A method for calculating intelligence correlation degree applied to network security threat intelligence

Abstract

The application discloses a kind of intelligence correlation degree calculation methods applied to network security threat intelligence, including threat intelligence graph construction, based on STIX format, structured semi-structured data is extracted, article graph extraction, entity normalization processing, word level comparison, entity correlation degree calculation and comprehensive scoring module, the correlation degree calculation is comprehensively scored before, and the correlation degree of the record of two intelligence articles in database is entered.The present application extracts the implicit association between articles, extracts intelligence core content through knowledge extraction, calculates the correlation degree of two intelligence by threat intelligence knowledge graph reasoning core content potential association, includes different name entity normalization processing, word level matching, entity correlation degree calculation, comprehensive scoring module, through three tuple direct matching score, graph identifies different name same entity score and malware, vulnerability correlation degree score three dimensions are calculated to intelligence correlation degree.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method for calculating intelligence correlation applied to network security threat intelligence. Background Technology

[0002] Currently, cybersecurity has become a pressing issue that governments at all levels, administrative agencies, public institutions, enterprises, and non-profit organizations must address. Faced with increasingly numerous cyber threats, targeted protection of organizational software, hardware, and systems is a necessary measure for all organizations. Before protecting organizational digital assets, organizations first need to understand what needs to be protected, highlighting the importance of cybersecurity threat intelligence. However, given the vast amount of cybersecurity threat intelligence available, obtaining a comprehensive picture of cybersecurity threat events is crucial. Intelligence from a single source only describes an event from one perspective and is insufficient to present a complete picture. Therefore, calculating the correlation between intelligence sources to integrate related information has become an indispensable part of cybersecurity event analysis.

[0003] There are two main methods for integrating related intelligence. The first is manual integration. Cybersecurity threat intelligence involves a wide range of content, a massive amount of information, and high timeliness requirements, which cannot be met by manual review alone. The second method is based on machine learning, including content recommendation and keyword-based approaches. This method mostly relies on direct textual comparison to determine the correlation of related content. However, these methods struggle to address the unique correlations in cybersecurity threat intelligence. For example, a threat organization might be called Sofacy, but it also goes by other names such as APT 28, Fancy Bear, and so on. Different intelligence articles may use different names, and simply using word or text correlation methods is insufficient to handle correlations between entities with completely different fields but belonging to the same entity. Furthermore, traditional methods struggle to handle correlations between entities in articles that are bridged by a third entity. For instance, two intelligence articles might mention vulnerabilities CVE-2018-0001 and CVE-2020-1234. While the two vulnerabilities appear unrelated on the surface, threat intelligence knowledge graphs indicate that they exist in the same software. Traditional methods cannot identify this implicit correlation. Summary of the Invention

[0004] To address the problem that traditional methods cannot identify implicit connections in current mainstream methods of intelligence integration, this invention provides a method for calculating the correlation degree of intelligence applied to cybersecurity threat intelligence. It extracts implicit connections between articles, extracts core intelligence content through knowledge extraction, and calculates the correlation degree between two intelligence reports by reasoning about the potential connections between the core content of the threat intelligence knowledge graph.

[0005] The solution adopted by this invention to solve its technical problem is: an intelligence correlation calculation method applied to network security threat intelligence, including the following steps.

[0006] Step 1: Threat Intelligence Map Construction

[0007] Based on the STIX format, it extracts structured and semi-structured data, including but not limited to CVE, CPE, ATT&CK and other datasets.

[0008] The second step is article graph extraction:

[0009] Named entity recognition is performed based on BERT-BiLSTM-CRF. After obtaining the entities, the relationships are extracted using the R-BERT model through a pipeline approach.

[0010] The third step is entity normalization:

[0011] In the threat intelligence knowledge graph, entity types with different names for the same entity include malicious organizations and malware. First, malicious organization and malware entities are extracted from the article intelligence triples. Second, the corresponding entity types and other entity names in the threat intelligence graph are traversed. Finally, the entity is located, and the corresponding entity in the article intelligence triples is converted into a standard entity.

