A method for generating APT attack templates based on network threat intelligence analysis

Abstract

The present invention discloses a method for generating APT attack templates based on network threat intelligence analysis. The method comprises parsing CTI reports to obtain attack instances; defining entity types, identifying and labeling entities in the attack instances according to the entity types, and using the labeled entities as tags to generalize word relationships in the attack instances to obtain relationship instances; obtaining multiple relationship instances based on multiple CTI reports, fusing the semantics of the words and tags to obtain a semantic representation of each relationship instance, clustering the relationship instances through a clustering operation, and obtaining attack templates from relationship instances belonging to the same category. The present invention can efficiently, automatically, and comprehensively extract effective and highly shareable attack templates from complex and similar CTI reports.

Description

Technical Field

[0001] The present invention belongs to the field of network security and deep learning technology, and specifically relates to a method for generating APT attack templates based on network threat intelligence analysis. Background Art

[0002] In recent years, APT attacks have garnered widespread attention. These attacks are planned, long-term, and persistent cyberattacks launched by malicious organizations against governments, large enterprises, and other organizations with the goal of stealing critical data. Cyber Threat Intelligence (CTI), used to describe attack context and guide attack detection, comes from a wide range of sources. Due to differences in writing habits, language, and focus among security professionals, CTI reports vary widely and contain errors. To more quickly respond to crises and predict attackers' next moves, defenders must analyze massive volumes of CTI reports. Therefore, an automated method is needed to supplement manual analysis of CTI reports and improve efficiency.

[0003] Currently, with the rapid development of natural language processing technology, analysts have successfully used this technology to extract attack behaviors related to threat indicators of compromise (IOCs) from threat reports. However, IOCs only account for a small part of a CTI report. This method ignores the importance of key entity connections and cannot fully restore the actual network attack chain. When applied to actual scenario detection, it may cause problems such as missed reports and false positives.

[0004] On the other hand, the open nature of CTI reports means that the intelligence information they can mine is also multi-source and heterogeneous, hindering its storage and sharing. This inevitably leads to multiple reports describing numerous identical attacks, reducing the efficiency of security professionals' analysis. Therefore, there is a lack of a method that combines consistency analysis with redundancy and deduplication to integrate and process these heterogeneous CTI reports, improve the inefficiency of their integrated analysis applications, and enhance their dissemination and sharing capabilities.

[0005] In response to the above problems, how to efficiently, automatically and comprehensively extract effective and shareable attack templates from complex and similar CTI reports is an urgent problem to be solved. Summary of the Invention

[0006] The purpose of the present invention is to provide an APT attack template generation method based on network threat intelligence analysis, which can efficiently, automatically and comprehensively extract effective and highly shareable attack templates from complex and similar CTI reports.

[0007] To achieve the above object, the technical solution adopted by the present invention is:

[0008] A method for generating an APT attack template based on network threat intelligence analysis, comprising:

[0009] Step 1: Parse the CTI report to obtain the attack instance;

[0010] Step 1.1: Filter non-attack statements in the CTI report.

[0011] Step 1.2: Convert the passive sentences in the attack sentences remaining after filtering into active sentences;

[0012] Step 1.3: Perform pronoun resolution and verb mapping on the attack statement obtained in step 1.2 to obtain the attack instance corresponding to the CTI report;

[0013] Step 2: Define entity types, identify and label entities in the attack instance according to the entity types, and use the labeled entities as markers to generalize the words in the attack instance to obtain relationship instances;

[0014] Step 3: Based on multiple CTI reports, multiple relationship instances are obtained. The semantics of words and tags are integrated to obtain the semantic representation of each relationship instance. The relationship instances are clustered through clustering operations, and attack templates are obtained from relationship instances belonging to the same category.

[0015] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution. They are merely further supplements or optimizations. Under the premise that there are no technical or logical contradictions, each optional method can be combined separately for the above-mentioned overall solution, or multiple optional methods can be combined.

[0016] Preferably, filtering non-attack statements in the CTI report includes:

[0017] Training language representation models;

[0018] The CTI report is input into the trained language representation model, and the language representation model is used to filter non-attack statements to obtain the remaining attack statements after filtering.

[0019] Preferably, the pronoun resolution includes: using a NeuralCoref pronoun resolution model to obtain pronoun mappings in all attack sentences, and replacing the pronouns in the attack sentences with the antecedent entities they refer to.

[0020] Preferably, the mapping relationship in the verb mapping is as follows:

[0021] The verbs cat, ls, net, ipconfig, tasklist, schtasks, query, and wmic in the attack statements are mapped to read; the verbs delete, drop, clean, remove, and pop are mapped to unlink; the verbs echo, copy, cp, scp, inject, push, mknod, and dump are mapped to write; the verbs call and start are mapped to exec; the verbs ping, mov, and nc–l are mapped to send; and the verbs kill and stop are mapped to exit.

