A method, device, equipment and storage medium for automatically identifying threat data

Abstract

The present invention provides a method, apparatus, device and storage medium for automatically identifying threat data. The method includes: obtaining an access request to be identified; the access request to be identified includes a visitor identifier and request data; identifying the request data through an online model to obtain an online identification result; processing the online identification result through an offline model to determine whether the access request to be identified includes threat data. By establishing an offline model and an online model, the present invention determines whether the access request to be identified carries threat data. The offline model generates a training model based on a Bayesian network by collecting historical threat intelligence information of visitors, and is used to probabilistically determine the attack relevance between real-time threat intelligence information and visitors. The online model then delivers the observed network behavior data of the visitor to the offline model, and the offline model analyzes the visitor, so as to automatically and quickly identify high-probability threat data during the attack process.

Description

Background Art

[0002] In the field of network security, as defenders use new defense detection means, network visitors will also quickly modify their attack techniques and methods according to the new defense means to evade detection and carry out attacks. Facing the fast and new attack means, defenders will fall into a passive defensive position. The traditional threat index methods (such as detecting known virus file signatures, matching beacons such as threat intelligence IPs, etc.) have become difficult to detect the latest attack behaviors of visitors, and existing defense means are becoming increasingly ineffective. Summary of the Invention

[0003] In view of this, the present invention provides a method, device, equipment and medium for determining a network attack range, which at least partially solves the technical problem that the existing defense means in network security are difficult to adapt to attack means. The technical solution adopted by the present invention is as follows:

[0004] According to one aspect of the present application, a method for automatically identifying threat data is provided, including:

[0005] Obtain a to-be-identified access request; the to-be-identified access request includes a visitor identifier and request data;

[0006] Identify the request data through an online model to obtain an online identification result;

[0007] Process the online identification result through an offline model to determine whether the to-be-identified access request includes threat data; the offline model is obtained based on the historical threat security events and Bayesian network of the visitor corresponding to the visitor identifier.

[0008] In an exemplary embodiment of the present application, identifying the request data through an online model to obtain an online identification result includes:

[0009] Real-time collect real-time threat intelligence information in the request data through an online model;

[0010] Summarize all the real-time threat intelligence information and determine it as the online identification result.

[0011] In an exemplary embodiment of the present application, processing the online identification result through an offline model to determine whether the to-be-identified access request includes threat data includes:

[0012] Analyze the real-time threat intelligence information through an offline model to obtain the threat probability value of the visitor corresponding to the visitor identifier;

[0013] Determine whether the to-be-identified access request includes threat data based on the threat probability value.

[0014] In an exemplary embodiment of the present application, determining whether the access request to be identified includes threat data based on the threat probability value includes:

[0015] If the threat probability value is greater than a preset probability threshold, it is determined that the access request to be identified includes threat data, and an alarm notification is issued; otherwise, it is determined that the access request to be identified does not include threat data.

[0016] In an exemplary embodiment of the present application, the offline model is determined by the following method:

[0017] According to the access request to be identified, obtain the historical threat security events corresponding to the visitor identifier;

[0018] Extract the historical threat intelligence information of the visitor corresponding to the visitor identifier through the historical threat security events;

[0019] Perform Bayesian network probability graph training on the historical threat intelligence information to obtain an offline model.

[0020] In an exemplary embodiment of the present application, the online model is determined by the following method:

[0021] Obtain each real-time security event stream in the request data;

[0022] Obtain an online model according to each real-time security event stream.

[0023] In an exemplary embodiment of the present application, after the step of, if the threat probability value is greater than a preset probability threshold, it is determined that the access request to be identified includes threat data, and an alarm notification is issued; otherwise, it is determined that the access request to be identified does not include threat data, the method for automatically identifying threat data further includes:

[0024] If the access request to be identified includes threat data, add the corresponding real-time threat intelligence information to the historical threat intelligence information.

[0025] According to one aspect of the present application, there is provided an apparatus for automatically identifying threat data, including:

[0026] A request response module, configured to obtain an access request to be identified; the access request to be identified includes a visitor identifier and request data;

[0027] An online identification module, configured to identify the request data through an online model to obtain an online identification result;

[0028] A threat analysis module, configured to process the online identification result through an offline model to determine whether the access request to be identified includes threat data.

[0029] According to one aspect of the present application, there is provided a non-transitory computer-readable storage medium storing at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the method for automatically identifying threat data.

[0030] According to one aspect of the present application, there is provided an electronic device including a processor and the non-transitory computer-readable storage medium described above.