[0012] Based on the alias data in the threat intelligence graph, all aliases are converted into {alias: standard entity}, all malicious organization aliases and malicious organization entities extracted from the article are converted into vectors, and the cosine similarity between each alias and entity in the two sets of data is calculated. After the cosine similarity calculation is completed, the malicious organization alias with the highest cosine similarity to the malicious organization entity is found. If the cosine similarity is greater than 0.9, the malicious organization entity in the article is converted into a standard entity according to the K_V relationship of the above data.

[0013] Malware is normalized through the same processing flow, converting extracted malware entities into standard malware entities.

[0014] By normalizing the content extracted from the article using cosine similarity and threat intelligence knowledge graph, potential relationships between entities can be obtained.

[0015] Step 4, word-level comparison:

[0016] After completing the keyword normalization process, word-level comparison is performed.

[0017] First, the keywords of the two articles are matched one by one. For each set of keywords matched, the scoring module adds one point and removes the set of keywords from the keyword group.

[0018] Step 5: Calculate entity association degree:

[0019] After removing entities that can be perfectly matched in the previous step, the remaining entities are subjected to correlation calculations to identify potential relationships between intelligence.

[0020] Step 6: This also includes a comprehensive scoring module:

[0021] Total score = Normalized entity match pairs * 1 + Malware correlation * 1 + Vulnerability-related infrastructure match pairs * 0.1 + Infrastructure vendor match pairs * 0.1 + Malicious organization correlation * 1. This module performs a comprehensive score on the aforementioned correlation calculations and records the correlation between the two intelligence articles in the database.

[0022] In the process of text graph extraction, named entity recognition based on BERT-BiLSTM-CRF is performed by using a BERT pre-trained model to obtain the corresponding word vectors, then inputting the word vectors into the BiLSTM layer to further extract the contextual relationships of the text, and finally obtaining the classification results through the CRF layer.

[0023] The input is a sequence of characters, and the output is the predicted label for each word. The entity is obtained by classification and extraction.

[0024] After acquiring entities, relations are extracted using the R-BERT model via a pipeline approach, which applies the BERT model to relation classification. First, special markers are inserted before and after the target entity's position. Then, the text is input into BERT for fine-tuning to identify the positions of the two target entities and pass the information to the BERT model. Next, the positions of the two target entities are found in the word vectors output by the BERT model. Using word vectors and sentence encoding as input to a multi-layer neural network for classification, this method captures the semantic information of the sentence and the two target entities, making it better suited for relation classification tasks.

[0025] During the entity correlation calculation process, for malware, this module discovers the potential correlation between malware entities by calculating the commonality of the attack methods implemented by malware. After normalization, malware entities in the article can be directly associated with malware entities in the threat intelligence knowledge graph. Then, the correlation of malware is calculated by the attack methods that malware can implement in the threat intelligence knowledge graph.

[0026] During the entity correlation calculation process, for vulnerabilities, this module discovers the potential correlation between vulnerability entities by judging whether the vulnerability exists in the same infrastructure. The relationship between the vulnerability and hardware, software, and operating system can be extracted from the threat intelligence knowledge graph. The hardware, software, and operating system related to the vulnerability in the two intelligence articles are extracted from the threat intelligence knowledge graph and matched. For each matching pair of the same hardware, software, and operating system, the scoring module adds 0.1 points.

[0027] During the entity correlation calculation process, for the infrastructure part, this module discovers the potential correlation between infrastructures by judging whether the infrastructure entities are products of the same vendor. The supplier relationship of the infrastructure can be extracted from the threat intelligence knowledge graph. The potential relationship of the infrastructure is judged by the same vendor. Each pair of matching vendors adds 0.1 points to the scoring module.

[0028] During the entity correlation calculation process, for malicious organizations, this module explores the potential correlation between malicious organizations by using their common attack methods and malware. The relationship between malicious organizations and their attack methods and malware can be extracted from the threat intelligence knowledge graph. By matching the same attack methods and malware between two malicious organizations, the correlation between the malicious organizations is calculated.

[0029] The beneficial effects of this invention are:

[0030] The intelligence correlation calculation method provided by this invention extracts the implicit correlation between articles, extracts the core content of intelligence through knowledge extraction, and calculates the correlation between two intelligences by reasoning the potential correlation of the core content of threat intelligence knowledge graph.