[0022] Preferably, the entity type includes a custom entity type and an IOC entity type;

[0023] The custom entity types include attacker, process and file, which are respectively recorded as Attacker, Process and File; the IOC entity types include Vulnerability, MD5, Hash, IP, Registry and E-mail.

[0024] Preferably, identifying and labeling entities in the attack instance according to entity type includes:

[0025] For an attack instance, the regular matching method is used to identify the entities in the attack instance and label the IOC entity type to which they belong. The named entity recognition model is used to identify the entities in the attack instance and label the custom entity type to which they belong.

[0026] Preferably, the semantic representation of each relation instance obtained by fusing the semantics of the word and the tag bit includes:

[0027] For the word part in the relation instance, the GloVe model is used to output the word vector representation as the semantic representation of the word For the tag bit part in the relation instance, the BERT model is used to output the tag bit vector representation as the semantic representation of the tag bit.

[0028] Assign different semantic weights based on the frequency of words and tags to obtain the semantic representation of relation instances

[0029]

[0030]

[0031] Where, Represents a relation instance t x The semantic representation of w irepresents the i-th word, 1≤i≤m, Represents word w i The semantic representation of p(w i ) represents word w i In the relation instance t x The frequency of occurrence in m j Indicates the jth mark bit, 1≤j≤n, Indicates the mark bit m j The semantic representation of p(M j ) indicates the mark bit m j In the relation instance t x The frequency of occurrence in .

[0032] Preferably, the clustering relationship instance by clustering operation includes:

[0033] (1) Initialize each class to contain only one relationship instance;

[0034] (2) Calculate the Euclidean distance between the two classes and obtain the Euclidean distance matrix;

[0035] (3) Determine whether the Euclidean distance between the two classes meets the merging condition. If so, merge the two classes as a new class and add it to the Euclidean distance matrix. Delete the original two classes in the Euclidean distance matrix and proceed to the next step. If not, proceed directly to the next step.

[0036] (4) Determine whether the Euclidean distance between all classes has been determined. If so, proceed to the next step. Otherwise, take the two classes that have not been determined and execute step (3).

[0037] (5) Determine whether the preset iteration stop condition is met. If so, end and output the final class to complete the relationship instance clustering; otherwise, return to step (2) to continue execution.

[0038] Preferably, the calculating the Euclidean distance between two classes comprises:

[0039] If both classes contain only one relation instance, the Euclidean distance is calculated as follows:

[0040]

[0041] Where, d(t x , t y ) is the Euclidean distance between the two classes in the current case, Represents a relation instance t x The semantic representation of Represents a relation instance t y Semantic representation of

[0042] If one of the two classes contains only one relationship instance and the other class contains multiple relationship instances, the Euclidean distance is calculated as follows:

[0043]

[0044] Where, d(T x , t y ) is the Euclidean distance between the two classes in the current case, T x represents class x, Indicates T x The semantic representation of the i-th relation instance in T x The number of relation instances in

[0045] If both classes contain multiple relationship instances, the Euclidean distance is calculated as follows:

[0046]

[0047] Where, d(T x , T y ) is the Euclidean distance between the two classes in the current case, T y represents class y, Indicates T y The semantic representation of the jth relation instance in T y The number of relation instances in .

[0048] Preferably, the acquiring of the attack template from the relationship instances belonging to the same category includes:

[0049] For a class that contains only one relation instance, the relation instance in the class is used as an attack template;

[0050] For a class containing multiple relationship instances, a majority fusion algorithm is used to obtain the final attack template for the class. The majority fusion algorithm includes:

[0051] (1) Take the word part in the relation instance, and replace the word in the word part as the mark bit with the entity type to which the mark bit belongs according to the mark bit part;

[0052] (2) Initialize an empty sequence S and take the word part of each relation instance in a class as a sequence as input;

[0053] (3) Select the element e that appears the most times on the left of all input sequences and add it to the sequence S. If the number of times the elements on the left appear the most times is the same, select the element that appears first as element e and add it to the sequence S.

[0054] (4) Delete element e from the input sequence where it is located;

[0055] (5) Repeat steps (3) and (4) until all input sequences are empty, and use the final sequence S as the attack template for the current class.

[0056] The main benefits of this invention are: 1. APT network attack analysis based on network threat reports. By extracting attack-related knowledge from network threat reports, security professionals can better understand the decision-making process of threat actors. 2. A representation design based on attack template generation. By analyzing the similar attack semantics and attack sequence between a large number of attack instances, APT attack templates are generated from similar multi-source network threat intelligence to discover attack patterns and further explore potential attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a flow chart of the APT attack template generation method based on network threat intelligence analysis of the present invention;

[0058] Figure 2 The flowchart of the present invention is to generate an attack template according to a relationship instance. DETAILED DESCRIPTION

[0059] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0061] like Figure 1 As shown, this embodiment provides a method for generating an APT attack template based on network threat intelligence analysis, comprising the following steps:

[0062] Step 1: Parse the CTI report to obtain attack instances: Train a language representation model to filter non-attack-related sentences in the CTI report, and perform voice conversion and verb mapping based on this.

