Threat intelligence knowledge graph construction method, device, equipment and storage medium

Abstract

The present disclosure provides a method, device, equipment and storage medium for constructing a threat intelligence knowledge graph, and relates to the field of computer technology. A plurality of threat intelligence entities are obtained, each of which corresponds to the attribute information of the threat intelligence entity and the relationship information with other threat intelligence entities. According to a preset algorithm, each threat intelligence entity is mapped to a feature vector corresponding to the current threat intelligence entity according to the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities. The similarity between any two threat intelligence entities is determined according to the feature vector corresponding to each threat intelligence entity. When the similarity meets a preset threshold, the two threat intelligence entities whose similarity meets the preset threshold are merged in a preset manner to obtain a target threat intelligence entity, and a threat intelligence knowledge graph is constructed according to the target threat intelligence entity. The present disclosure overcomes the problem of low utilization of current threat intelligence knowledge graphs.

Description

Background Art

[0002] The timely sharing of threat intelligence can effectively improve network security protection capabilities. With the diversification of threat data sources, how to extract knowledge from massive intelligence, refine threat features based on the extracted knowledge, and thus demonstrate the relationship between threat intelligence has become an urgent problem to be solved.

[0003] Knowledge graph technology has advantages in current knowledge search, fusion and reasoning. However, in the process of applying knowledge graph technology in the field of threat intelligence, there is a problem of information redundancy in the constructed threat intelligence knowledge graph, which reduces the utilization rate of the threat intelligence knowledge graph. Summary of the invention

[0004] The present disclosure provides a method, device, equipment and storage medium for constructing a threat intelligence knowledge graph, which at least to a certain extent overcomes the problem of low utilization rate of current threat intelligence knowledge graphs.

[0005] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0006] According to one aspect of the present disclosure, a method for constructing a threat intelligence knowledge graph is provided, comprising:

[0007] Acquire multiple threat intelligence entities, where each threat intelligence entity corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities;

[0008] According to a preset algorithm, each threat intelligence entity is mapped into a feature vector corresponding to the current threat intelligence entity based on the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities;

[0009] Determine the similarity between any two threat intelligence entities based on the feature vector corresponding to each threat intelligence entity;

[0010] When the similarity meets the preset threshold, two threat intelligence entities whose similarity meets the preset threshold are merged according to a preset method to obtain a target threat intelligence entity;

[0011] Construct a threat intelligence knowledge graph based on the target threat intelligence entity.

[0012] In one embodiment of the present disclosure, when the similarity satisfies a preset threshold, after merging two threat intelligence entities whose similarity satisfies the preset threshold in a preset manner to obtain a target threat intelligence entity, before constructing a threat intelligence knowledge graph according to the target threat intelligence entity, the method further includes:

[0013] Classify the target threat intelligence entities according to preset classification rules to obtain target threat intelligence entities of multiple categories;

[0014] Determine, based on a preset model, whether any target threat intelligence entity under any category has corresponding relationship information with target threat intelligence entities under other categories;

[0015] In the case where corresponding relationship information exists, the relationship information is supplemented between the two target threat intelligence entities to obtain the supplemented target threat intelligence entity;

[0016] Construct a threat intelligence knowledge graph based on the target threat intelligence entity, including:

[0017] Construct a threat intelligence knowledge graph based on the completed target threat intelligence entities.

[0018] In one embodiment of the present disclosure, determining whether any target threat intelligence entity under any category has corresponding relationship information with target threat intelligence entities under other categories according to a preset model includes:

[0019] According to the Transe model, determine whether any target threat intelligence entity under any category has corresponding relationship information with the target threat intelligence entities under other categories.

[0020] In one embodiment of the present disclosure, when the similarity satisfies a preset threshold, two threat intelligence entities whose similarity satisfies the preset threshold are merged in a preset manner to obtain a target threat intelligence entity, including:

[0021] Merge the text information corresponding to two threat intelligence entities whose similarity meets the preset threshold to obtain the target threat intelligence entity;

[0022] The attribute information of the threat intelligence entities and the relationship information with other threat intelligence entities respectively corresponding to the two threat intelligence entities whose similarity meets the preset threshold are used as the attribute information of the target threat intelligence entity and the relationship information with other threat intelligence entities.

[0023] In one embodiment of the present disclosure, when the similarity satisfies a preset threshold, two threat intelligence entities whose similarity satisfies the preset threshold are merged in a preset manner to obtain a target threat intelligence entity, including:

[0024] Delete any one of the two threat intelligence entities whose similarity meets the preset threshold;

[0025] The attribute information corresponding to the deleted threat intelligence entity and the relationship information with other threat intelligence entities are used as the attribute information of the non-deleted threat intelligence entity and the relationship information with other threat intelligence entities of two threat intelligence entities whose similarity meets a preset threshold.

