Identification methods and devices, electronic devices, and storage media for specified technologies in threat intelligence

Abstract

The present application provides a method and device for identifying specified technologies in threat intelligence, an electronic device, and a storage medium, including: pre-processing network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence; after adding a word mask to the word sequence, inputting a trained cloze model to obtain the predicted words corresponding to the word mask output by the cloze model; inputting the word sequence into a trained technology classification model to obtain multiple prediction categories output by the technology classification model and the confidence corresponding to each prediction category, and selecting several prediction categories with high confidence as the target prediction categories corresponding to the paragraph; for each paragraph, judging whether there is any target prediction category corresponding to the paragraph, including the predicted words corresponding to the paragraph; and determining whether the paragraph includes the specified technology based on the judgment result corresponding to each paragraph. The present application can accurately identify content describing the specified technology from network threat intelligence.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for identifying specified technologies in threat intelligence, an electronic device, and a computer-readable storage medium. Background Art

[0002] Threat intelligence is defined as "evidence-based knowledge, including context, mechanisms, indicators, impacts, and recommendations for possible actions, related to an existing or emerging threat or asset compromise that can be used to inform decision-makers' responses to that threat or compromise." Threat intelligence in the cybersecurity field, or cyber threat intelligence, provides timely information, such as attack signatures, to help reduce uncertainty in identifying potential security vulnerabilities and attacks. Individuals or businesses can obtain cyber threat intelligence from channels such as social media (e.g., blogs), vendor announcements (e.g., Microsoft, Cisco), and hacker forums.

[0003] However, the format of cyber threat intelligence is not fixed. The technologies involved may have standard identifiers, but it is also possible to have only descriptive descriptions without standard identifiers. For example, for the "Sudo and Sudo Caching" technology, cyber threat intelligence may directly state the technology name as "T1548.003 Sudo and Sudo Caching" or use text to describe it as "Adversaries may perform sudo caching and / or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges."

[0004] For users of cyber threat intelligence (individuals or businesses), there may be certain technologies that require special attention in order to improve their ability to defend against cyber threats. Therefore, a solution is urgently needed to accurately identify specific technologies from cyber threat intelligence. Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide a method and device for identifying specified technologies in threat intelligence, an electronic device, and a computer-readable storage medium, which are used to accurately identify content related to the specified technology from network threat intelligence.

[0006] In one aspect, the present application provides a method for identifying specified technologies in threat intelligence, including:

[0007] Preprocessing the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence;

[0008] For each word sequence corresponding to each paragraph, add a word mask to the word sequence, input the trained cloze model, and obtain the predicted words corresponding to the word mask output by the cloze model;

[0009] For each paragraph, the word sequence is input into a trained technology classification model to obtain multiple prediction categories output by the technology classification model and the confidence level corresponding to each prediction category. Several prediction categories with higher confidence levels are selected as target prediction categories corresponding to the paragraph; each prediction category indicates a technology name belonging to a specified technology.

[0010] For each paragraph, determine whether there is any target prediction category corresponding to the paragraph, including the predicted words corresponding to the paragraph;

[0011] According to the judgment result corresponding to each paragraph, it is determined whether the paragraph includes the specified technology.

[0012] Through the above measures, after splitting the network threat intelligence into multiple paragraphs, the cloze model and technology classification model are used to identify the specified technology for each paragraph, so as to accurately identify the paragraphs containing content related to the specified technology.

[0013] In one embodiment, before preprocessing the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence, the method further includes:

[0014] Performing regular expression matching on the network threat intelligence using multiple technology names under the specified technology to determine whether any technology name can be matched;

[0015] If any technology name is matched, determining that the network threat intelligence includes the specified technology;

[0016] If no technical name is matched, continue with the steps for pre-processing network threat intelligence.

[0017] Through the above measures, when the network threat intelligence contains the technical name under the specified technology, the specified technology in the network threat intelligence can be quickly identified, thereby reducing the workload of the identification task.

