Threat intelligence IOC credibility scoring method, device and related devices

Abstract

The embodiments of the present application provide a method, device and related devices for credibility scoring of threat intelligence IOC, which relate to the field of computer technology. The method includes: obtaining IOC intelligence from different channels; clustering the obtained IOC intelligence to obtain multiple target clusters; for each target cluster, obtaining a manual score for each first IOC intelligence in the target cluster, the number of first IOC intelligence is less than the total number of IOC intelligence in the target cluster; for each target cluster, determining the target credibility score of each IOC intelligence in the target cluster according to the manual score corresponding to the target cluster. In this way, the credibility score of IOC intelligence can be obtained by combining man and machine, which can ensure both the speed of obtaining the score and the accuracy of the score.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a method and device for scoring the credibility of threat intelligence (IOC). Background Art

[0002] With the advancement of computer technology, big data is increasingly being applied to cybersecurity. A key area of application is the use of cyber threat intelligence (IOCs, or Indicators of Compromise) for security scenario analysis. Currently, IOC intelligence from various sources floods the cyberspace, and its quality varies widely. Therefore, it is necessary to score various types of IOC intelligence so that higher-quality IOCs can be used to reduce missed and false positives in security scenarios. Summary of the Invention

[0003] The embodiments of the present application provide a method, device, and related devices for credibility scoring of threat intelligence IOC, which can obtain the credibility score of IOC intelligence through a human-machine combination, thereby ensuring both the speed of obtaining the score and the accuracy of the score.

[0004] The embodiments of the present application can be implemented as follows:

[0005] In a first aspect, an embodiment of the present application provides a method for scoring the reputation of threat intelligence IOC, the method comprising:

[0006] Obtain IOC intelligence from various channels;

[0007] Cluster the obtained IOC intelligence to obtain multiple target clusters;

[0008] For each target cluster, obtaining a manual score of each first IOC intelligence in the target cluster, wherein the number of the first IOC intelligence is less than the total number of IOC intelligence in the target cluster;

[0009] For each target cluster, a target credibility score of each IOC intelligence in the target cluster is determined according to the manual score corresponding to the target cluster.

[0010] In a second aspect, an embodiment of the present application provides a device for scoring the reputation of threat intelligence IOC, the device comprising:

[0011] Intelligence acquisition module, used to obtain IOC intelligence from different channels;

[0012] The clustering module is used to cluster the obtained IOC intelligence to obtain multiple target clusters;

[0013] a scoring module, configured to obtain, for each target cluster, a manual score of each first IOC intelligence in the target cluster, wherein the number of the first IOC intelligence is less than the total number of IOC intelligence in the target cluster;

[0014] The scoring module is further configured to determine, for each target cluster, a target credibility score for each IOC intelligence in the target cluster according to a manual score corresponding to the target cluster.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, including a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor can execute the machine-executable instructions to implement the IOC credibility scoring method described in the aforementioned embodiment.

[0016] In a fourth aspect, an embodiment of the present application provides a readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the IOC credibility scoring method as described in the aforementioned embodiment is implemented.

[0017] The IOC credibility scoring method, device, and related devices provided in the embodiments of this application aggregate IOC intelligence from different channels to obtain multiple target clusters, then manually score some of the IOC intelligence in each cluster. Finally, based on the manual scores of each target cluster, a target credibility score is obtained for each piece of IOC intelligence in that target cluster. In this way, the credibility score of IOC intelligence is obtained through a human-computer interaction approach, which ensures both the speed of scoring and the accuracy of the scoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 A block diagram of an electronic device provided in an embodiment of the present application;

[0020] Figure 2 A flowchart of the IOC credibility scoring method provided in an embodiment of the present application;

[0021] Figure 3 for Figure 2 Schematic diagram of the flow of sub-steps included in step S140;

[0022] Figure 4 for Figure 3 A schematic flow chart of the sub-steps included in sub-step S142;

[0023] Figure 5 A block diagram of an IOC credibility scoring device provided in an embodiment of the present application.

