligence information corresponding to the clue does not exist in the first target threat intelligence database, the intelligence information in the first target threat intelligence database is incomplete. Therefore, a prompt is issued to the first target threat intelligence database to add threat intelligence information, so that security analysts can use this prompt to improve the first target threat intelligence database. The prompt can include network features corresponding to the threat analysis items for which no corresponding intelligence information has been extracted, so that security analysts can improve the intelligence database based on these network features.

[0085] In some embodiments, after the above-mentioned step 102101 extracts threat intelligence information corresponding to the clue to be threat handled from at least one threat intelligence library based on the preset threat analysis item, the threat handling method may also include the following steps: if the threat intelligence information corresponding to the clue does not exist in all threat intelligence libraries, a threat handling termination prompt for the clue is issued.

[0086] If no threat intelligence information corresponding to a clue exists in any threat intelligence repository, there are two possible scenarios: First, the clue is not a threat clue, so no intelligence information exists in any threat intelligence repository to prove it is a threat clue. Second, the clue is a threat clue, but the intelligence information in all threat intelligence repositories is outdated and there is no relevant evidence. Therefore, since no threat intelligence information corresponding to the clue exists in any threat intelligence repository, a threat handling termination notification for the clue is issued, allowing security analysts to determine the specific situation based on this notification.

[0087] In some embodiments, in order to provide a more intuitive security protection strategy for users involved in the clue, after determining the corresponding intelligence handling suggestions based on the intelligence keywords in the extracted threat intelligence information in step 102, the threat handling method further includes the following steps: generating a threat handling report for the clue. The method for generating a threat handling report for the clue includes the following steps 401 to 403:

[0088] 401. Based on the type of clue, select the threat handling report template.

[0089] 402. For each threat analysis item in the threat handling report template, determine a value of the threat analysis item based on corresponding threat intelligence information, and assign a value to the threat analysis item according to the determined value.

[0090] For example, the intelligence information corresponding to the geographic information item is the geographic location and country of "IP: 111.122.101.120". The address location and country are used as the geographic information item value and assigned to the geographic information item.

[0091] 403. Process the intelligence disposal suggestion into a disposal plan with a logical relationship, and add the disposal plan to the threat disposal report template to form a threat disposal report for the clue.

[0092] To ensure that users can clearly understand the intelligence handling suggestions, the intelligence handling suggestions are processed into logically related handling plans based on the characteristics of the handling plans involved in the intelligence handling suggestions. The handling plans clearly define the execution steps for users to perform security operations.

[0093] After the disposal plan is determined, the disposal plan is converted into a format that can be used by the threat disposal report template, and the converted disposal plan is added to the threat disposal report template, thereby forming a threat disposal report that can guide users to perform security disposal.

[0094] After the threat disposal report is generated, it can be exported and displayed in the preset report list so that security analysts can view the threat disposal report.

[0095] Furthermore, according to the above method embodiment, another embodiment of the present invention also provides a threat handling device, such as Figure 2 As shown, the device includes:

[0096] An extraction unit 51 is configured to extract threat intelligence information corresponding to a clue to be handled from at least one threat intelligence repository based on a preset threat analysis item, wherein the threat analysis item is configured to extract threat intelligence information that satisfies a corresponding condition;

[0097] The determining unit 52 is configured to determine corresponding intelligence handling suggestions based on intelligence keywords in the extracted threat intelligence information.

[0098] The threat handling device provided by the embodiment of the present invention, when it is necessary to handle clues to be handled, first extracts the threat intelligence information corresponding to the clues from the threat intelligence library based on the preset threat analysis items, and then determines the corresponding intelligence handling suggestions based on the intelligence keywords in the extracted threat intelligence information. It can be seen that the solution provided by the embodiment of the present invention can combine the preset threat analysis and the threat intelligence library to conduct line-of-sight analysis on the clues, and give corresponding intelligence handling suggestions based on the threat intelligence information extracted by the line-of-sight analysis. The clue analysis process and the determination process of the intelligence handling suggestions involved do not require human intervention. Therefore, the solution provided by the embodiment of the present invention can improve the efficiency and accuracy of threat handling.

[0099] Optional, such as Figure 3 As shown, the extraction unit 51 includes:

[0100] A first extraction module 511 is configured to extract network features corresponding to the threat analysis items from the clues;

[0101] The second extraction module 512 is configured to extract corresponding threat intelligence information from a threat intelligence library corresponding to the threat analysis item based on the network feature corresponding to the threat analysis item.

[0102] Optional, such as Figure 3 As shown, the extraction unit 51 includes:

[0103] A first determining module 513 is configured to determine the ranking of the threat analysis items;

[0104] a third extraction module 514 configured to extract, for the threat analysis item ranked first, a network feature corresponding to the threat analysis item from the clue, and extract corresponding threat intelligence information from the at least one threat intelligence repository based on the network feature;

[0105] The fourth extraction module 515 is used to traverse the threat analysis items that are not ranked first in the order: if the threat intelligence information of the threat analysis item ranked previously contains the threat feature corresponding to the threat analysis item currently traversed, then the corresponding threat intelligence information is extracted from the at least one threat intelligence library based on the threat feature; if the threat intelligence information of the threat analysis item ranked previously does not contain the threat feature corresponding to the threat analysis item currently traversed, then the traversal operation is terminated.