[0018] In one embodiment, the preprocessing of the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence includes:

[0019] Divide the cyber threat intelligence into several sections;

[0020] Perform word segmentation on each paragraph and filter out stop words and invalid words from the word segmentation results;

[0021] For each paragraph, stem extraction is performed on the filtered word segmentation results to obtain the word sequence corresponding to the paragraph.

[0022] Through the above measures, network threat intelligence can be processed into word sequences corresponding to several paragraphs.

[0023] In one embodiment, the cloze model is trained in the following manner:

[0024] For a sample corpus in a sample data set, replacing at least one word in the sample corpus with a word mask to obtain a specified sample corpus;

[0025] Input the specified sample corpus into the pre-training model to obtain a sample prediction result corresponding to the word mask in the specified sample corpus;

[0026] According to the sample prediction results corresponding to the word mask in the specified sample corpus and the replaced words, the model parameters of the pre-trained model are adjusted to obtain a cloze model.

[0027] Through the above measures, a cloze model can be trained.

[0028] In one embodiment, the sample corpus includes technology names and technology descriptions;

[0029] The replacing at least one word in the sample corpus with a word mask comprises:

[0030] Select one word from the technical names contained in the sample corpus and replace it with the word mask; and / or,

[0031] Select a word related to the specified technology from the technical description contained in the sample corpus and replace it with the word mask; and / or,

[0032] At least one word in the sample corpus is randomly selected and replaced with a word mask.

[0033] Through the above measures, the sample corpus can be processed into the specified sample corpus.

[0034] In one embodiment, the technology classification model is trained in the following manner:

[0035] Input the technical descriptions included in the sample corpus in the sample data set into the classification model to obtain the sample prediction category output by the classification model;

[0036] According to the difference between the sample prediction category of the sample corpus and the technology name contained in the sample corpus, the model parameters of the classification model are adjusted to obtain a technology classification model.

[0037] Through the above measures, a technology classification model can be trained.

[0038] In one embodiment, determining whether each paragraph includes a specified technology based on a judgment result corresponding to the paragraph includes:

[0039] If the judgment result corresponding to any paragraph indicates that there is a target prediction category including the predicted word, it is determined that the paragraph includes the specified technology;

[0040] If the judgment result corresponding to any paragraph indicates that there is no target prediction category including the prediction word, it is determined that the paragraph does not include the specified technology.

[0041] Through the above measures, several paragraphs containing specified techniques can be identified from cyber threat intelligence.

[0042] On the other hand, the present application also includes a device for identifying a specified technology in threat intelligence, including:

[0043] A preprocessing module, configured to preprocess the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence;

[0044] A first prediction module is configured to, for each paragraph, add a word mask to the word sequence, input the word mask into a trained cloze model, and obtain a predicted word corresponding to the word mask output by the cloze model;

[0045] A second prediction module is configured to input a word sequence corresponding to each paragraph into a trained technology classification model, obtain multiple prediction categories output by the technology classification model and the confidence level corresponding to each prediction category, and select several prediction categories with higher confidence levels as target prediction categories corresponding to the paragraph; wherein each prediction category indicates a technology name belonging to a specified technology;

[0046] A judgment module, configured to judge, for each paragraph, whether there is any target prediction category corresponding to the paragraph, including the predicted words corresponding to the paragraph;

[0047] The determination module is used to determine whether each paragraph includes a specified technology according to the judgment result corresponding to the paragraph.

[0048] In addition, the present application also includes an electronic device, comprising:

[0049] processor;

[0050] a memory for storing processor-executable instructions;

[0051] The processor is configured to execute the identification method of the specified technology in the above-mentioned threat intelligence.

[0052] Furthermore, the present application also includes a computer-readable storage medium, which stores a computer program, and the computer program can be executed by a processor to complete the identification method of the specified technology in the above-mentioned threat intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments of the present application.