[0024] Icons: 100 - electronic device; 110 - memory; 120 - processor; 130 - communication unit; 200 - IOC credibility scoring device; 210 - intelligence acquisition module; 220 - clustering module; 230 - scoring module. DETAILED DESCRIPTION

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0026] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present application.

[0027] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0028] IOCs (Indicators of Comprise, threat intelligence) describe a series of information indicating an attacker's illegal destruction of a victim's host. Currently, IOC intelligence from various sources floods the cyberspace, and its quality varies. Therefore, it is necessary to score IOC intelligence so that high-quality IOC intelligence can be used for security scenario analysis and reduce missed and false positives.

[0029] Currently, various IOC intelligence sources are typically obtained through various channels, and then data is analyzed to generate IOC intelligence scores. IOC intelligence can also include the channel's own score, which can be used as a reference during analysis. Each channel corresponds to a specific type of IOC intelligence.

[0030] IOC intelligence is complex and multifaceted, making it difficult to develop a universal data analysis method for accurate scoring. Specifically, using a universal data analysis method to analyze multiple types of IOC intelligence from different regions to generate scores would result in inaccurate scores and a low accuracy rate.

[0031] If a scoring model is established for each channel based on a large amount of data, and the IOC intelligence of the channel is scored using the scoring model corresponding to the channel, although accurate scores for various types of IOC intelligence can be obtained, the implementation is complex and the workload is large.

[0032] Furthermore, after obtaining the IOC intelligence score, the IOC reputation score is typically adjusted dynamically based on feedback from actual IOC applications. Using low-accuracy IOC intelligence to assess real-world security scenarios and then revising the score based on actual feedback can lead to misjudgments of security scenarios, increasing false positives and false negatives. For example, if an attack is believed to have occurred based on low-accuracy IOC intelligence 1 and recorded in the attack log, and then the attack is subsequently confirmed based on the attack log, the score of the channel corresponding to IOC intelligence 1 is increased. This constitutes closed-loop learning based on misjudgments, leading to further inaccurate scores.

[0033] In response to the above situation, the embodiments of the present application provide a method, device and related devices for credibility scoring of threat intelligence IOC, which can obtain the credibility score of IOC intelligence through a human-machine combination, and can ensure both the speed of obtaining the score and the accuracy of the score.

[0034] It is worth noting that the defects existing in the above solutions are the results obtained by the inventor after practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed in the embodiments of this application below should be the contributions made by the inventor to this application during the application process.

[0035] The following describes some embodiments of the present application in detail with reference to the accompanying drawings. In the absence of conflict, the following embodiments and features therein may be combined with each other.

[0036] Please refer to Figure 1 , Figure 1This is a block diagram of an electronic device 100 provided in an embodiment of the present application. The electronic device 100 may be, but is not limited to, a computer, a server, or the like. The electronic device 100 may include a memory 110, a processor 120, and a communication unit 130. The memory 110, the processor 120, and the communication unit 130 are electrically connected to each other, directly or indirectly, to enable data transmission or interaction. For example, these components may be electrically connected to each other via one or more communication buses or signal lines.

[0037] The memory 110 is used to store programs or data. The memory 110 may be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.

[0038] The processor 120 is used to read / write data or programs stored in the memory 110 and execute corresponding functions. For example, the memory 110 stores an IOC reputation scoring device 200, which includes at least one software function module stored in the memory 110 in the form of software or firmware. The processor 120 executes software programs and modules stored in the memory 110, such as the IOC reputation scoring device 200 in the embodiment of the present application, to execute various functional applications and data processing, thereby implementing the IOC reputation scoring method in the embodiment of the present application.

[0039] The communication unit 130 is used to establish a communication connection between the electronic device 100 and other communication terminals through a network, and to send and receive data through the network.

[0040] It should be understood that Figure 1 The structure shown is only a schematic diagram of the structure of the electronic device 100. The electronic device 100 may also include Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0041] Please refer to Figure 2, Figure 2 This is a flow chart of a method for scoring the reputation of an IOC provided in an embodiment of the present application. The method can be applied to the electronic device 100 described above. The specific process of the method for scoring the reputation of an IOC is described in detail below. In this embodiment, the method may include steps S110 to S140.