[0031] This invention includes a normalization process for entities with different names, word-level matching, entity correlation calculation, and a comprehensive scoring module. It calculates the degree of intelligence correlation based on three dimensions: direct triple matching scoring, graph recognition scoring for entities with different names but the same entity, and correlation scoring for malware and vulnerabilities. Attached Figure Description

[0032] Figure 1 This is a flowchart of the method of the present invention.

[0033] Figure 2 This is a block diagram of named entity recognition based on BERT-BiLSTM-CRF.

[0034] Figure 3 This is a flowchart of the entity normalization process.

[0035] Figure 4 This is a word-level comparison flowchart. Detailed Implementation

[0036] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0037] Example 1: The terminology is explained below.

[0038] STIX: STIX (Structured Threat Information eXpression) is a standardized language developed collaboratively by MITRE for representing structured information about cyber threats. It is easily shared, stored, and used in a consistent manner, thus promoting automation and... Artificial assistance Analysis. This invention extracts a portion of the STIX ontology and relationships (attackers, organizations, malware, attack methods, vulnerabilities, infrastructure) as the ontology and relationships of a knowledge graph.

[0039] Malicious organization: an individual, group, or organization that is believed to be operating maliciously.

[0040] Organization: identity, individual, organization or group, and the category of individual, organization or group.

[0041] Malware: A type of TTP (Tactics of Attack), also known as malicious code and malware, used to compromise the confidentiality, integrity, or availability of a victim's data or system.

[0042] Attack Method: A type of TTP (Tactics to Attack) used to describe the methods by which a threat actor attempts to attack a target.

[0043] Vulnerability: A bug in the software that can be exploited by hackers to gain access to the system or network.

[0044] Infrastructure: hardware, software, operating system.

[0045] Entity: An entity is an abstraction of an objective individual. A person, a movie, or a sentence can all be regarded as an entity.

[0046] Example: Sofacy,

[0047] Type: A type is an abstraction of a collection of entities that have the same characteristics or attributes.

[0048] Example: The entity Sofacy is of type "malicious organization".

[0049] Relationship: A relationship is an abstraction of the relationship between entities.

[0050] Example: Sofacy - Attack Target [Relationship] - Windows,

[0051] Attributes: Similar to entities, but do not constitute entities; they are merely entity elements or supplements.

[0052] Example: Sofacy (malicious organization) [Entity] - Alias ​​- APT28 [Attributes].

[0053] Triples: Triples are the basic units of knowledge representation in knowledge graphs, abbreviated as SPO. Triples are used to represent the relationships between entities.

[0054] Example: Sofacy (malicious organization) [entity] - attack target [relationship] - Windows (infrastructure) [entity].

[0055] Threat Intelligence Knowledge Graph: A threat intelligence knowledge graph based on the STIX format, storing known entities and relationships, functioning as a think tank.

[0056] Standard Entity: In the threat intelligence knowledge graph, the same entity may have different names. The mainstream name is used as the standard entity.

[0057] Article Intelligence Graph: A graph extracted from an article to extract the core content needed by analysts.

[0058] I. Threat Intelligence Map Construction

[0059] Based on the STIX format, it extracts structured and semi-structured data, including but not limited to CVE, CPE, ATT&CK and other datasets.

[0060] II. Article Graph Extraction

[0061] Named entity recognition based on BERT-BiLSTM-CRF, such as Figure 2 As shown.

[0062] Principle: The corresponding word vectors are obtained by using the BERT pre-trained model. Then, the word vectors are input into the BiLSTM layer to further extract the contextual relationship of the text. Finally, the classification result is obtained through the CRF layer.

[0063] Input: Word sequence;

[0064] Output: The predicted label for each word; the entity is obtained by classification and extraction.

[0065] After obtaining the entities, relations are extracted using the R-bert model via a pipeline approach.

[0066] This paper applies the BERT model to relation classification. First, special tokens are inserted before and after the positions of the target entities. Then, the text is input into BERT for fine-tuning to identify the positions of the two target entities and pass this information to the BERT model. The positions of the two target entities are then found in the word vectors output by the BERT model. Their word vectors and sentence encoding (embeddings of a special token set in BERT) are used as input to a multi-layer neural network for classification. In this way, the semantic information of the sentence and the two target entities can be captured, making it better suited for relation classification tasks.