[0054] Figure 1 A schematic diagram of an application scenario of a method for identifying a specified technology in threat intelligence provided in an embodiment of the present application;

[0055] Figure 2 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application;

[0056] Figure 3 A flowchart of a method for identifying a specified technology in threat intelligence provided by an embodiment of the present application;

[0057] Figure 4 A flowchart of a method for initially identifying a specified technology in threat intelligence provided by an embodiment of the present application;

[0058] Figure 5 Provided for an embodiment of this application Figure 3 Detailed flow diagram of step 310;

[0059] Figure 6 A flowchart of a cloze model training method provided in one embodiment of the present application;

[0060] Figure 7 A flowchart of a method for training a technology classification model according to an embodiment of the present application is provided;

[0061] Figure 8 An overall schematic diagram of a method for identifying specified technologies in threat intelligence provided by an embodiment of the present application;

[0062] Figure 9 A flowchart of a method for identifying a specified technology in threat intelligence provided by another embodiment of the present application;

[0063] Figure 10 A block diagram of an apparatus for identifying specified technologies in threat intelligence provided by one embodiment of the present application. DETAILED DESCRIPTION

[0064] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0065] Similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0066] Figure 1 Schematic diagram of an application scenario of a method for identifying a specific technology in threat intelligence provided by an embodiment of this application. Figure 1 As shown, the application scenario includes a client 20 and a server 30; the client 20 can be a user terminal such as a host, mobile phone, tablet computer, etc., which is used to send an artificially constructed sample data set to the server 30; the server 30 can be a server, a server cluster or a cloud computing center, which can train a cloze model and a technical classification model based on the sample corpus in the sample data set, so as to use the cloze model and the technical classification model to identify content containing specified technical features from network threat intelligence.

[0067] like Figure 2 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12, Figure 2 In the example, a processor 11 is used. Processor 11 and memory 12 are connected via bus 10. Memory 12 stores instructions executable by processor 11. Processor 11 executes these instructions, enabling electronic device 1 to perform all or part of the method described in the following embodiments. In one embodiment, electronic device 1 may be the aforementioned server 30, configured to execute a method for identifying a specific technology in threat intelligence.

[0068] The memory 12 can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0069] The present application also provides a computer-readable storage medium, which stores a computer program. The computer program can be executed by the processor 11 to complete the identification method of the specified technology in the threat intelligence provided by the present application.

[0070] See also Figure 3 , which is a flowchart of a method for identifying a specified technology in threat intelligence provided by an embodiment of the present application, such as Figure 3 As shown, the method may include the following steps 310 to 350.

[0071] Step 310: Preprocess the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence.

[0072] The present application solution is used to identify content containing specified technologies from network threat intelligence. Here, the specified technology is the technology that users of network threat intelligence are more concerned about, and can be configured according to user needs. The specified technology can be one or more. Exemplarily, the specified technology can be a technology in the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) knowledge base, or the specified technology can be a technology in the CAPEC (Common Attack Pattern Enumeration and Classification) data set. The specified technology can include multiple sub-techniques.

[0073] After obtaining the network threat intelligence to be identified from the Internet or local storage space, the server can pre-process the network threat intelligence to split the network threat intelligence into multiple paragraphs and obtain the word sequence corresponding to each paragraph. The word sequence includes multiple words in the paragraph.

[0074] Step 320: For each word sequence corresponding to each paragraph, add a word mask to the word sequence, input the trained cloze model, and obtain the predicted words corresponding to the word mask output by the cloze model.

[0075] After obtaining the word sequences for each paragraph in the cyber threat intelligence, the server can add a word mask to the word sequence corresponding to each paragraph. The word mask is used to indicate the position of the predicted new word in the word sequence. For example, the word mask can be added at the very beginning of the word sequence, that is, the word sequence is attached to the word mask; or the word mask can be added at the very end of the word sequence, that is, the word mask is attached to the word sequence. The form of the word mask can be pre-configured. For example, the word mask can be [MASK].

[0076] After adding a word mask to the word sequence, the word sequence can be input into a cloze model. The cloze model can be trained by a natural language model and used to predict new words based on text context information. The natural language model can be, but is not limited to, BERT (Bidirectional Encoder Representations from Transformer), T5 (Text-To-Text Transfer Transformer), mT5 (AMassively Multilingual Pre-trained Text-to-Text Transformer) and other models. The server can use the cloze model to generate a predicted word at the position of the word mask based on other words in the word sequence. The predicted word is the word that is most likely to appear at the position of the word mask when there are other words in the word sequence.