[0042] Step S110: Obtain IOC intelligence from different channels.

[0043] IOC intelligence can be obtained from various sources, such as abuse.ch. Locally acquired IOC intelligence through log processing can also be used as IOC intelligence for scoring. The specific methods for obtaining IOC intelligence from different channels can be determined based on actual needs and are not specifically limited. IOC intelligence from different channels may not include exactly the same information dimensions, but key dimensions, such as user-agent, attack methods, and attack samples, are common.

[0044] Step S120: clustering the obtained IOC intelligence to obtain multiple target clusters.

[0045] In this embodiment, any AI clustering algorithm can be used to cluster the multiple IOC intelligence obtained in step S110 to obtain multiple target clusters. For example, a K-MEANS clustering algorithm or Mean-Shift clustering can be used. The specific clustering method can be determined based on actual needs and is not specifically limited here.

[0046] Step S130: For each target cluster, obtain a manual score of each first IOC intelligence in the target cluster.

[0047] After clustering, for each target cluster, a portion of IOC intelligence can be extracted from that target cluster as the first IOC intelligence. The amount of first IOC intelligence is less than the total number of IOC intelligence in the target cluster. Each piece of first IOC intelligence can be manually inspected to obtain a manual score for each piece of first IOC intelligence. This allows for a joint analysis of security expert knowledge and information from multiple sources to complete the scoring of the sampled IOC intelligence.

[0048] Step S140 : For each target cluster, a target credibility score of each IOC intelligence in the target cluster is determined according to the manual score corresponding to the target cluster.

[0049] For each target cluster, when a manual score of the first IOC intelligence in the target cluster is obtained, a score can be determined based on the manual score as the target credibility score of each IOC intelligence in the target cluster. For example, the determined score is the mode value, average value, etc. in the manual score of the target cluster. Alternatively, the target credibility score of each IOC intelligence in the target cluster can be obtained by analyzing the manual score. It should be noted that the above is only an example, and other methods can be used in combination with actual needs to obtain the target credibility score of each IOC intelligence in the target cluster.

[0050] This embodiment of the application clusters various IOC intelligence items based on their multiple features for similarity. It then performs manual sampling of the existing clustering results to obtain manual scores. This manual score is then used to determine the target credibility score for each IOC intelligence item in the corresponding clustering results. This method, combining human and machine learning to obtain credibility scores for IOC intelligence, ensures both speed and accuracy of score acquisition. It also eliminates the need to establish separate scoring models for each channel, reducing the complexity of model application.

[0051] To ensure the accuracy of the target reputation score of at least some IOC intelligence, Figure 3 The target reputation score is obtained in the manner described. Please refer to Figure 3 , Figure 3 for Figure 2 Schematic diagram of the flow of sub-steps included in step S140. In this embodiment, step S140 may include sub-steps S141 and S142.

[0052] Sub-step S141: for each first IOC intelligence, the manual score of the first IOC intelligence is used as the target credibility score of the first IOC intelligence.

[0053] Sub-step S142, obtaining a target credibility score for each second IOC intelligence based on the obtained manual score for each first IOC intelligence.

[0054] In this embodiment, since the manual evaluation of the first IOC intelligence is manually confirmed, the accuracy can be guaranteed, so the manual evaluation of each first IOC intelligence can be directly used as the target credibility score of the first IOC intelligence. For each target cluster, the IOC intelligence other than the first IOC intelligence in the target cluster can be used as the second IOC intelligence, and the target credibility score of each second IOC thin and light version can be obtained by analysis based on the manual evaluation of each first IOC intelligence in the target cluster. In this way, the accuracy of the target credibility score of the first IOC intelligence can be guaranteed, and at the same time, the target credibility score of other IOC intelligence in the same cluster can be determined based on the manual evaluation of the first IOC intelligence, thereby ensuring the accuracy of the evaluation of the second IOC intelligence.