[0067] III. Entity Normalization Processing

[0068] like Figure 3 As shown, in the threat intelligence knowledge graph, entity types with different names for the same entity include malicious organizations and malware. First, malicious organization and malware entities are extracted from the article intelligence triples. Second, the corresponding entity types and other entity names in the threat intelligence graph are traversed. Finally, the entities are located, and the corresponding entities in the article intelligence triples are converted into standard entities.

[0069] Take the following data as an example:

[0070] Entity 1: SIG40 (malicious organization).

[0071] Entity 2: APT-28 (malicious organization).

[0072] Entity 3: Yttrium (malicious organization).

[0073] The three entity fields are completely different, and neither direct matching nor word cosine similarity calculation can identify them.

[0074] Based on alias data in the threat intelligence graph:

[0075] {"Sofacy":{"pred":"aliases","obj":['ATK 5','Fancy Bear','SNAKEMACKEREL','Group 74','TG-4127','STRONTIUM','TAG-0700Grizzly Steppe','APT28','Swallowtail','Tsar Team','Iron Twilight','T-APT-12','Sednit','SIG40','Pawn Storm','Threat Group-4127','Sofacy','Snakemackerel','Strontium','APT28']},

[0076] "YTTRIUM":{"pred":"aliases","obj":['YTTRIUM','StellarParticle','CozyDuke','The Dukes','Yttrium','APT29','ATK 7','Iron Hemlock','NobleBaron','NOBELIUM','Group 100','CloudLook','Grizzly Steppe','APT 29','Minidionis','Cozy Bear','UNC2452','Dark Halo']}}.

[0077] Convert all aliases to {alias: standard entity}.

[0078] {'ATK 5':'Sofacy','Fancy Bear':'Sofacy','SNAKEMACKEREL':'Sofacy','Group 74':'Sofacy','TG-4127':'Sofacy','STRONTIUM':'Sofacy','TAG-0700GrizzlySteppe':'Sofacy','APT 28':'Sofacy','Swallowtail':'Sofacy','Tsar Team':'Sofacy','Iron Twilight':'Sofacy','T-APT-12':'Sofacy','Sednit':'Sofacy','SIG40':'Sofacy','Pawn Storm':'Sofacy','Threat Group-4127':'Sofacy','Sofacy':'Sofacy','Snakemackerel':'Sofacy','Strontium':'Sofacy','APT28':'Sofacy','YTTRIUM':'YTTR IUM','StellarParticle':'YTTRIUM','CozyDuke':'YTTRIUM','TheDukes':'YTTRIUM','Yttrium':'YTTRIUM','APT29':'YTTRIUM','ATK 7':'YTTRIUM','Iron Hemlock':'YTTRIUM','NobleBaron':'YTTRIUM','NOBELIUM':'YTTRIUM','Group100':'YTTRIUM','CloudLook':'YTTRIUM','Grizzly Steppe':'YTTRIUM','APT 29':'YTTRIUM','Minidionis':'YTTRIUM','Cozy Bear':'YTTRIUM','UNC2452':'YTTRIUM','Dark Halo':'YTTRIUM'}.

[0079] All malicious organization aliases and malicious organization entities extracted from the articles are converted into vectors, and the cosine similarity between each alias and entity in the two sets of data is calculated. After completing the cosine similarity calculation, the malicious organization alias with the highest cosine similarity to the malicious organization entity is found. If the cosine similarity is greater than 0.9, the malicious organization entity in the article is converted into a standard entity according to the KV relationship of the above data.

[0080] example:

[0081] Entity 1 (SIG40) has the highest cosine similarity to the malicious organization alias "SIG40", with a cosine similarity of 1. Therefore, Entity 1 is converted to Sofacy.

[0082] Entity 2 (APT-28) has the highest cosine similarity to the malicious organization alias "APT 28", with a cosine similarity of 0.9506. Entity 2 is converted to Sofacy.

[0083] Entity 3 (Yttrium) has the highest cosine similarity to the malicious organization alias "YTTRIUM", with a cosine similarity of 1. Therefore, entity 3 is converted to YTTRIUM.

[0084] Malware is normalized through the same processing flow, converting extracted malware entities into standard malware entities.