[0077] For each paragraph, the cloze model can be used to output the predicted words corresponding to the word sequence of the paragraph.

[0078] Step 330: For each word sequence corresponding to a paragraph, the word sequence is input into a trained technology classification model to obtain multiple prediction categories output by the technology classification model and the confidence corresponding to each prediction category, and several prediction categories with higher confidence are selected as the target prediction categories corresponding to the paragraph; wherein each prediction category indicates a technology name belonging to a specified technology.

[0079] For each paragraph's corresponding word sequence, the server can input the word sequence into a technical classification model. This technical classification model is used to classify text and can be trained using a classification model. The classification model can include, but is not limited to, FastText, SVM (Support Vector Machine), GBDT (Gradient Boosting Decision Tree), and others.

[0080] The prediction categories that the technology classification model can output can be configured according to needs. For example, if the specified technology includes the names of n sub-techniques, then the technology classification model can be trained to classify the n sub-techniques.

[0081] The server processes the word sequence using a technical classification model, thereby outputting multiple prediction categories and the confidence level corresponding to each prediction category. The server can sort the confidence levels of the multiple prediction categories from highest to lowest, thereby selecting several prediction categories with the highest confidence levels as the target prediction categories corresponding to the paragraph. Here, the number of prediction categories selected by the server can be configured as needed. For example, the server can select the two prediction categories with the highest confidence levels as the target prediction categories.

[0082] For each paragraph, the server can generate and select several target prediction categories for the paragraph through a technology classification model, where each target prediction category indicates the technical name of a subdivided technology that the content of the paragraph may contain.

[0083] Step 340: For each paragraph, determine whether there is any target prediction category corresponding to the paragraph, including the predicted words corresponding to the paragraph.

[0084] For any paragraph, the server can check whether each target prediction category of the paragraph contains the predicted word corresponding to the paragraph, thereby determining whether there is at least one target prediction category containing the predicted word.

[0085] Step 350: Determine whether the paragraph includes the specified technology based on the judgment result corresponding to each paragraph.

[0086] The server can determine whether a paragraph contains content corresponding to a specific technology based on the judgment results for each paragraph. If a specific technology is found in any paragraph of the cyber threat intelligence, the server can extract the paragraph for subsequent use of the content related to the specific technology.

[0087] Through the above measures, after splitting the network threat intelligence into multiple paragraphs, the cloze model and technology classification model are used to identify the specified technology for each paragraph, so as to accurately identify the paragraphs containing content related to the specified technology.

[0088] In one embodiment, before identifying the specified technology in the network threat intelligence through the above steps 310 to 350, a preliminary identification of the network threat intelligence can be performed first. Figure 4 , which is a flowchart of a method for preliminary identification of a specified technology in threat intelligence provided by an embodiment of the present application, such as Figure 4 As shown, the method may include the following steps 410 to 430.

[0089] Step 410: Perform regular expression matching on the network threat intelligence using multiple technology names under the specified technology to determine whether any technology name can be matched.

[0090] After obtaining network threat intelligence, the server can use the technical names of all sub-techniques under the specified technology to perform regular expression matching on the network threat intelligence to check whether the network threat intelligence matches any technical name.

[0091] Step 420: If any technology name is matched, it is determined that the network threat intelligence includes the specified technology.

[0092] In one case, if any technology name is matched, it means that the network threat intelligence contains relevant content of the specified technology indicated by the technology name. In this case, it is not necessary to perform the identification process of steps 310 to 350 on the network threat intelligence.

[0093] Step 430: If no technical name is matched, continue to perform the step of pre-processing the network threat intelligence.

[0094] In another case, if any technology name under the specified technology cannot be matched, it means that the network threat intelligence does not directly contain the technology name. At this time, it is necessary to continue to perform the above-mentioned identification process of steps 310 to 350 on the network threat intelligence in order to identify the relevant content containing the specified technology from the case where the network threat intelligence contains technology descriptions.