[0055] Please refer to Figure 4 , Figure 4 for Figure 3 Flowchart of sub-steps included in sub-step S142. In this embodiment, sub-step S142 may include sub-steps S1421 and S1422.

[0056] Sub-step S1421: determining an initial credibility score based on the obtained manual scores of each of the first IOC intelligence.

[0057] Sub-step S1422: determining a target credibility score for each of the second IOC intelligences based on the initial credibility score.

[0058] In this embodiment, for each target cluster, the manual score of the first IOC intelligence corresponding to the target cluster can be analyzed to determine the mode, average, maximum, or minimum value of the manual score, etc., as the initial credibility score corresponding to the target cluster. The initial credibility score corresponding to the target cluster can then be directly used as the target credibility score for each second IOC intelligence in the target cluster.

[0059] Alternatively, the target score plus or minus information corresponding to each second IOC intelligence in the target cluster can be obtained, and then the target credibility score of each second IOC intelligence can be calculated based on the target score plus or minus information corresponding to each second IOC intelligence and the initial credibility score. The target score plus or minus information is used to indicate how to adjust the initial credibility score. For example, if the initial credibility score is 50 points and the target score plus or minus information indicates adding 5 points, the target credibility score can be 55 points.

[0060] The target score plus or minus information corresponding to a piece of second IOC intelligence may be determined based on features in the second IOC intelligence. As a possible implementation, the target score plus or minus information corresponding to each piece of second IOC intelligence may be obtained based on a target adjustment model corresponding to the target cluster and each piece of second IOC intelligence in the target cluster. For example, any piece of second IOC intelligence in the target cluster may be input into the target adjustment model corresponding to the target cluster to obtain the target score plus or minus information corresponding to the second IOC intelligence.

[0061] Among them, the target adjustment models corresponding to different target clusters are different. The target adjustment model corresponding to a target cluster is obtained based on the difference training of each unsampled IOC intelligence in the corresponding initial cluster and each unsampled IOC intelligence. The difference is the difference between the reference score determined based on the manual scoring of the sampled IOC intelligence in the initial cluster and the manual scoring of the unsampled IOC intelligence. The method for determining the reference score is the same as the method for determining the initial credibility score. The center of the target cluster is the same as the center of the corresponding initial cluster.

[0062] That is, any clustering algorithm can be used to first cluster the initial IOC intelligence to obtain multiple initial clusters. Then, a sample from each initial cluster is manually inspected to obtain a manual score for some of the initial IOC intelligence in the initial cluster. Next, a reference score is calculated for the initial cluster based on the manual score of the initial cluster. Then, a manual method can be used to manually calculate the score difference corresponding to each unsampled IOC intelligence in the initial cluster. Finally, based on this score difference and each unsampled IOC intelligence, a target adjustment model corresponding to the initial cluster is trained. It is understandable that in order to improve the accuracy of the target adjustment model, the sample size can be increased.

[0063] In this case, clustering can be performed directly based on the centers of each initial cluster and the IOC intelligence obtained in step S110 to complete the clustering of the obtained IOC intelligence and obtain multiple target clusters. Then, the target adjustment model corresponding to each initial cluster can be used as the target adjustment model corresponding to the target cluster with the center of the initial cluster as the cluster center, so that the model can be used to subsequently determine the target addition and subtraction information.

[0064] The embodiment of the present application utilizes data analysis to perform similarity clustering on various types of IOC intelligence based on their multiple features. Samples are then taken from each clustering result, and a joint analysis is performed using the manual knowledge of security experts and multi-party information to score the sampled IOCs, thereby obtaining accurate credibility scores for some IOCs. Subsequently, based on the manual scores of each clustering result, a reference credibility score for the unsampled IOC intelligence in the clustering result is determined, thereby obtaining an accurate credibility score for the unsampled IOC intelligence in the clustering result.