[0026] In one embodiment of the present disclosure, before obtaining a plurality of threat intelligence entities, each of which corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities, the method further includes:

[0027] Determine the category of the threat intelligence entity, the category of the attribute information corresponding to the threat intelligence entity, and the category of the relationship information between the threat intelligence entity and other threat intelligence entities according to preset standards.

[0028] In one embodiment of the present disclosure, multiple threat intelligence entities are obtained, wherein each threat intelligence entity corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities, including:

[0029] Obtain threat intelligence information;

[0030] According to preset rules, the threat intelligence information is mapped into multiple threat intelligence entities according to the determined threat intelligence entity category, mapped into attribute information corresponding to multiple threat intelligence entities according to the determined attribute information category, and mapped into relationship information of each threat intelligence entity with other threat intelligence entities according to the determined relationship information category.

[0031] According to another aspect of the present disclosure, a threat intelligence knowledge graph construction device is provided, comprising:

[0032] An acquisition module is used to acquire multiple threat intelligence entities, where each threat intelligence entity corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities;

[0033] A mapping module is used to map each threat intelligence entity according to the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities into a feature vector corresponding to the current threat intelligence entity according to a preset algorithm;

[0034] A first determination module is used to determine the similarity between any two threat intelligence entities according to the feature vector corresponding to each threat intelligence entity;

[0035] A merging module is used to merge two threat intelligence entities whose similarities meet a preset threshold in a preset manner to obtain a target threat intelligence entity when the similarity meets a preset threshold;

[0036] A building module is used to build a threat intelligence knowledge graph based on the target threat intelligence entity.

[0037] In one embodiment of the present disclosure, the threat intelligence knowledge graph construction device further includes:

[0038] A classification module, when the similarity meets a preset threshold, merges two threat intelligence entities whose similarity meets the preset threshold in a preset manner to obtain a target threat intelligence entity, and then classifies the target threat intelligence entity according to a preset classification rule before building a threat intelligence knowledge graph based on the target threat intelligence entity to obtain target threat intelligence entities of multiple categories;

[0039] The second determination module is used to determine whether any target threat intelligence entity under any category has corresponding relationship information with target threat intelligence entities under other categories according to a preset model;

[0040] The supplementing module is used to supplement the relationship information between two target threat intelligence entities when there is corresponding relationship information, so as to obtain the supplemented target threat intelligence entity.

[0041] Building blocks also include:

[0042] The construction unit is used to construct a threat intelligence knowledge graph based on the completed target threat intelligence entity.

[0043] In one embodiment of the present disclosure, the first determining module includes:

[0044] The determination unit is used to determine whether any target threat intelligence entity under any category has corresponding relationship information with the target threat intelligence entities under other categories according to the Transe model.

[0045] In one embodiment of the present disclosure, the merging module includes:

[0046] A first merging unit is used to merge text information corresponding to two threat intelligence entities whose similarity meets a preset threshold to obtain a target threat intelligence entity;

[0047] The second merging unit is used to use the attribute information of the threat intelligence entities and the relationship information with other threat intelligence entities respectively corresponding to two threat intelligence entities whose similarity meets a preset threshold as the attribute information of the target threat intelligence entity and the relationship information with other threat intelligence entities.

[0048] In one embodiment of the present disclosure, the merging module includes:

[0049] The third merging unit is used to delete any one of the two threat intelligence entities whose similarity meets a preset threshold;

[0050] The fourth merging unit is used to use the attribute information corresponding to the deleted threat intelligence entity and the relationship information with other threat intelligence entities as the attribute information of the non-deleted threat intelligence entity and the relationship information with other threat intelligence entities whose similarity meets a preset threshold.

[0051] In one embodiment of the present disclosure, the threat intelligence knowledge graph construction device further includes:

[0052] The third determination module is used to determine the category of the threat intelligence entity, the category of the attribute information corresponding to the threat intelligence entity, and the category of the relationship information between the threat intelligence entity and other threat intelligence entities according to preset standards before obtaining multiple threat intelligence entities, each of which corresponds to the attribute information of the threat intelligence entity and the relationship information with other threat intelligence entities.

[0053] In one embodiment of the present disclosure, the acquisition module further includes:

[0054] An acquisition unit, used to acquire threat intelligence information;

[0055] A mapping unit is used to map threat intelligence information into multiple threat intelligence entities according to the category of determined threat intelligence entities according to preset rules, map it into attribute information corresponding to multiple threat intelligence entities according to the category of determined attribute information, and map the relationship information of each threat intelligence entity into other threat intelligence entities according to the category of determined relationship information.