[0095] Through the above preliminary identification process, when the network threat intelligence contains the technical name under the specified technology, the specified technology in the network threat intelligence can be quickly identified, thereby reducing the workload of the identification task.

[0096] In one embodiment, see Figure 5 , provided in one embodiment of the present application Figure 3 The detailed flow chart of step 310 is as follows: Figure 5As shown, the preprocessing process may include the following steps 311 to 313.

[0097] Step 311: Divide the network threat intelligence into several sections.

[0098] The server can divide the network threat intelligence into several paragraphs. The server can directly split each natural segment of the network threat intelligence to obtain multiple paragraphs. Alternatively, the server can split each natural segment of the network threat intelligence and merge adjacent natural segments (for example, every two adjacent natural segments are merged into one paragraph) to obtain multiple paragraphs. Alternatively, the server can select multiple consecutive sentences as a paragraph, thereby dividing multiple paragraphs. For example, 10 consecutive sentences are divided into one paragraph.

[0099] Step 312: Perform word segmentation on each paragraph, and filter out stop words and invalid words from the word segmentation results.

[0100] For each paragraph, the server can perform word segmentation on the paragraph, thereby obtaining multiple word segmentation results, each of which is a word. The server can use a stop word list and an invalid word list to filter out stop words and invalid words from the multiple word segmentation results, thereby obtaining a filtered word segmentation result for the paragraph.

[0101] Step 313: For each paragraph, perform stem extraction on the filtered word segmentation results to obtain a word sequence corresponding to the paragraph.

[0102] For any paragraph of the filtered segmentation results, the server can check whether there are words with extractable stems. If so, the word endings can be removed to extract the stems. For example, common endings in English text include "ing" and "s". For words without endings in the segmentation results, no processing is required. After extracting the stems of words with endings, the extracted stems and other words without endings can be combined to form the word sequence corresponding to the paragraph.

[0103] Through the above measures, network threat intelligence can be processed into word sequences corresponding to several paragraphs.

[0104] In one embodiment, see Figure 6 , is a flow chart of a training method for a cloze model provided in one embodiment of the present application, such as Figure 6 As shown, the method may include the following steps 610 to 630.

[0105] Step 610: For a sample corpus in the sample data set, replace at least one word in the sample corpus with a word mask to obtain a designated sample corpus.

[0106] The sample data set may include multiple sample corpora, each of which includes the technical name of a subdivided technology under a specified technology and a technical description of the subdivided technology.

[0107] For any sample corpus, the server can select at least one word from the sample corpus and replace the word's position in the sample corpus with a word mask to obtain a specified sample corpus. For example, if the sample corpus includes 10 words, the second word is selected and replaced with the word mask, resulting in a specified sample corpus consisting of 9 words plus 1 word mask.

[0108] In one embodiment, when replacing at least one word in the sample corpus with a word mask, the server may complete the replacement by one or more combinations of the following methods.

[0109] The first replacement method: The server can select a word from the technical names contained in the sample corpus and replace it with a word mask. Since technical names are often composed of multiple words, for a single sample corpus, by replacing different words in the technical name with the word mask, multiple specified sample corpora can be generated.

[0110] The second replacement method: the server can select a relevant word of the specified technology from the technical description contained in the sample corpus and replace it with a word mask. Here, the relevant word can be a word that is associated with the specified technology, and the relevant word can be pre-configured manually. Exemplary, the relevant words can be protocol and command. The server can search the technical description contained in the sample corpus based on the pre-configured relevant words, and replace any relevant word in the found technical description with the word mask. Since the technical description may include multiple related words, for a sample corpus, after selecting different words in the technical description and replacing them with the word mask, multiple specified sample corpora can be obtained.

[0111] The third replacement method: The server can randomly select at least one word in the sample corpus and replace it with the word mask. Here, each randomly selected word is replaced with a word mask.

[0112] Step 620: Input the specified sample corpus into the pre-training model to obtain sample prediction results corresponding to the word mask in the specified sample corpus.