[0106] Optional, such as Figure 3 As shown, the device also includes:

[0107] The association unit 53 is used to determine whether there is an associated keyword in the extracted threat intelligence information after the extraction unit 51 extracts the threat intelligence information corresponding to the clue to be threatened from at least one threat intelligence library based on the preset threat analysis item, wherein the associated keyword is used to extract associated clue information related to the threat intelligence information in which it is located; if so, extract the associated clue information corresponding to the associated keyword from at least one associated clue library, and incorporate the associated clue information into the corresponding threat intelligence information.

[0108] Optional, such as Figure 3 As shown, the device also includes:

[0109] An adding unit 54 is configured to extract the historical attack information from at least one attack information repository after the extraction unit 51 extracts threat intelligence information corresponding to the clue to be threat handled from at least one threat intelligence repository based on a preset threat analysis item, wherein the historical attack information is used to perform attack trend analysis on the clue; generate historical attack trend information corresponding to the clue based on the historical attack information; and add the historical attack trend information to the threat analysis item corresponding to the threat handling report template.

[0110] Optional, such as Figure 3 As shown, the device also includes:

[0111] The first prompt unit 55 is used to issue a prompt to add threat intelligence information to a first target threat intelligence library in the at least one threat intelligence library after the extraction unit 51 extracts threat intelligence information corresponding to the clue to be threat handled from the at least one threat intelligence library based on the preset threat analysis item, if the threat intelligence information corresponding to the clue does not exist in the first target threat intelligence library in the at least one threat intelligence library.

[0112] Optional, such as Figure 3 As shown, the device also includes:

[0113] The second prompt unit 56 is used to issue a threat handling termination prompt for the clue after the extraction unit 51 extracts the threat intelligence information corresponding to the clue to be threat handled from at least one threat intelligence library based on the preset threat analysis item, if the threat intelligence information corresponding to the clue does not exist in all threat intelligence libraries.

[0114] Optional, such as Figure 3 As shown, the device also includes:

[0115] The selection unit 57 is used to select a threat disposal report template based on the type of the clue before the extraction unit 51 extracts the threat intelligence information corresponding to the clue to be threat handled from at least one threat intelligence library based on the preset threat analysis item; and determine the threat analysis item included in the threat disposal report template as the preset threat analysis item.

[0116] Optional, such as Figure 3 As shown, the device also includes:

[0117] The generating unit 58 is configured to select a threat disposal report template based on the type of the clue after the determining unit 52 determines the corresponding intelligence disposal suggestion based on the intelligence keywords in the extracted threat intelligence information; determine the value of each threat analysis item in the threat disposal report template based on the corresponding threat intelligence information, and assign a value to the threat analysis item according to the determined value; process the intelligence disposal suggestion into a disposal plan with a logical relationship, and add the disposal plan to the threat disposal report template to form a threat disposal report for the clue.

[0118] Optional, such as Figure 3 As shown, the at least one threat intelligence library involved in the extraction unit 51 includes at least one of the following: a geographic information intelligence library, a family attack method intelligence library, an attack behavior intelligence library, and an advanced persistent threat intelligence library.

[0119] In the threat handling device provided by the embodiment of the present invention, the detailed description of the method adopted during the operation of each functional module can be found in the detailed description of the corresponding method in the above method embodiment, and will not be repeated here.

[0120] Furthermore, according to the above embodiment, another embodiment of the present invention also provides a computer-readable storage medium, wherein the storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the above threat handling method.

[0121] The beneficial effects of the computer-readable storage medium provided in the embodiments of the present application can be referred to the description in the embodiments of the above-mentioned threat handling method, and will not be repeated here.

[0122] Furthermore, according to the above embodiment, another embodiment of the present invention also provides a storage management device, which includes: a memory for storing a program; and a processor coupled to the memory for running the program to execute the above threat handling method.

[0123] The beneficial effects of the storage management device provided in the embodiments of the present application can be referred to the description in the embodiments of the above-mentioned threat handling method, which will not be repeated here.

[0124] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0125] It is understood that the relevant features of the above methods and devices can be referenced to each other. In addition, the terms "first" and "second" in the above embodiments are used to distinguish between the embodiments, and do not represent the advantages and disadvantages of the embodiments.

[0126] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0127] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing this type of system. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0128] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0129] Furthermore, those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of the present invention and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0130] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components of the operating method, apparatus, and framework of the deep neural network model according to an embodiment of the present invention. The present invention may also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0131] It should be noted that the above embodiments illustrate rather than limit the invention, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

Claims

1. A threat handling method, characterized in that: The method comprises: Extracting threat intelligence information corresponding to clues to be handled from at least one threat intelligence repository based on preset threat analysis items, wherein the threat analysis items are used to extract threat intelligence information that meets corresponding conditions; Determine corresponding intelligence handling suggestions based on intelligence keywords in the extracted threat intelligence information; Based on preset threat analysis items, threat intelligence information corresponding to clues to be threatened is extracted from at least one threat intelligence library, including: determining the ranking of the threat analysis items; for the threat analysis item ranked first, extracting the network features corresponding to the threat analysis item from the clues, and extracting the corresponding threat intelligence information from the at least one threat intelligence library based on the network features; for the threat analysis items ranked not first, traversing according to the ranking: if the threat feature corresponding to the currently traversed threat analysis item exists in the threat intelligence information of the threat analysis item ranked previously, extracting the corresponding threat intelligence information from the at least one threat intelligence library based on the threat feature; if the threat feature corresponding to the currently traversed threat analysis item does not exist in the threat intelligence information of the threat analysis item ranked previously, ending the traversal operation.