[0031] The present invention has at least the following beneficial effects:

[0032] The present invention analyzes a to-be-identified access request by establishing an offline model and an online model to determine whether threat data is carried in the to-be-identified access request. The offline model generates a training model based on a Bayesian network by collecting historical threat intelligence information of visitors, which is used to probabilize the attack correlation between real-time threat intelligence information and visitors. The online model then delivers the observed network behavior data of the visitor to the offline model, and the offline model analyzes the visitor, thereby automatically and quickly identifying high-probability threat data during the attack process. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0034] Figure 1 It is a flowchart of the method for automatically identifying threat data provided by the embodiment of the present invention;

[0035] Figure 2 It is a block diagram of the device for automatically identifying threat data provided by the embodiment of the present invention;

[0036] Figure 3 It is a schematic diagram of the construction of the offline model in the method for automatically identifying threat data provided by the embodiment of the present invention;

[0037] Figure 4 It is a schematic diagram of the construction of the online model in the method for automatically identifying threat data provided by the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0038] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts belong to the protection scope of the present invention.

[0039] In the field of network security, the attack and defense confrontation is a long-term battle of ebb and flow. As defenders use new defense and detection means, network visitors will also quickly modify attack techniques and methods according to the new defense means to evade detection and carry out attacks. Facing the fast and new attack means, defenders will have a sense of "powerlessness" and thus fall into a passive defensive position. Facing the increasingly complex and endless network attack means, coupled with the trend of attack in the dark and defense in the open, traditional threat index methods (such as known virus file signature detection, threat intelligence IP beacon matching, etc.) have become very difficult to detect the latest attack behaviors of attackers, and defense means are becoming increasingly ineffective.

[0040] ATT&CK (Adversarial Tactics, Techniques and Common Knowledge), that is, the confrontation tactics, techniques and common knowledge in network security, is a model that describes the techniques used in each stage of the attack from the perspective of visitors. ATT&CK has formed a knowledge base of confrontation tactics and techniques for the attacker's attack life cycle and the goals of each attack stage through a detailed analysis of publicly available threat intelligence reports of visitors. However, the data collected by security companies from the real environment to detect attack techniques through direct observation, although more intuitive, often consumes a large amount of energy of network security personnel, and there are also deficiencies in preparation and effectiveness, and it is impossible to form a productization ability. Therefore, a method for automatically and quickly identifying and predicting threat data needs to be proposed.

[0041] A method for automatically identifying threat data, as Figure 1 shown, includes:

[0042] Step S100: Obtain the access request to be identified; the access request to be identified includes a visitor identifier and request data;

[0043] The access request to be identified is an access request sent by a visitor, which includes the visitor identifier corresponding to the visitor and the request data for requesting access. Each visitor corresponds to a visitor identifier, which is used to identify all visitors. When the access request to be identified carries threat data, it is convenient to find the corresponding visitor according to the visitor identifier.

[0044] Step S200: Identify the request data through an online model to obtain an online identification result;

[0045] Among them, the online model is determined by the following method:

[0046] Step S011: Obtain each real-time security event stream in the request data;

[0047] Step S012: Obtain the online model according to each real-time security event stream.

[0048] As Figure 4 shown, the method for building the online model is as follows:

[0049] Obtain the real-time security event stream of the visitor, enrich the relevant information through the associated threat intelligence database, such as IP reputation, attack weapon library, accessed file reputation, etc., and calibrate the TTPs information in combination with the TTPs knowledge base in ATT&CK to obtain the online model.

[0050] The request data stores the intelligence data corresponding to several security events sent by the visitor. It is necessary to first identify and collect the intelligence data corresponding to all security events through the online model to obtain the corresponding online recognition result, and then perform the subsequent threat data verification work.

[0051] Furthermore, in step S200, the request data is identified through the online model to obtain the online recognition result, including:

[0052] Step S210: Real-time collect the real-time threat intelligence information in the request data through the online model;

[0053] Step S220: Summarize all the real-time threat intelligence information and determine it as the online recognition result.

[0054] Step S300: Process the online recognition result through the offline model to determine whether the access request to be recognized includes threat data; the offline model is obtained according to the historical threat security events of the visitor corresponding to the visitor identifier and the Bayesian network;

[0055] The intelligence data corresponding to the security events real-time collected by the online model through the offline model, that is, the real-time threat intelligence information, is subjected to probability verification processing to determine whether the access request to be recognized includes threat data.

[0056] Among them, the offline model is determined by the following method:

[0057] Step S021: According to the access request to be recognized, obtain the historical threat security events corresponding to the visitor identifier;

[0058] Step S022: Extract the historical threat intelligence information of the visitor corresponding to the visitor identifier through the historical threat security events;

[0059] Step S023: Perform Bayesian network probability graph training on historical threat intelligence information to obtain an offline model.