[0065] The embodiment of the present application uses a human-machine combination approach to see IOC reputation scoring. In this approach, manual precision scoring is first performed, followed by data analysis, and the precise IOC intelligence reputation scoring is extended to a large number of other IOC intelligence. In this way, IOC threat intelligence data can be quickly and accurately scored for credibility using a combination of human and machine advantages. Compared to the approach of establishing a scoring model for each channel separately, this solution does not require the establishment of a scoring model. Instead, it performs low-complexity clustering, manually obtains precise scores for some IOC intelligence in the cluster, and further generalizes the reputation scores obtained manually, achieving rapid and accurate scoring of IOC intelligence credibility and effectively reducing the complexity of model application.

[0066] In order to execute the corresponding steps in the above embodiments and various possible methods, an implementation method of an IOC reputation scoring device 200 is given below. Optionally, the IOC reputation scoring device 200 can adopt the above Figure 1 The device structure of the electronic device 100 is shown in FIG. Figure 5 , Figure 5 This is a block diagram of an IOC reputation scoring device 200 provided in an embodiment of the present application. It should be noted that the basic principles and technical effects of the IOC reputation scoring device 200 provided in this embodiment are the same as those in the aforementioned embodiments. For the sake of brevity, any details not mentioned in this embodiment are referred to the corresponding content in the aforementioned embodiments. In this embodiment, the IOC reputation scoring device 200 may include an intelligence acquisition module 210, a clustering module 220, and a scoring module 230.

[0067] The intelligence acquisition module 210 is used to obtain IOC intelligence from different channels.

[0068] The clustering module 220 is used to cluster the obtained IOC intelligence to obtain multiple target clusters.

[0069] The scoring module 230 is configured to obtain, for each target cluster, a manual score of each first IOC intelligence in the target cluster, wherein the number of the first IOC intelligence is less than the total number of IOC intelligence in the target cluster.

[0070] The scoring module 230 is further configured to determine, for each target cluster, a target credibility score for each IOC intelligence in the target cluster according to the manual score corresponding to the target cluster.

[0071] Optionally, in this embodiment, the scoring module 230 is specifically used to: for each first IOC intelligence, use the manual score of the first IOC intelligence as the target credibility score of the first IOC intelligence; and obtain the target credibility score of each second IOC intelligence based on the obtained manual score of each first IOC intelligence, wherein the second IOC intelligence is the IOC intelligence in the target cluster other than the first IOC intelligence.

[0072] Optionally, in this embodiment, the scoring module 230 is specifically configured to: determine an initial credibility score based on the manual scoring of each first IOC intelligence; and determine a target credibility score for each second IOC intelligence based on the initial credibility score.

[0073] Optionally, in this embodiment, the scoring module 230 is specifically used to: obtain target score addition and subtraction information corresponding to each second IOC intelligence; and calculate the target credibility score of each second IOC intelligence based on the target score addition and subtraction information corresponding to each second IOC intelligence and the initial credibility score.

[0074] Optionally, in this embodiment, the scoring module 230 is specifically used to: obtain target addition and subtraction information corresponding to each second IOC intelligence according to the target adjustment model corresponding to the target cluster and each second IOC intelligence in the target cluster, wherein different target clusters correspond to different target clusters. The target adjustment model corresponding to the target cluster is obtained by training based on each unsampled IOC intelligence in the corresponding initial cluster and the score difference corresponding to each unsampled IOC intelligence. The score difference is the difference between a reference score determined based on a manual score of the sampled IOC intelligence in the initial cluster and a manual score of the unsampled IOC intelligence. The center of the target cluster is the same as the center of the corresponding initial cluster.

[0075] Optionally, in this embodiment, the clustering module 220 is specifically configured to perform clustering according to the centers of the initial clusters and the obtained IOC intelligence to obtain a plurality of target clusters.

[0076] Optionally, the above modules can be stored in the form of software or firmware. Figure 1The memory 110 shown in FIG. 110 or the operating system (OS) of the electronic device 100 may be fixed and may be used by Figure 1 Meanwhile, the data, program codes, etc. required to execute the above modules may be stored in the memory 110.

[0077] An embodiment of the present application further provides a readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the IOC credibility scoring method is implemented.