[0085] Cosine similarity and threat intelligence knowledge graphs can be used to normalize the content extracted from articles, thereby obtaining potential relationships between entities.

[0086] IV. Word-level comparison

[0087] like Figure 4 As shown, after completing the keyword normalization process, word-level comparison is performed.

[0088] First, the keywords of the two articles are matched one by one. For each set of keywords matched, the scoring module adds 1 point and removes the set of keywords from the keyword group.

[0089] V. Entity Relationship Calculation

[0090] After removing entities that can be perfectly matched in the previous step, the remaining entities are subjected to correlation calculations to identify potential relationships between intelligence.

[0091] Malware: This module uncovers potential connections between malware entities by calculating the commonalities in the attack methods that malware can perform.

[0092] After normalization, the malware entities in the article can be directly associated with the malware entities in the threat intelligence knowledge graph. Then, the association degree (0-1) of the malware is calculated by the attack methods that the malware can achieve in the threat intelligence knowledge graph. The calculation of the malware association degree is not within the scope of this patent, so it will not be elaborated in detail.

[0093] Vulnerability: This module discovers the potential correlation between vulnerable entities by determining whether the vulnerability exists in the same infrastructure.

[0094] The relationship between vulnerabilities and hardware, software, and operating systems can be extracted from the threat intelligence knowledge graph. The hardware, software, and operating systems related to vulnerabilities in two intelligence articles are extracted from the threat intelligence knowledge graph and matched. For each matching pair of the same hardware, software, and operating system, the scoring module increases by 0.1 points.

[0095] Infrastructure: This module discovers potential relationships between infrastructures by determining whether infrastructure entities are products of the same vendor.

[0096] Supplier relationships associated with infrastructure can be extracted from the threat intelligence knowledge graph. Potential relationships between infrastructures can be determined by identifying the same suppliers. Each pair of matching vendors adds 0.1 points to the scoring module.

[0097] Malicious Organizations: This module uses common attack methods and malware of malicious organizations to uncover potential connections between them.

[0098] The relationship between malicious organizations, attack methods, and malware can be extracted from the threat intelligence knowledge graph. By matching two malicious organizations with the same attack methods and malware, the correlation degree of malicious organizations (0-1) can be calculated. The calculation of the correlation degree of malicious organizations is outside the scope of this patent, so it will not be described in detail.

[0099] VI. Comprehensive Scoring Module

[0100] Total Score = Normalized Entity Matching Count * 1 + Malware Association Count * 1 + Vulnerability Association Infrastructure Matching Count * 0.1 + Infrastructure Vendor Matching Count * 0.1 + Malicious Organization Association Count * 1.

[0101] This module performs a comprehensive score on the aforementioned correlation calculation and records the correlation between the two intelligence articles in the database.

[0102] Example 2: A method for calculating intelligence relevance applied to cybersecurity threat intelligence, such as... Figure 1 The steps shown are as follows.

[0103] The first step is to construct a threat intelligence map: based on the STIX format, extract structured and semi-structured data, including but not limited to CVE, CPE, ATT&CK datasets.

[0104] The second step is article graph extraction: Named entity recognition is performed based on BERT-BiLSTM-CRF. After obtaining the entities, the relationship is extracted using the R-BERT model through a pipeline approach.

[0105] The third step is entity normalization: In the threat intelligence knowledge graph, entity types with different names for the same entity include malicious organizations and malware. First, extract the malicious organization and malware entities from the article intelligence triples. Second, traverse the corresponding entity type and other entity names in the threat intelligence graph. Finally, locate the entity and convert the corresponding entity in the article intelligence triples into a standard entity.

[0106] Based on the alias data in the threat intelligence graph, all aliases are converted into {alias: standard entity}, all malicious organization aliases and malicious organization entities extracted from the article are converted into vectors, and the cosine similarity between each alias and entity in the two sets of data is calculated. After the cosine similarity calculation is completed, the malicious organization alias with the highest cosine similarity to the malicious organization entity is found. If the cosine similarity is greater than 0.9, the malicious organization entity in the article is converted into a standard entity according to the K_V relationship of the above data.

[0107] Malware is normalized through the same processing flow, converting extracted malware entities into standard malware entities.

[0108] By normalizing the content extracted from the article using cosine similarity and threat intelligence knowledge graph, potential relationships between entities can be obtained.