[0056] According to another aspect of the present disclosure, there is provided an electronic device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the above-mentioned threat intelligence knowledge graph construction method by executing the executable instructions.

[0057] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned threat intelligence knowledge graph construction method is implemented.

[0058] The threat intelligence knowledge graph construction method provided by the embodiment of the present disclosure obtains multiple threat intelligence entities, and then maps each threat intelligence entity to a feature vector corresponding to the current threat intelligence entity according to the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities according to a preset algorithm, and then determines the similarity between any two threat intelligence entities according to the feature vector corresponding to each threat intelligence entity. When the similarity meets the preset threshold, the two threat intelligence entities whose similarity meets the preset threshold are merged to obtain the target threat intelligence entity, and then a threat intelligence knowledge graph is constructed according to the target threat intelligence entity. Since threat intelligence entities with high similarity are merged, the number of threat intelligence entities in the constructed threat intelligence knowledge graph can be reduced, thereby avoiding the problem of low utilization of the threat intelligence knowledge graph caused by too many threat intelligence entities in the constructed threat intelligence knowledge graph, and improving the utilization of the threat intelligence knowledge graph.

[0059] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0061] Figure 1 A flowchart of a method for constructing a threat intelligence knowledge graph in an embodiment of the present disclosure is shown;

[0062] Figure 2 Another flowchart of a method for constructing a threat intelligence knowledge graph in an embodiment of the present disclosure is shown;

[0063] Figure 3 A flowchart of another method for constructing a threat intelligence knowledge graph in an embodiment of the present disclosure is shown;

[0064] Figure 4 A flowchart of another method for constructing a threat intelligence knowledge graph in an embodiment of the present disclosure is shown;

[0065] Figure 5 A flowchart of another method for constructing a threat intelligence knowledge graph in an embodiment of the present disclosure is shown;

[0066] Figure 6 A schematic diagram of a threat intelligence knowledge graph construction device in an embodiment of the present disclosure is shown; and

[0067] Figure 7 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0068] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0069] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and thus their repeated descriptions will be omitted. Some of the block diagrams shown in the accompanying drawings are functional threat intelligence entities, which do not necessarily correspond to physically or logically independent threat intelligence entities. These functional threat intelligence entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0070] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0071] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0072] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0073] In order to solve the above problems, the embodiments of the present disclosure provide a method, device, equipment and storage medium for constructing a threat intelligence knowledge graph.

[0074] Below, the threat intelligence knowledge graph construction method provided by the embodiment of the present disclosure is first described.

[0075] Figure 1 A flow chart of a method for constructing a threat intelligence knowledge graph provided by an embodiment of the present disclosure is shown.

[0076] like Figure 1As shown, the threat intelligence knowledge graph construction method provided by the embodiment of the present disclosure may include:

[0077] S102, obtaining a plurality of threat intelligence entities, wherein each threat intelligence entity corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities.

[0078] It should be noted that the threat intelligence entity may be the smallest element constituting the threat intelligence knowledge graph, and the attribute information may be information describing the attributes of the threat intelligence entity.

[0079] Generally speaking, there are certain connections between different threat intelligence entities in the threat intelligence knowledge graph, and relationship information is information that can be used to describe this connection.

[0080] Exemplarily, threat intelligence entities and threat intelligence entities can constitute triples of threat intelligence entities, relationships, and threat intelligence entities, and multiple triples are used to directly constitute a threat intelligence knowledge graph.

[0081] At the same time, in the threat intelligence knowledge graph, there may also be triples of threat intelligence entities, attributes, and values, which can be used to describe threat intelligence entities.

[0082] S104, mapping each threat intelligence entity into a feature vector corresponding to the current threat intelligence entity according to the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities according to a preset algorithm.

[0083] It should be noted that the preset algorithms may include TF-IDF, word2Vec, Jaccard, and simHash. The present disclosure does not specifically limit the preset algorithms.

[0084] Mapping the threat intelligence entity according to the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities into the feature vector corresponding to the current threat intelligence entity according to the above algorithm is a relatively common technology in the field and will not be repeated here.

[0085] Since different threat intelligence entities have different attribute information and relationship information with other threat intelligence entities, the feature vectors corresponding to different threat intelligence entities are also different.

[0086] S106, determining the similarity between any two threat intelligence entities according to the feature vector corresponding to each threat intelligence entity.

[0087] It should be noted that in the embodiments of the present disclosure, the similarity of the feature vectors corresponding to two threat intelligence entities can be determined based on a variety of calculation methods such as cosine distance and Hamming distance, which is not specifically limited here.

[0088] S108, when the similarity meets the preset threshold, two threat intelligence entities whose similarity meets the preset threshold are merged in a preset manner to obtain a target threat intelligence entity.