[0113] The server can input a specified sample corpus into a pre-trained model. This pre-trained model can be trained using natural language models such as BERT, T5, and mT5. The server can use the pre-trained model to predict the most likely words at the position of the word mask in the specified sample corpus, obtaining a sample prediction result. The sample prediction result can include multiple sample predicted words, each of which is associated with a matching degree, ranging from 0 to 1.

[0114] Step 630: According to the sample prediction results corresponding to the word mask in the specified sample corpus and the replaced words, the model parameters of the pre-trained model are adjusted to obtain a cloze model.

[0115] For each sample prediction result corresponding to a word mask in a specified sample corpus, the server can search for the replaced word at the position of the word mask in the sample prediction result to obtain the matching degree of the replaced word in the sample prediction result. After finding the matching degree of the replaced word, the server can evaluate the difference between the matching degree of the replaced word and the target matching degree of the replaced word based on the loss function, thereby adjusting the model parameters of the pre-trained model. Here, the target matching degree is 1.

[0116] After adjusting the model parameters, the process may return to step 620 and re-input the designated sample corpus into the adjusted pre-trained model. After multiple rounds of iterative training, a trained cloze model may be obtained.

[0117] Through the above measures, a cloze model can be trained to output predicted words at the position of the word mask in the text.

[0118] In one embodiment, see Figure 7 , which is a flow chart of a training method for a technical classification model provided in one embodiment of the present application, such as Figure 7 As shown, the method may include the following steps 710 to 720.

[0119] Step 710: Input the technical description included in the sample corpus in the sample data set into the classification model to obtain the sample prediction category output by the classification model.

[0120] Here, the classification model can be one of the models such as FastText, SVM, GBDT, etc.

[0121] The server can input the technical descriptions in the sample corpus into the classification model to obtain the sample prediction category output by the classification model. For classification models that can directly process natural language, the technical descriptions can be directly input into the classification model; for classification models that cannot directly process natural language, the technical descriptions can be converted into a corresponding multidimensional vector through word embedding, and then the multidimensional vector can be input into the classification model.

[0122] Step 720: According to the difference between the sample prediction category of the sample corpus and the technology name contained in the sample corpus, the model parameters of the classification model are adjusted to obtain a technology classification model.

[0123] The server can use a loss function to evaluate the discrepancy between the predicted sample categories of the sample corpus and the technical descriptions of the sample corpus itself, thereby adjusting the model parameters of the classification model. After adjustment, the server can return to step 710 and re-input the technical descriptions in the sample corpus into the classification model to further adjust the model parameters of the classification model. After multiple rounds of iterative training, a trained technical classification model can be obtained.

[0124] Through the above measures, a technology classification model for technology classification based on corpus can be trained.

[0125] In one embodiment, before training a cloze model or a technology classification model, a sample dataset can be constructed. In response to user operations, the server can extract relevant content about a specific technology from cyber threat intelligence and construct a corpus based on the technology name and description. After filtering out stop words and invalid words from the corpus, stemming is performed on the filtered words, thereby constructing a sample corpus using the extracted stems and other words without endings. The server can construct a sample corpus based on multiple sample corpora.

[0126] See also Figure 8 , which is an overall schematic diagram of a method for identifying a specified technology in threat intelligence provided by an embodiment of the present application, such as Figure 8 As shown, first, a large amount of network threat intelligence can be obtained from the server, and then the content related to the specified technology can be extracted manually. Figure 8 The designated technology is ATT&CK. A sample corpus is constructed based on the extracted content. A sample database is constructed from multiple sample corpora, which are then used to train a cloze model and a technology classification model. After training these two models, the cloze model and technology classification model are subsequently used to extract content related to ATT&CK from the threat intelligence being tested.