[0109] The fourth step is word-level comparison: After completing the keyword normalization process, word-level comparison is performed. First, the keywords of the two articles are matched one by one. For each set of keywords that is matched, the scoring module adds one point and removes that set of keywords from the keyword group.

[0110] Step 5: Calculate entity association degree:

[0111] After removing entities that can be perfectly matched in the previous step, the remaining entities are subjected to correlation calculations to identify potential relationships between intelligence.

[0112] Step 6: This also includes a comprehensive scoring module: Total Score = Normalized Entity Matching Pairs * 1 + Malware Relevance * 1 + Vulnerability-Related Infrastructure Matching Pairs * 0.1 + Infrastructure Vendor Matching Pairs * 0.1 + Malicious Organization Relevance * 1. This module performs a comprehensive scoring on the aforementioned relevance calculations and records the relevance between the two intelligence articles in the database.

[0113] In the text graph extraction process, named entity recognition based on BERT-BiLSTM-CRF involves using a BERT pre-trained model to obtain corresponding word vectors, then inputting these word vectors into a BiLSTM layer to further extract the contextual relationships of the text, and finally obtaining the classification result through a CRF layer. The input is a sequence of characters, and the output is the predicted label for each word; classification and extraction yield the entity.

[0114] The process involves extracting relationships using the R-BERT model via a pipeline after entity acquisition, applying the BERT model to relationship classification. First, special markers are inserted before and after the target entity's location. Then, the text is input into BERT for fine-tuning to identify the locations of the two target entities and transmit this information to the BERT model. The locations of the two target entities are then found in the word vectors output by the BERT model. Using word vectors and sentence encoding as input to a multi-layer neural network for classification captures the semantic information of the sentence and the two target entities, making it better suited for relationship classification tasks.

[0115] During the entity correlation calculation process, for malware, this module discovers potential correlations between malware entities by calculating the commonalities in the attack methods implemented by malware. After normalization, malware entities in the article can be directly associated with malware entities in the threat intelligence knowledge graph. Then, the correlation is calculated based on the attack methods that malware can implement in the threat intelligence knowledge graph. For vulnerabilities, this module discovers potential correlations between vulnerability entities by determining whether vulnerabilities exist in the same infrastructure. The relationship between vulnerabilities and hardware, software, and operating systems can be extracted from the threat intelligence knowledge graph. Hardware, software, and operating systems related to vulnerabilities in two intelligence articles are extracted from the threat intelligence knowledge graph and matched. For each matching pair of identical hardware, software, and operating systems, the scoring module adds 0.1 points. For the infrastructure part, this module discovers potential correlations between infrastructure by determining whether infrastructure entities are products of the same vendor. The vendor relationships associated with infrastructure can be extracted from the threat intelligence knowledge graph. Potential relationships between infrastructures are determined by using identical vendors. For each matching pair of vendors, the scoring module adds 0.1 points. For malicious organizations, this module explores the potential correlation between them by using their common attack methods and malware. It can extract the relationship between malicious organizations and their attack methods and malware from the threat intelligence knowledge graph, and calculate the correlation between two malicious organizations by matching the same attack methods and malware.