[0089] Exemplarily, the preset threshold may include manually dividing different threat intelligence entities into similar threat intelligence entities and dissimilar threat intelligence entities, and then obtaining the similarities between the divided similar threat intelligence entities, respectively. The method for obtaining the similarity may be the method in the above steps, which will not be repeated here.

[0090] After obtaining the similarities between multiple similar threat intelligence entities, the average of the similarities of the multiple similar threat intelligence entities can be obtained, and then the average is used as a preset threshold.

[0091] S110, construct a threat intelligence knowledge graph based on the target threat intelligence entity.

[0092] It should be noted that after the threat intelligence knowledge graph is constructed, the threat intelligence knowledge graph can be stored.

[0093] Exemplarily, the determined threat intelligence knowledge graph can be stored and displayed based on the Neo4j database.

[0094] The threat intelligence knowledge graph construction method provided by the embodiment of the present disclosure obtains multiple threat intelligence entities, and then maps each threat intelligence entity to a feature vector corresponding to the current threat intelligence entity according to the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities according to a preset algorithm, and then determines the similarity between any two threat intelligence entities according to the feature vector corresponding to each threat intelligence entity. When the similarity meets the preset threshold, the two threat intelligence entities whose similarity meets the preset threshold are merged to obtain the target threat intelligence entity, and then a threat intelligence knowledge graph is constructed according to the target threat intelligence entity. Since threat intelligence entities with high similarity are merged, the number of threat intelligence entities in the constructed threat intelligence knowledge graph can be reduced, thereby avoiding the problem of low utilization of the threat intelligence knowledge graph caused by too many threat intelligence entities in the constructed threat intelligence knowledge graph, and improving the utilization of the threat intelligence knowledge graph.

[0095] Based on the same inventive concept, the embodiment of the present disclosure provides a method for constructing a threat intelligence knowledge graph, which can be executed by any electronic device with computing and processing capabilities.

[0096] Figure 2 A flowchart of another method for constructing a threat intelligence knowledge graph in an embodiment of the present disclosure is shown.

[0097] like Figure 2 As shown, another method for constructing a threat intelligence knowledge graph may include:

[0098] S202, classify the target threat intelligence entity according to a preset classification rule to obtain target threat intelligence entities of multiple categories.

[0099] It should be noted that the preset rules may include rules defined by the user.

[0100] For example, a user may set rules for classifying a target threat intelligence entity based on multiple aspects such as path, reason, and function.

[0101] S204: Determine, according to a preset model, whether any target threat intelligence entity under any category has corresponding relationship information with target threat intelligence entities under other categories.

[0102] It should be noted that there may be connections between different target threat intelligence entities.

[0103] S204 may specifically include:

[0104] According to the Transe model, determine whether any target threat intelligence entity under any category has corresponding relationship information with the target threat intelligence entities under other categories.

[0105] Exemplarily, determining whether there is a storage relationship between target threat intelligence entities according to the Transe model may include:

[0106] First, the word vector corresponding to each target threat intelligence entity is determined, and then the word vectors of a category of target threat intelligence entities are used as a matrix, where the rows in the matrix represent the word vectors of the target threat intelligence entities.

[0107] Secondly, the word vector corresponding to the relationship information is determined according to the above method. The method for determining the vector has been described in detail in the above embodiment and will not be repeated here. Then the word vector corresponding to the determined relationship information is used as a matrix, and the rows of the matrix are used as the word vectors of the relationship information.

[0108] Then, any word vector representing the target threat intelligence entity is obtained from the matrix corresponding to the target threat intelligence entity, and then any word vector representing the relationship information is obtained from the matrix corresponding to the relationship information, and then the above two vectors are input into the Transe model to obtain the vector.

[0109] Then we need to determine whether there are vectors in the obtained vector that are similar to vectors of other categories.

[0110] Among them, when determining whether they are similar, the determination can be made according to the method in the above steps.

[0111] When it is determined that there is a vector similar to the vector obtained by the model, the corresponding relationship information may be added between the two target threat intelligence entities.

[0112] S206: If corresponding relationship information exists, the relationship information is supplemented between the two target threat intelligence entities to obtain a supplemented target threat intelligence entity.

[0113] In the threat intelligence knowledge graph construction method provided by the embodiment of the present disclosure, the target threat intelligence entities are classified, and then it is determined whether there is a relationship between target threat intelligence entities of different categories in the target threat intelligence entities of different categories. If there is a relationship, the relationship between the target threat intelligence entities is supplemented, and then the threat intelligence knowledge graph is constructed using the supplemented target threat intelligence entities. Since the threat intelligence knowledge graph is constructed based on the supplemented target threat intelligence entities, the relationships in the constructed threat intelligence knowledge graph can be made cleaner, avoiding the problem of low availability of the threat intelligence knowledge graph caused by the lack of relationship information in the threat intelligence knowledge graph.