[0127] In one embodiment, when the server determines whether a paragraph includes a specified technology based on the judgment result corresponding to each paragraph, in one case, if the judgment result corresponding to any paragraph indicates the presence of a target prediction category with a predicted word, the paragraph is determined to include the specified technology. When the target prediction category includes a predicted word, the paragraph can be determined to include content related to the subdivision technology indicated by the target prediction category. If there are at least two target prediction categories, and at least two target prediction categories include predicted words, the paragraph is determined to include content related to the subdivision technology indicated by the target prediction category with the highest confidence.

[0128] In another case, if the judgment result corresponding to any paragraph indicates that there is no target prediction category including the predicted word, it is determined that the paragraph does not include the specified technology.

[0129] See also Figure 9 , which is a flowchart of a method for identifying a specified technology in threat intelligence provided by another embodiment of the present application, such as Figure 9 As shown, multiple paragraphs are divided from the network threat intelligence. For paragraph 1, the predicted word W1 is generated by the cloze model, and the target prediction categories R1 and R2 are generated by the technical classification model. The confidence corresponding to R1 is S1, and the confidence corresponding to R2 is S2.

[0130] The server can determine whether W1 exists in R1 or R2. Since R1 and R2 are technology names indicating the target prediction category, if paragraph 1 contains a specific technology, the cloze model can generate the terms in the technology name based on paragraph 1. The target prediction category obtained by the technology classification model for paragraph 1 will inevitably include the terms predicted by the cloze model.

[0131] In one case, neither target prediction category R1 nor R2 contains the predicted word W1, indicating that paragraph 1 does not describe the relevant content of ATT&CK technology.

[0132] In one case, the target prediction category R1 includes the predicted word W1, and the target prediction category R2 does not include the predicted word W1. This indicates that paragraph 1 describes the segmentation technology R1 under ATT&CK.

[0133] In one case, the target prediction category R2 includes the predicted word W1, and the target prediction category R1 does not include the predicted word W1. This indicates that paragraph 1 describes the segmentation technology R2 under ATT&CK.

[0134] In one case, both target prediction categories R1 and R2 contain the predicted word W1. The target prediction category with higher confidence is the segmentation technology under ATT&CK described in paragraph 1.

[0135] Through the above measures, several paragraphs containing ATT&CK-related content can be identified from cyber threat intelligence.

[0136] Figure 10 This is a block diagram of a device for identifying a specified technology in threat intelligence according to an embodiment of the present invention. Figure 10 As shown, the device may include:

[0137] A preprocessing module 1010 is configured to preprocess the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence;

[0138] A first prediction module 1020 is configured to, for each paragraph, add a word mask to the word sequence, input the word mask into a trained cloze model, and obtain a predicted word corresponding to the word mask output by the cloze model;

[0139] The second prediction module 1030 is configured to input the word sequence corresponding to each paragraph into a trained technology classification model, obtain multiple prediction categories output by the technology classification model and the confidence level corresponding to each prediction category, and select several prediction categories with higher confidence levels as target prediction categories corresponding to the paragraph; wherein each prediction category indicates a technology name belonging to a specified technology;

[0140] A determination module 1040 is configured to determine, for each paragraph, whether there is any target prediction category corresponding to the paragraph, including a predicted word corresponding to the paragraph;

[0141] The determination module 1050 is configured to determine whether each paragraph includes a specified technology according to a judgment result corresponding to the paragraph.

[0142] The implementation process of the functions and effects of each module in the above-mentioned device is detailed in the implementation process of the corresponding steps in the identification method of the specified technology in the above-mentioned threat intelligence, and will not be repeated here.

[0143] In several embodiments provided in this application, the disclosed devices and methods may also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the devices, methods, and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a portion of code, and the module, program segment, or a portion of code contains one or more executable instructions for implementing the specified logical functions. In some alternative implementations, the functions marked in the boxes may also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes may actually be executed substantially in parallel, or they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, may be implemented using a dedicated hardware-based system that performs the specified functions or actions, or may be implemented using a combination of dedicated hardware and computer instructions.