[0060] According to the access request to be identified of the visitor, obtain the historical threat intelligence information of the visitor, that is, by obtaining the threat security events that occurred to the visitor in the past, and the threat security events calibrated according to the existing experience of intelligence threat experts. The historical threat security events of the visitor are the threat security events that occurred to the visitor in the past. According to the TTPs (Tactics, Techniques, and Procedures) of ATT&CK, extract the corresponding historical threat intelligence information of the visitor from the threat security events, that is, historical TTPs information.

[0061] The Bayesian network, also known as the belief network or the directed acyclic graph model, is a probabilistic graphical model. As Figure 3 shown, the method of building an offline model using a Bayesian network is as follows:

[0062] According to the historical threat security event data of the visitor or the threat security event data calibrated by intelligence threat experts, perform data enrichment processing on it. Data enrichment is to enrich relevant information by associating with a threat intelligence database. Relevant information such as IP reputation, attack weapon arsenal, access file reputation, etc. Then perform the TTPs information calibration step. TTPs information calibration is to calibrate the TTPs used for each threat security event through the TTPs knowledge base in ATT&CK. For example, a certain ransomware event used lateral movement tools (ATT&CK TTPs T1570), created / modified system processes (ATT&CK TTPs T1432), compromised defenses (ATT&CK TTPs T1562.001), etc. technologies. Then converge a large number of collected threat security events according to the attack event type. For example, aggregate the data of all ransomware events into a set to ensure that the attack event types of the threat security events in the same set are the same. Mark the probability variable of the TTPs used by the attack event type of the set. For example, in the ransomware security event, the probability variable of lateral movement occurring is P(T1570|ransomware) = N (the number of times T1570 is used in ransomware events) / N (the total number of ransomware events); Finally, input the probability variable into the Bayesian network for training to obtain the probability model of threat security events and TTPs, that is, the offline model.

[0063] Furthermore, in step S300, process the online recognition result through the offline model to determine whether the access request to be identified includes threat data, including:

[0064] Step S310: Analyze the real-time threat intelligence information through the offline model to obtain the threat probability value of the visitor corresponding to the visitor identifier;

[0065] Step S320: Determine whether the access request to be identified includes threat data based on the threat probability value.

[0066] The online model collects the real-time threat intelligence information of the visitor in real time, obtains all the calibrated TTPs information within a preset time period. For example, within 10 minutes, threat security events are calibrated as having T1570, T1432, etc. The threat security events corresponding to the TTPs information within the preset time period are sent to the offline model. The offline model predicts the occurrence probability of this threat security event, that is, the threat probability value corresponding to the visitor, and compares the obtained threat probability value with the preset probability threshold to determine whether this visitor carries threat data.

[0067] Specifically, in step S320, determining whether the access request to be identified includes threat data based on the threat probability value includes:

[0068] Step S321: If the threat probability value is greater than the preset probability threshold, determine that the access request to be identified includes threat data and issue an alarm notification; otherwise, determine that the access request to be identified does not include threat data.

[0069] Step S322: If the access request to be identified includes threat data, add the corresponding real-time threat intelligence information to the historical threat intelligence information.

[0070] Compare the obtained threat probability value with the preset probability threshold. If the obtained threat probability value exceeds the preset probability threshold, an alarm notification is generated. For example, according to the threat security event corresponding to the TTPs of T1570 and T1432 being a ransomware event, the predicted confidence level of the ransomware event is 83%, and the preset probability threshold is 80%. Therefore, it is determined that the visitor corresponding to this threat security event carries threat data, and an alarm is issued for this threat data as a ransomware event.

[0071] In specific implementation, if a visitor connects to the visited party through remote desktop, this action is captured by the probe of the visited party, and it starts to check its attack method by the offline model. The offline model, through a large amount of data of historical threat security events, knows that remote desktop access (ATT&CK TTPs T1021, remote service) is a common technical means for visitors to conduct initial access. The visitor executes a ransomware sample on the device of the visited party, and this is perceived by the probe of the visited party due to accessing the bait file. The offline model checks its attack method, and the confidence levels of relevant branches of lateral movement tools (ATT&CK TTPs T1570, lateral movement tools), creating / modifying system processes (ATT&CK TTPs T1432), and compromising defenses (ATT&CK TTPs T1562.001) in the offline model are strengthened. The online model obtains the real-time threat intelligence information of the visitor in real time and sets the collected time period to 3 minutes. When the attack activity of the visitor has lasted for 3 minutes, the time window corresponding to the time period reaches the threshold, indicating that there are suspicious threat activities in the internal network environment, and the real-time threat intelligence information is sent to the offline model. The offline model will predict that the threat data is most likely a threat security event of ransomware behavior by delivering samples through remote access based on the strengthened branch probabilities of remote desktop access (T1021), lateral movement tools (T1570), creating / modifying system processes (T1432), and compromising defenses (T1562.001).