[0114] Based on the same inventive concept, the embodiment of the present disclosure provides another method for constructing a threat intelligence knowledge graph, which can be executed by any electronic device with computing and processing capabilities.

[0115] Figure 3 A flowchart of another threat intelligence knowledge graph construction method in an embodiment of the present disclosure is shown.

[0116] like Figure 3 As shown, another method for constructing a threat intelligence knowledge graph is different from the above embodiment in that S108 may include:

[0117] S302: Merge the text information corresponding to two threat intelligence entities whose similarity meets a preset threshold to obtain a target threat intelligence entity.

[0118] It should be noted that the threat intelligence entity may generally be represented by information, and merging text information may include merging text information corresponding to two threat intelligence entities.

[0119] S304: The attribute information of the threat intelligence entities and the relationship information with other threat intelligence entities respectively corresponding to the two threat intelligence entities whose similarity meets the preset threshold are used as the attribute information of the target threat intelligence entity and the relationship information with other threat intelligence entities.

[0120] In the threat intelligence knowledge graph correspondence provided by the embodiment of the present disclosure, the target threat intelligence entity is obtained by merging the text information corresponding to the two threat intelligence entities, and then the attributes corresponding to the two threat intelligence entities and the relationship information with other threat intelligence entities are merged, thereby avoiding the problem of missing information of the threat intelligence entities after the threat intelligence entities are merged.

[0121] Based on the same inventive concept, the disclosed embodiment provides another method for constructing a threat intelligence knowledge graph, which can be executed by any electronic device with computing and processing capabilities.

[0122] Figure 4 A flowchart of another threat intelligence knowledge graph construction method in an embodiment of the present disclosure is shown.

[0123] like Figure 4 As shown, another method for constructing a threat intelligence knowledge graph is different from the above embodiment in that S108 may include:

[0124] S402: Delete any one of the two threat intelligence entities whose similarity meets a preset threshold.

[0125] It should be noted that any one of the two threat intelligence entities can be randomly deleted.

[0126] S404: Use the attribute information corresponding to the deleted threat intelligence entity and the relationship information with other threat intelligence entities as the attribute information of the non-deleted threat intelligence entity and the relationship information with other threat intelligence entities of two threat intelligence entities whose similarity meets a preset threshold.

[0127] In the threat intelligence knowledge graph correspondence provided by the embodiment of the present disclosure, by deleting any one of the two threat intelligence entities and retaining the remaining threat intelligence entity, the target threat intelligence entity is obtained, and then the attributes corresponding to the two threat intelligence entities and the relationship information with other threat intelligence entities are merged, thereby avoiding the problem of missing information of the threat intelligence entities after the threat intelligence entities are merged.

[0128] Based on the same inventive concept, the disclosed embodiment provides another method for constructing a threat intelligence knowledge graph, which can be executed by any electronic device with computing and processing capabilities.

[0129] Figure 5 A flowchart of another threat intelligence knowledge graph construction method in an embodiment of the present disclosure is shown.

[0130] like Figure 5As shown, another method for constructing a threat intelligence knowledge graph is different from the above embodiment in that, before S102, the method may further include:

[0131] S502: Determine, according to a preset standard, the category of the threat intelligence entity, the category of the attribute information corresponding to the threat intelligence entity, and the category of the relationship information between the threat intelligence entity and other threat intelligence entities.

[0132] It should be noted that the preset standard may be a user-defined standard.

[0133] For example, the user refers to the STIX 2.1 cybersecurity intelligence standard commonly used in the former industry, and combines the behaviors and structures that security personnel usually create or use when security incidents occur, and divides the threat intelligence entity categories in the intelligence threat intelligence knowledge graph into 9 categories: attack organizations, attack indicators, vulnerabilities, attack activities, reports, tools, malware, attack patterns, and solutions.

[0134] In addition, by analyzing the existing cybersecurity corpus and relevant national standards and specifications, users can classify the semantic relationship categories of threat intelligence entities into seven categories: use, belong to, exploit, initiate, contain vulnerability, contain object and associate. In addition, the attributes of various types of intelligence threat intelligence entities are implemented with reference to the international intelligence standard STIX2.1.

[0135] S504, obtaining threat intelligence information;

[0136] Exemplarily, in the present disclosure, information of multiple categories and multiple addresses can be obtained through multiple channels such as crawlers.

[0137] It should be noted that the present disclosure does not limit the channels and means of obtaining information.