[0078] In summary, the embodiments of the present application provide a credibility scoring method, apparatus, and related devices for IOCs. These methods aggregate IOC intelligence from different channels to obtain multiple target clusters, then manually score portions of the IOC intelligence within each cluster. Finally, based on the manual scores for each target cluster, a target credibility score is obtained for each piece of IOC intelligence within that cluster. In this way, the credibility score of IOC intelligence is obtained through a human-machine integration approach, ensuring both speed and accuracy.

[0079] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0080] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0081] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0082] The above description is merely an optional embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A reputation scoring method for threat intelligence IOC, characterized in that: The method comprises: Obtain IOC intelligence from various channels; Cluster the obtained IOC intelligence to obtain multiple target clusters; For each target cluster, obtaining a manual score of each first IOC intelligence in the target cluster, wherein the number of the first IOC intelligence is less than the total number of IOC intelligence in the target cluster; For each of the target clusters, a target credibility score for each IOC intelligence in the target cluster is determined based on the manual score corresponding to the target cluster, including: for each first IOC intelligence, the manual score of the first IOC intelligence is used as the target credibility score of the first IOC intelligence; an initial credibility score is obtained based on the obtained manual score of each first IOC intelligence; and a target credibility score for each second IOC intelligence is determined based on the initial credibility score, wherein the second IOC intelligence is the IOC intelligence in the target cluster other than the first IOC intelligence, and the target credibility score of each second IOC intelligence is the initial credibility score, or a score obtained by adjusting the initial credibility score.

2. The method according to claim 1, characterized in that Determining a target credibility score for each of the second IOC intelligence based on the initial credibility score includes: Obtain target score addition and subtraction information corresponding to each of the second IOC intelligence; The target credibility score of each second IOC intelligence is calculated based on the target plus / minus score information and the initial credibility score corresponding to each second IOC intelligence.

3. The method according to claim 2, characterized in that The obtaining of target score addition and subtraction information corresponding to each second IOC intelligence includes: According to the target adjustment model corresponding to the target cluster and each second IOC intelligence in the target cluster, the target addition and subtraction information corresponding to each second IOC intelligence is obtained, wherein different target clusters correspond to different target clusters. The target adjustment model corresponding to the target cluster is obtained based on the unsampled IOC intelligence in the corresponding initial cluster and the score difference training corresponding to each unsampled IOC intelligence. The score difference is the difference between the reference score determined based on the manual score of the sampled IOC intelligence in the initial cluster and the manual score of the unsampled IOC intelligence. The center of the target cluster is the same as the center of the corresponding initial cluster.

4. The method according to claim 3, characterized in that The obtained IOC intelligence is clustered to obtain multiple target clusters, including: Clustering is performed according to the centers of the initial clusters and the obtained IOC intelligence to obtain a plurality of target clusters.

5. A device for scoring the reputation of threat intelligence IOC, characterized in that: The device comprises: Intelligence acquisition module, used to obtain IOC intelligence from different channels; The clustering module is used to cluster the obtained IOC intelligence to obtain multiple target clusters; a scoring module, configured to obtain, for each target cluster, a manual score of each first IOC intelligence in the target cluster, wherein the number of the first IOC intelligence is less than the total number of IOC intelligence in the target cluster; The scoring module is further configured to determine, for each target cluster, a target credibility score for each IOC intelligence in the target cluster based on a manual score corresponding to the target cluster; The scoring module is specifically configured to: for each first IOC intelligence, use the manual score of the first IOC intelligence as the target credibility score of the first IOC intelligence; obtain an initial credibility score based on the manual score of each first IOC intelligence; and determine the target credibility score of each second IOC intelligence based on the initial credibility score, wherein the second IOC intelligence is the IOC intelligence in the target cluster other than the first IOC intelligence, and the target credibility score of each second IOC intelligence is the initial credibility score, or a score obtained by adjusting the initial credibility score.

6. An electronic device, characterized in that: The invention comprises a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor can execute the machine-executable instructions to implement the reputation scoring method of the IOC according to any one of claims 1 to 4.

7. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the IOC reputation scoring method according to any one of claims 1 to 4 is implemented.

Images