[0072] The present invention combines the TTPs technology of ATT&CK and a Bayesian network to establish an offline model and an online model, analyzes the to-be-identified access request sent by a visitor, and determines whether there is threat data in the to-be-identified access request. The offline model collects the historical threat intelligence information of the visitor, converts it into a set of clearly defined ATT&CK TTPs data, and generates a training model based on the Bayesian network to probabilize the attack correlation between the real-time threat intelligence information and the visitor. The online model then delivers the observed network behavior data of the visitor to the offline model, and the offline model analyzes the visitor, solving the dependencies among advanced data, TTPs, and missing or uncertain data, thereby automatically and quickly identifying the high-probability threat data during the attack process.

[0073] A device 100 for automatically identifying threat data, as Figure 2 shown, includes:

[0074] A request response module 110, configured to obtain a to-be-identified access request; the to-be-identified access request includes a visitor identifier and request data;

[0075] An online identification module 120, configured to identify the request data through an online model to obtain an online identification result;

[0076] The threat analysis module 130 is used to process the online recognition result through an offline model to determine whether the access request to be recognized includes threat data.

[0077] Among them, the online recognition module 120 is further used for:

[0078] Collect real-time threat intelligence information in the request data in real time through an online model;

[0079] Summarize all the real-time threat intelligence information and determine it as the online recognition result.

[0080] Among them, the threat analysis module 130 is further used for:

[0081] Analyze the real-time threat intelligence information through an offline model to obtain the threat probability value of the visitor corresponding to the visitor identifier;

[0082] If the threat probability value is greater than the preset probability threshold, it is determined that the access request to be recognized includes threat data and an alarm notification is issued; otherwise, it is determined that the access request to be recognized does not include threat data;

[0083] If the access request to be recognized includes threat data, add the corresponding real-time threat intelligence information to the historical threat intelligence information.

[0084] An embodiment of the present invention also provides a computer program product, which includes program code. When the program product runs on an electronic device, the program code is used to cause the electronic device to execute the steps in the methods according to various exemplary embodiments of the present invention described above in this specification.

[0085] In addition, although the steps of the methods in the present disclosure are described in a specific order in the drawings, this does not require or imply that these steps must be executed in this specific order, or that all the shown steps must be executed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution, etc.

[0086] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described here can be implemented by software or by a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure

[0087] can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can

[0088] It can be a personal computer, a server, a mobile terminal, or a network device, etc., to execute the method according to the embodiments of the present disclosure.

[0089] In an exemplary embodiment of the present disclosure, there is also provided an electronic device capable of implementing the above method.

[0090] Those skilled in the art can understand that various aspects of the present invention can be implemented as a system, a method, or a program product.

[0091] Therefore, various aspects of the present invention can be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software aspects, which can be collectively referred to as "circuit", "module", or "system" here.

[0092] The electronic device according to this embodiment of the present invention. The electronic device is only an example and should not impose any limitation on the functions and usage scope of the embodiments of the present invention.

[0093] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: the above at least one processor, the above at least one storage, and a bus connecting different system components (including the storage and the processor).

[0094] Among them, the storage stores program codes, and the program codes can be executed by the processor, so that the processor executes the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of this specification.

[0095] The storage may include a readable medium in the form of a volatile storage, such as a random access storage (RAM) and / or a cache storage, and may further include a read-only storage (ROM).

[0096] The storage may also include a program / utility having a set (at least one) of program modules, and such program modules include, but are not limited to: an operating system, one or more application programs, other program modules, and program data. The implementation of a network environment may be included in each or some combination of these examples.

[0097] The bus may represent one or more of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any bus structure in a variety of bus structures.

[0098] The electronic device can also communicate with one or more external devices (such as a keyboard, a pointing device, a Bluetooth device, etc.), and can also communicate with one or more devices that enable a user to interact with the electronic device, and / or communicate with any device that enables the electronic device to communicate with one or more other computing devices (such as a router, a modem, etc.). Such communication can be carried out through an input / output (I / O) interface. Moreover, the electronic device can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device through a bus. It should be understood that although not shown in the figure, other hardware and / or software modules can be used in combination with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0099] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be implemented by software, or can be implemented by the way of software combined with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, and the software product can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0100] In an exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium, on which a program product capable of implementing the above method of this specification is stored. In some possible implementation manners, various aspects of the present invention can also be implemented in the form of a program product, which includes program code. When the program product runs on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of this specification.