[0138] S506, according to preset rules, the threat intelligence information is mapped into multiple threat intelligence entities according to the determined categories of threat intelligence entities, mapped into attribute information respectively corresponding to multiple threat intelligence entities according to the determined categories of attribute information, and mapped into relationship information of each threat intelligence entity respectively with other threat intelligence entities according to the determined categories of relationship information.

[0139] It should be noted that in the present disclosure, mapping can be performed according to user customization or by deep learning methods.

[0140] In the threat intelligence knowledge graph construction method provided by the embodiment of the present disclosure, by pre-categorizing threat intelligence entities, threat intelligence entity attributes, and threat intelligence entity relationship information, it is possible to facilitate the subsequent fusion and supplementation of threat intelligence entities, thereby facilitating the subsequent fusion and supplementation between threat intelligence entities.

[0141] Based on the same inventive concept, the embodiments of the present disclosure also provide a threat intelligence knowledge graph construction device, such as the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0142] Figure 6 A schematic diagram of a threat intelligence knowledge graph construction device in an embodiment of the present disclosure is shown. Figure 6 As shown, the device 600 includes:

[0143] An acquisition module 602 is used to acquire multiple threat intelligence entities, where each threat intelligence entity corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities;

[0144] A mapping module 604 is used to map each threat intelligence entity according to the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities into a feature vector corresponding to the current threat intelligence entity according to a preset algorithm;

[0145] A first determination module 606, configured to determine the similarity between any two threat intelligence entities according to the feature vector corresponding to each threat intelligence entity;

[0146] A merging module 608 is used to merge two threat intelligence entities whose similarities meet the preset threshold in a preset manner to obtain a target threat intelligence entity when the similarity meets the preset threshold;

[0147] The construction module 610 is used to construct a threat intelligence knowledge graph according to the target threat intelligence entity.

[0148] In the threat intelligence knowledge graph construction device provided by the embodiment of the present disclosure, multiple threat intelligence entities are obtained, and then each threat intelligence entity is mapped to a feature vector corresponding to the current threat intelligence entity according to the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities according to a preset algorithm, and then the similarity between any two threat intelligence entities is determined according to the feature vector corresponding to each threat intelligence entity. When the similarity meets the preset threshold, the two threat intelligence entities whose similarity meets the preset threshold are merged to obtain the target threat intelligence entity, and then a threat intelligence knowledge graph is constructed according to the target threat intelligence entity. Since threat intelligence entities with high similarity are merged, the number of threat intelligence entities in the constructed threat intelligence knowledge graph can be reduced, thereby avoiding the problem of low utilization of the threat intelligence knowledge graph caused by too many threat intelligence entities in the constructed threat intelligence knowledge graph, and improving the utilization of the threat intelligence knowledge graph.

[0149] In one embodiment of the present disclosure, the threat intelligence knowledge graph construction device further includes:

[0150] The classification module 610 is used to classify the target threat intelligence entity according to a preset classification rule before building a threat intelligence knowledge graph based on the target threat intelligence entity after merging the two threat intelligence entities whose similarity meets the preset threshold in a preset manner to obtain a target threat intelligence entity when the similarity meets the preset threshold, so as to obtain target threat intelligence entities of multiple categories;

[0151] A second determination module 612 is used to determine whether any target threat intelligence entity under any category has corresponding relationship information with target threat intelligence entities under other categories according to a preset model;

[0152] The supplement module 614 is used to supplement the relationship information between the two target threat intelligence entities to obtain the supplemented target threat intelligence entity when there is corresponding relationship information.

[0153] The building block 610 further includes:

[0154] The construction unit is used to construct a threat intelligence knowledge graph based on the completed target threat intelligence entity.

[0155] In the threat intelligence knowledge graph construction method provided by the embodiment of the present disclosure, the target threat intelligence entities are classified, and then it is determined whether there is a relationship between target threat intelligence entities of different categories in the target threat intelligence entities of different categories. If there is a relationship, the relationship between the target threat intelligence entities is supplemented, and then the threat intelligence knowledge graph is constructed using the supplemented target threat intelligence entities. Since the threat intelligence knowledge graph is constructed based on the supplemented target threat intelligence entities, the relationships in the constructed threat intelligence knowledge graph can be made cleaner, avoiding the problem of low availability of the threat intelligence knowledge graph caused by the lack of relationship information in the threat intelligence knowledge graph.

[0156] In one embodiment of the present disclosure, the first determining module 606 includes:

[0157] The determination unit is used to determine whether any target threat intelligence entity under any category has corresponding relationship information with the target threat intelligence entities under other categories according to the Transe model.