2. The method according to claim 1, characterized in that Based on the preset threat analysis items, extract threat intelligence information corresponding to the clues to be handled from at least one threat intelligence library, including: extracting network features corresponding to the threat analysis items from the clues; Based on the network feature corresponding to the threat analysis item, corresponding threat intelligence information is extracted from a threat intelligence library corresponding to the threat analysis item.

3. The method according to any one of claims 1 to 2, characterized in that After extracting threat intelligence information corresponding to clues to be handled based on preset threat analysis items from at least one threat intelligence library, the method further includes: Determining whether the extracted threat intelligence information contains a related keyword, wherein the related keyword is used to extract related clue information related to the threat intelligence information in which the related keyword exists; If so, the associated clue information corresponding to the associated keyword is extracted from at least one associated clue library, and the associated clue information is incorporated into the corresponding threat intelligence information.

4. The method according to any one of claims 1 to 2, characterized in that After extracting threat intelligence information corresponding to clues to be handled based on preset threat analysis items from at least one threat intelligence library, the method further includes: Extracting the historical attack information from at least one attack information database, wherein the historical attack information is used to perform attack trend analysis on the clue; Historical attack trend information corresponding to the clue is generated based on the historical attack information.

5. The method according to any one of claims 1 to 2, characterized in that After extracting threat intelligence information corresponding to clues to be handled based on preset threat analysis items from at least one threat intelligence library, the method further includes: If the threat intelligence information corresponding to the clue does not exist in a first target threat intelligence library among the at least one threat intelligence library, a prompt for adding threat intelligence information is issued to the first target threat intelligence library.

6. The method according to any one of claims 1 to 2, characterized in that After extracting threat intelligence information corresponding to clues to be handled based on preset threat analysis items from at least one threat intelligence library, the method further includes: If the threat intelligence information corresponding to the clue does not exist in all threat intelligence libraries, a threat handling termination prompt for the clue is issued.

7. The method according to any one of claims 1 to 2, characterized in that Before extracting threat intelligence information corresponding to clues to be handled based on preset threat analysis items from at least one threat intelligence library, the method further includes: Select a threat handling report template based on the type of clue; The threat analysis items included in the threat handling report template are determined as the preset threat analysis items.

8. The method according to any one of claims 1 to 2, characterized in that After determining corresponding intelligence handling suggestions based on intelligence keywords in the extracted threat intelligence information, the method includes: Select a threat handling report template based on the type of clue; For each threat analysis item in the threat handling report template, determining a value of the threat analysis item based on corresponding threat intelligence information, and assigning a value to the threat analysis item according to the determined value; The intelligence handling suggestions are processed into handling plans with logical relationships, and the handling plans are added to the threat handling report template to form a threat handling report for the clues.

9. The method according to any one of claims 1 to 2, characterized in that The at least one threat intelligence library includes at least one of the following: a geographic information intelligence library, a family attack method intelligence library, an attack behavior intelligence library, and an advanced persistent threat intelligence library.

10. A threat handling device, characterized in that: The device comprises: An extraction unit is configured to extract threat intelligence information corresponding to clues to be threatened and handled from at least one threat intelligence repository based on preset threat analysis items, wherein the threat analysis items are used to extract threat intelligence information that meets corresponding conditions; wherein, based on the preset threat analysis items, extracting threat intelligence information corresponding to clues to be threatened and handled from at least one threat intelligence repository comprises: determining the ranking of the threat analysis items; for a threat analysis item ranked first, extracting network features corresponding to the threat analysis item from the clues, and extracting corresponding threat intelligence information from the at least one threat intelligence repository based on the network features; for threat analysis items ranked not first, traversing according to the ranking: if the threat feature corresponding to the currently traversed threat analysis item exists in the threat intelligence information of the threat analysis item ranked previously, extracting corresponding threat intelligence information from the at least one threat intelligence repository based on the threat feature; if the threat feature corresponding to the currently traversed threat analysis item does not exist in the threat intelligence information of the threat analysis item ranked previously, terminating the traversal operation; The determination unit is used to determine corresponding intelligence handling suggestions based on intelligence keywords in the extracted threat intelligence information.

11. A computer-readable storage medium, characterized in that The storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the threat handling method according to any one of claims 1 to 9.

12. A storage management device, characterized in that: The storage management device includes: Memory, used to store programs; A processor, coupled to the memory, is configured to run the program to execute the threat handling method according to any one of claims 1 to 9.

Images