[0116] It should be understood that the specific embodiments described above are merely illustrative or explanatory of the principles of the present invention and do not constitute a limitation thereof. Therefore, any modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and scope of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for calculating intelligence correlation applied to cybersecurity threat intelligence, characterized in that, Includes the following steps: Step 1: Threat Intelligence Map Construction Based on the STIX format, structured and semi-structured data are extracted, including CVE, CPE, and ATT&CK datasets. The second step is article graph extraction: Named entity recognition is performed based on BERT-BiLSTM-CRF. After obtaining the entities, the relationship is extracted using the R-BERT model through a pipeline approach. The third step is entity normalization: In the threat intelligence knowledge graph, entity types with different names for the same entity include malicious organizations and malware. First, extract the malicious organization and malware entities from the article intelligence triples. Second, traverse the corresponding entity type and other entity names in the threat intelligence graph. Finally, locate the entity and convert the corresponding entity in the article intelligence triples into a standard entity. Based on the alias data in the threat intelligence graph, all aliases are converted into {alias: standard entity}, all malicious organization aliases and malicious organization entities extracted from the article are converted into vectors, and the cosine similarity between each alias and entity in the two sets of data is calculated; after completing the cosine similarity calculation, the malicious organization alias with the highest cosine similarity to the malicious organization entity is found. If the cosine similarity is greater than 0.9, the malicious organization entity in the article is converted into a standard entity according to the K_V relationship of {alias: standard entity} mentioned above. Malware is normalized through the same processing flow, converting the extracted malware entities into standard malware entities; The content extracted from the article is normalized using cosine similarity and threat intelligence knowledge graphs to obtain potential relationships between entities. Step 4, word-level comparison: After completing keyword normalization, word-level comparison is performed. First, the keywords of the two articles are matched one by one. For each set of keywords matched, one point is added to the score, and the set of keywords is removed from the keyword group. Step 5: Calculate entity association degree: After removing entities that can be fully matched in the previous step, the remaining entities are subjected to correlation calculation to identify potential relationships between intelligence. In the process of calculating entity correlation, for malware, the potential correlation between malware entities is discovered by calculating the commonality of the attack methods implemented by malware. After normalization, malware entities in the article can be directly associated with malware entities in the threat intelligence knowledge graph. Then, the correlation of malware is calculated by the attack methods that malware can implement in the threat intelligence knowledge graph.

2. The intelligence correlation calculation method according to claim 1, characterized in that, It also includes a comprehensive score, with the total score being: normalized entity matching pairs * 1 + malware correlation * 1 + vulnerability-related infrastructure matching pairs * 0.1 + infrastructure vendor matching pairs * 0.1 + malicious organization correlation * 1. The aforementioned correlation calculations are used to make a comprehensive score, and the correlation between the two intelligence articles is recorded in the database.

3. The intelligence correlation calculation method according to claim 1, characterized in that, In the process of text graph extraction, named entity recognition based on BERT-BiLSTM-CRF is performed by using a BERT pre-trained model to obtain the corresponding word vectors, then inputting the word vectors into the BiLSTM layer to further extract the contextual relationships of the text, and finally obtaining the classification results through the CRF layer.

4. The intelligence correlation calculation method according to claim 3, characterized in that, The input is a sequence of characters, and the output is the predicted label for each word. The entity is obtained by classification and extraction.

5. The intelligence correlation calculation method according to claim 1, characterized in that, After acquiring entities, relations are extracted using the R-BERT model via a pipeline approach, which applies the BERT model to relation classification. First, special markers are inserted before and after the target entity's position. Then, the text is input into BERT for fine-tuning to identify the positions of the two target entities and pass the information to the BERT model. Next, the positions of the two target entities are found in the word vectors output by the BERT model. Using word vectors and sentence encoding as input to a multi-layer neural network for classification, this method captures the semantic information of the sentence and the two target entities, making it better suited for relation classification tasks.

6. The method for calculating intelligence relevance according to claim 1, characterized in that, During the entity correlation calculation process, for vulnerabilities, the potential correlation between vulnerability entities is explored by determining whether the vulnerabilities exist in the same infrastructure. The relationship between vulnerabilities and hardware, software, and operating systems can be extracted from the threat intelligence knowledge graph. Hardware, software, and operating systems related to vulnerabilities in two intelligence articles are extracted from the threat intelligence knowledge graph and matched. For each matching pair of the same hardware, software, and operating systems, the score increases by 0.1 points.

7. The method for calculating intelligence relevance according to claim 1, characterized in that, During the entity correlation calculation process, for the infrastructure part, the potential correlation between infrastructures is explored by judging whether the infrastructure entities are products of the same vendor. The supplier relationship of infrastructure can be extracted from the threat intelligence knowledge graph. The potential relationship of infrastructure is judged by the same vendor. Each pair of matching vendors increases the score by 0.1 points.

8. The method for calculating intelligence relevance according to claim 1, characterized in that, In the process of calculating entity correlation, for malicious organizations, the potential correlation between malicious organizations is explored by using their common attack methods and malware. The relationship between malicious organizations and their attack methods and malware can be extracted from the threat intelligence knowledge graph. By matching the same attack methods and malware of two malicious organizations, the correlation between malicious organizations is calculated.

Images