[0158] In one embodiment of the present disclosure, the merging module 608 includes:

[0159] A first merging unit is used to merge text information corresponding to two threat intelligence entities whose similarity meets a preset threshold to obtain a target threat intelligence entity;

[0160] The second merging unit is used to use the attribute information of the threat intelligence entities and the relationship information with other threat intelligence entities respectively corresponding to two threat intelligence entities whose similarity meets a preset threshold as the attribute information of the target threat intelligence entity and the relationship information with other threat intelligence entities.

[0161] In the threat intelligence knowledge graph correspondence provided by the embodiment of the present disclosure, by deleting any one of the two threat intelligence entities and retaining the remaining threat intelligence entity, the target threat intelligence entity is obtained, and then the attributes corresponding to the two threat intelligence entities and the relationship information with other threat intelligence entities are merged, thereby avoiding the problem of missing information of the threat intelligence entities after the threat intelligence entities are merged.

[0162] In one embodiment of the present disclosure, the merging module 608 includes:

[0163] The third merging unit is used to delete any one of the two threat intelligence entities whose similarity meets a preset threshold;

[0164] The fourth merging unit is used to use the attribute information corresponding to the deleted threat intelligence entity and the relationship information with other threat intelligence entities as the attribute information of the non-deleted threat intelligence entity and the relationship information with other threat intelligence entities whose similarity meets a preset threshold.

[0165] In the threat intelligence knowledge graph correspondence provided by the embodiment of the present disclosure, the target threat intelligence entity is obtained by merging the text information corresponding to the two threat intelligence entities, and then the attributes corresponding to the two threat intelligence entities and the relationship information with other threat intelligence entities are merged, thereby avoiding the problem of missing information of the threat intelligence entities after the threat intelligence entities are merged.

[0166] In one embodiment of the present disclosure, the threat intelligence knowledge graph construction device further includes:

[0167] The third determination module 616 is used to determine the category of the threat intelligence entity, the category of the attribute information corresponding to the threat intelligence entity, and the category of the relationship information between the threat intelligence entity and other threat intelligence entities according to preset standards before obtaining multiple threat intelligence entities, each of which corresponds to the attribute information of the threat intelligence entity and the relationship information with other threat intelligence entities.

[0168] In one embodiment of the present disclosure, the acquisition module 602 further includes:

[0169] An acquisition unit, used to acquire threat intelligence information;

[0170] A mapping unit is used to map threat intelligence information into multiple threat intelligence entities according to the category of determined threat intelligence entities according to preset rules, map it into attribute information corresponding to multiple threat intelligence entities according to the category of determined attribute information, and map the relationship information of each threat intelligence entity into other threat intelligence entities according to the category of determined relationship information.

[0171] In the threat intelligence knowledge graph construction method provided by the embodiment of the present disclosure, by pre-categorizing threat intelligence entities, threat intelligence entity attributes, and threat intelligence entity relationship information, it is possible to facilitate the subsequent fusion and supplementation of threat intelligence entities, thereby facilitating the subsequent fusion and supplementation between threat intelligence entities.

[0172] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0173] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present disclosure is described. Figure 7 The electronic device 700 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0174] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0175] The storage unit stores program codes, which can be executed by the processing unit 710, so that the processing unit 710 performs the steps of various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 710 can perform the following steps of the above method embodiment:

[0176] Acquire multiple threat intelligence entities, where each threat intelligence entity corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities;

[0177] According to a preset algorithm, each threat intelligence entity is mapped into a feature vector corresponding to the current threat intelligence entity based on the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities;

[0178] Determine the similarity between any two threat intelligence entities based on the feature vector corresponding to each threat intelligence entity;

[0179] When the similarity meets the preset threshold, two threat intelligence entities whose similarity meets the preset threshold are merged according to a preset method to obtain a target threat intelligence entity;

[0180] Construct a threat intelligence knowledge graph based on the target threat intelligence entity.

[0181] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202 , and may further include a read-only storage unit (ROM) 7203 .

[0182] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0183] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0184] The electronic device 700 may also communicate with one or more external devices 740 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 750. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 760. As shown, the network adapter 760 communicates with other modules of the electronic device 700 via a bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0185] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0186] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the above method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0187] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0188] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0189] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0190] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0191] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0192] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0193] Through the description of the above implementation modes, it is easy for those skilled in the art to understand that the example implementation modes described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation mode of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation mode of the present disclosure.