[0101] The program product may employ any combination of one or more readable media. The readable media may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0102] The computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which the readable program code is carried. Such a propagated data signal may take various forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the foregoing. The readable signal medium may also be any readable medium other than the readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device.

[0103] The program code contained on the readable medium may be transmitted by any appropriate medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0104] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., and also including conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's device, executed as a stand-alone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., by using an Internet service provider to connect through the Internet).

[0105] In addition, the above drawings are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present invention, and are not for limiting purposes. It is easy to understand that the processes shown in the above drawings do not indicate or limit the chronological order of these processes. Additionally, it is also easy to understand that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0106] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of the two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0107] As described above, the above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A method for automatically identifying threat data, characterized in that, Including: Obtain an access request to be recognized; The access request to be recognized includes a visitor identifier and request data; Identify the request data through an online model to obtain an online identification result; Process the online identification result through an offline model to determine whether the access request to be recognized includes threat data; The offline model is obtained based on the historical threat security events of the visitor corresponding to the visitor identifier and a Bayesian network; Among them, identifying the request data through an online model to obtain an online identification result includes: Real-time collect real-time threat intelligence information in the request data through an online model; Summarize all the real-time threat intelligence information and determine it as the online identification result; Among them, processing the online identification result through an offline model to determine whether the access request to be recognized includes threat data includes: Analyze the real-time threat intelligence information through an offline model to obtain the threat probability value of the visitor corresponding to the visitor identifier; Determine whether the access request to be recognized includes threat data based on the threat probability value; Among them, determining whether the access request to be recognized includes threat data based on the threat probability value includes: If the threat probability value is greater than a preset probability threshold, determine that the access request to be recognized includes threat data and issue an alarm notification; otherwise, determine that the access request to be recognized does not include threat data; Among them, the offline model is determined by the following method: According to the access request to be recognized, obtain the historical threat security events corresponding to the visitor identifier; Extract the historical threat intelligence information of the visitor corresponding to the visitor identifier through the historical threat security events; Perform Bayesian network probability graph training on the historical threat intelligence information to obtain an offline model.

2. The method according to claim 1, characterized in that, The online model is determined by the following method: Obtain each real-time security event stream in the request data; Obtain an online model according to each real-time security event stream.

3. The method according to claim 1, wherein If the threat probability value is greater than a preset probability threshold, determine that the access request to be recognized includes threat data and issue an alarm notification; Otherwise, after the step of determining that the access request to be recognized does not include threat data, the method further includes: If the access request to be recognized includes threat data, add the corresponding real-time threat intelligence information to the historical threat intelligence information.

4. An apparatus for automatically identifying threat data, characterized in that, Including: A request response module for obtaining an access request to be recognized; The access request to be recognized includes a visitor identifier and request data; An online identification module for identifying the request data through an online model to obtain an online identification result; A threat analysis module for processing the online identification result through an offline model to determine whether the access request to be recognized includes threat data; Among them, identifying the request data through an online model to obtain an online identification result includes: Real-time collect real-time threat intelligence information in the request data through an online model; Summarize all the real-time threat intelligence information and determine it as the online identification result; Among them, processing the online recognition result through an offline model to determine whether the access request to be recognized includes threat data includes: Analyzing the real-time threat intelligence information through the offline model to obtain the threat probability value of the visitor corresponding to the visitor identifier; Determining whether the access request to be recognized includes threat data based on the threat probability value; Among them, determining whether the access request to be recognized includes threat data based on the threat probability value includes: If the threat probability value is greater than a preset probability threshold, it is determined that the access request to be recognized includes threat data, and an alarm notification is sent; otherwise, it is determined that the access request to be recognized does not include threat data; Among them, the offline model is determined by the following method: According to the access request to be recognized, obtaining the historical threat security events corresponding to the visitor identifier; Extracting the historical threat intelligence information of the visitor corresponding to the visitor identifier through the historical threat security events; Performing Bayesian network probability graph training on the historical threat intelligence information to obtain an offline model.

5. A non-transitory computer-readable storage medium storing at least one instruction or at least one program segment, characterized in that, The at least one instruction or the at least one program is loaded and executed by a processor to implement the method according to any one of claims 1-3.

6. An electronic device, characterized in that, Including a processor and the non-transitory computer-readable storage medium according to claim 5.

Images