[0144] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0145] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Claims

1. A method for identifying a specified technology in threat intelligence, characterized in that: include: Preprocessing the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence; For each word sequence corresponding to each paragraph, add a word mask to the word sequence, input the trained cloze model, and obtain the predicted words corresponding to the word mask output by the cloze model; For each paragraph, the word sequence is input into a trained technology classification model to obtain multiple prediction categories output by the technology classification model and the confidence level corresponding to each prediction category. Several prediction categories with higher confidence levels are selected as target prediction categories corresponding to the paragraph; each prediction category indicates a technology name belonging to a specified technology. For each paragraph, determine whether there is any target prediction category corresponding to the paragraph, including the predicted words corresponding to the paragraph; According to the judgment result corresponding to each paragraph, it is determined whether the paragraph includes the specified technology.

2. The method according to claim 1, characterized in that Before preprocessing the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence, the method further includes: Performing regular expression matching on the network threat intelligence using multiple technology names under the specified technology to determine whether any technology name can be matched; If any technology name is matched, determining that the network threat intelligence includes the specified technology; If no technical name is matched, continue with the steps for pre-processing network threat intelligence.

3. The method according to claim 1, characterized in that The preprocessing of the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence includes: Divide the cyber threat intelligence into several sections; Perform word segmentation on each paragraph and filter out stop words and invalid words from the word segmentation results; For each paragraph, stem extraction is performed on the filtered word segmentation results to obtain the word sequence corresponding to the paragraph.

4. The method according to claim 1, wherein The cloze model is trained in the following way: For a sample corpus in a sample data set, replacing at least one word in the sample corpus with a word mask to obtain a specified sample corpus; Input the specified sample corpus into the pre-training model to obtain a sample prediction result corresponding to the word mask in the specified sample corpus; According to the sample prediction results corresponding to the word mask in the specified sample corpus and the replaced words, the model parameters of the pre-trained model are adjusted to obtain a cloze model.

5. The method according to claim 4, characterized in that The sample corpus includes technology names and technical descriptions; The replacing at least one word in the sample corpus with a word mask comprises: Select one word from the technical names contained in the sample corpus and replace it with the word mask; and / or, Select a word related to the specified technology from the technical description contained in the sample corpus and replace it with the word mask; and / or, At least one word in the sample corpus is randomly selected and replaced with a word mask.

6. The method according to claim 1, characterized in that The technical classification model is trained in the following way: Input the technical descriptions included in the sample corpus in the sample data set into the classification model to obtain the sample prediction category output by the classification model; According to the difference between the sample prediction category of the sample corpus and the technology name contained in the sample corpus, the model parameters of the classification model are adjusted to obtain a technology classification model.

7. The method according to claim 1, characterized in that The step of determining whether each paragraph includes a specified technology based on a judgment result corresponding to each paragraph includes: If the judgment result corresponding to any paragraph indicates that there is a target prediction category including the predicted word, it is determined that the paragraph includes the specified technology; If the judgment result corresponding to any paragraph indicates that there is no target prediction category including the prediction word, it is determined that the paragraph does not include the specified technology.

8. A device for identifying a specific technology in threat intelligence, characterized in that: include: A preprocessing module, configured to preprocess the network threat intelligence to obtain a word sequence corresponding to each paragraph in the network threat intelligence; A first prediction module is configured to, for each paragraph, add a word mask to the word sequence, input the word mask into a trained cloze model, and obtain a predicted word corresponding to the word mask output by the cloze model; A second prediction module is configured to input a word sequence corresponding to each paragraph into a trained technology classification model, obtain multiple prediction categories output by the technology classification model and the confidence level corresponding to each prediction category, and select several prediction categories with higher confidence levels as target prediction categories corresponding to the paragraph; wherein each prediction category indicates a technology name belonging to a specified technology; A judgment module, configured to judge, for each paragraph, whether there is any target prediction category corresponding to the paragraph, including the predicted words corresponding to the paragraph; The determination module is used to determine whether each paragraph includes a specified technology according to the judgment result corresponding to the paragraph.

9. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method for identifying a specified technology in threat intelligence according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The storage medium stores a computer program, which can be executed by a processor to complete the method for identifying a specified technology in threat intelligence according to any one of claims 1 to 7.

Images