[0194] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for constructing a threat intelligence knowledge graph, characterized in that: The method comprises: Acquire multiple threat intelligence entities, where each threat intelligence entity corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities; According to a preset algorithm, each threat intelligence entity is mapped into a feature vector corresponding to the current threat intelligence entity based on the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities; Determine the similarity between any two threat intelligence entities based on the feature vector corresponding to each threat intelligence entity; When the similarity satisfies a preset threshold, two threat intelligence entities whose similarity satisfies the preset threshold are merged in a preset manner to obtain a target threat intelligence entity; Build a threat intelligence knowledge graph based on the target threat intelligence entity; The construction of a threat intelligence knowledge graph based on the target threat intelligence entity includes: Classify the target threat intelligence entities according to preset classification rules to obtain target threat intelligence entities of multiple categories; Determine, based on a preset model, whether any target threat intelligence entity under any category has corresponding relationship information with target threat intelligence entities under other categories; In the case where corresponding relationship information exists, the relationship information is supplemented between the two target threat intelligence entities to obtain the supplemented target threat intelligence entity; Construct a threat intelligence knowledge graph based on the completed target threat intelligence entities.

2. The method for constructing a threat intelligence knowledge graph according to claim 1, characterized in that: The determining, according to the preset model, whether any target threat intelligence entity under any category has corresponding relationship information with target threat intelligence entities under other categories includes: According to the Transe model, determine whether any target threat intelligence entity under any category has corresponding relationship information with the target threat intelligence entities under other categories.

3. The method for constructing a threat intelligence knowledge graph according to claim 1, characterized in that: When the similarity satisfies a preset threshold, two threat intelligence entities whose similarity satisfies the preset threshold are merged in a preset manner to obtain a target threat intelligence entity, including: Merge the text information corresponding to two threat intelligence entities whose similarity meets the preset threshold to obtain the target threat intelligence entity; The attribute information of the threat intelligence entities and the relationship information with other threat intelligence entities respectively corresponding to the two threat intelligence entities whose similarity meets the preset threshold are used as the attribute information of the target threat intelligence entity and the relationship information with other threat intelligence entities.

4. The method for constructing a threat intelligence knowledge graph according to claim 1, characterized in that: When the similarity satisfies a preset threshold, two threat intelligence entities whose similarity satisfies the preset threshold are merged in a preset manner to obtain a target threat intelligence entity, including: Delete any one of the two threat intelligence entities whose similarity meets the preset threshold; The attribute information corresponding to the deleted threat intelligence entity and the relationship information with other threat intelligence entities are used as the attribute information of the non-deleted threat intelligence entity and the relationship information with other threat intelligence entities of two threat intelligence entities whose similarity meets a preset threshold.

5. The method for constructing a threat intelligence knowledge graph according to claim 1, characterized in that: Before obtaining a plurality of threat intelligence entities, each of which corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities, the method further includes: Determine the category of the threat intelligence entity, the category of the attribute information corresponding to the threat intelligence entity, and the category of the relationship information between the threat intelligence entity and other threat intelligence entities according to preset standards.

6. The method for constructing a threat intelligence knowledge graph according to claim 5, characterized in that: Obtain multiple threat intelligence entities, each of which corresponds to the attribute information of the threat intelligence entity and the relationship information with other threat intelligence entities, including: Obtain threat intelligence information; According to preset rules, the threat intelligence information is mapped into multiple threat intelligence entities according to the determined categories of threat intelligence entities, mapped into attribute information respectively corresponding to multiple threat intelligence entities according to the determined categories of attribute information, and mapped into relationship information of each threat intelligence entity respectively with other threat intelligence entities according to the determined categories of relationship information.

7. A threat intelligence knowledge graph construction device, characterized in that: The device comprises: An acquisition module is used to acquire multiple threat intelligence entities, where each threat intelligence entity corresponds to attribute information of the threat intelligence entity and relationship information with other threat intelligence entities; A mapping module is used to map each threat intelligence entity according to the attribute information corresponding to the threat intelligence entity and the relationship information with other threat intelligence entities into a feature vector corresponding to the current threat intelligence entity according to a preset algorithm; A first determination module is used to determine the similarity between any two threat intelligence entities according to the feature vector corresponding to each threat intelligence entity; A merging module, configured to merge two threat intelligence entities whose similarities meet a preset threshold value in a preset manner to obtain a target threat intelligence entity when the similarity meets a preset threshold value; A construction module is used to construct a threat intelligence knowledge graph based on the target threat intelligence entity; The construction of a threat intelligence knowledge graph based on the target threat intelligence entity includes: Classify the target threat intelligence entities according to preset classification rules to obtain target threat intelligence entities of multiple categories; Determine, based on a preset model, whether any target threat intelligence entity under any category has corresponding relationship information with target threat intelligence entities under other categories; In the case where corresponding relationship information exists, the relationship information is supplemented between the two target threat intelligence entities to obtain the supplemented target threat intelligence entity; Construct a threat intelligence knowledge graph based on the completed target threat intelligence entities.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; Wherein, the processor is configured to execute the threat intelligence knowledge graph construction method described in any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for constructing a threat intelligence knowledge graph as described in any one of claims 1 to 6 is implemented.

Images