[0063] Step 1.1: Filter non-attack statements in CTI reports: Train the language representation model and annotate the collected CTI reports with labels for attack-related and non-related statements to build the corpus required for model training. The dataset label annotation format is<label\tab txt> , where label = 1 for attack-related statements and label = 0 for non-related statements. A deep bidirectional language representation model (BERT model is selected in this embodiment) is built and trained. The CTI report to be filtered is input into the trained language representation model. The language representation model is used to filter non-attack statements to obtain the remaining attack statements after filtering, i.e., the threat report.

[0064] Step 1.2, voice conversion: Use the POS tagging and DP tree functions provided by spaCy to determine the sentence components of the attack sentence, convert all filtered passive sentences into active sentences and perform subject recovery operations on subject-elliptic sentences.

[0065] Step 1.3, Pronoun Resolution and Verb Mapping: Pronouns are mapped and replaced with the antecedent entities they refer to using the NeuralCoref pronoun resolution model to achieve pronoun resolution. Verb mapping involves mapping the dependent verbs in the CTI report to verbs that can be reflected in the underlying system logs according to Table 1. This series of operations yields a relatively standardized attack instance.

[0066] Table 1 Verb mapping relationship table

[0067] Mapping Verbs Dependent verbs read cat, ls, net, ipconfig, tasklist, schtasks, query, wmic unlink delete, drop, clean, remove, pop, write echo, copy, cp, scp, inject, push, mknod, dump exec call、start、 send ping, mov, nc-l exit kill、stop

[0068] Step 2: Entity identification and attack instance generalization: Define entity types, identify and label entities in the attack instance according to the entity types, and use the labeled entities as markers to generalize the words in the attack instance to obtain relationship instances.

[0069] Step 2.1, Entity Type Definition: The entities in the CTI report include open-source IOC entity types such as Vulnerability, MD5, Hash, IP, Registry, and Email. In addition, it also includes some attack-related entities without fixed types. In addition to the open-source IOC entity types, this embodiment also provides custom entity types: Attacker, Process, and File for the purpose of subsequent template extraction.

[0070] Step 2.2, Entity Type Identification and Labeling: Use regular expressions to identify the open source IOC entity types in the attack instance, such as the regular expression rules defined in Table 2, to extract them and assign them to corresponding types; for the sub-defined entity types in Step 2.1, use a learning-based named entity recognition (NER) model, such as BERT-BiLSTM-CRF, to identify them and label their types. This model has been pre-trained on a large general corpus and technical examples from MITRE ATT&CK.

[0071] That is, for the same attack instance, the regular matching method is first used to identify the entities in the attack instance and mark the IOC entity type to which they belong. Then, the named entity recognition model is used to identify the entities in the attack instance and mark the custom entity type to which they belong.

[0072] Table 2 Regular expression rule definition

[0073]

[0074]

[0075] Step 2.3, Attack Instance Generalization: Select the entities identified in the attack instance in (2-2) as markers, and treat each word in the attack instance as a word, to obtain the relation instance shown in Formula 1. In actual dataset representation, a relation instance obtained from processing a CTI report can be treated as a large dictionary, depending on the task requirements. The dictionary keys can be sentences, ner, etc. Sentences contains a list of sentences, each consisting of multiple words, and ner can contain the markers (entities) in the sentence. Therefore, a relation instance contains m words and n markers, arranged in the order of their appearance in the text, ensuring the authenticity of each link in the attack kill chain in the instance.

[0076] t x ={"sentences":[[w1,...,w i ],...,[w j ,...,w m ]], "ner": [M1,...,M n ]}(1)

[0077] Where, [w1, ..., w i ] as a list of sentences, w i is the relation instance t x The i-th word, w j is the relation instance t x The jth word, M nis the relation instance t x The nth mark bit of .

[0078] Step 3: Extract attack templates based on deep semantic computing: Based on multiple CTI reports, multiple relationship instances are obtained. The semantics of words and tags are integrated to obtain the semantic representation of each relationship instance. The relationship instances are clustered through clustering operations, and attack templates are obtained from relationship instances that belong to the same category (i.e., have similar semantics). Figure 2 The specific process is as follows.

[0079] Step 3.1, relation instance semantic calculation: design a relation instance semantic calculation method that combines word and tag information. The semantic calculation of the word part uses GloVe output word vector to obtain the word semantic representation. Use the output of BERT to obtain the semantic representation of the tag bit part As shown in formula 2. Finally, different semantic weights are assigned according to the word frequency of words and tag positions, as shown in formula 3, and finally the semantic representation of the relation instance is obtained.

[0080]

[0081]

[0082] Where, Represents a relation instance t x The semantic representation of w i represents the i-th word, 1≤i≤m, Represents word w i The semantic representation of p(w i ) represents word w i In the relation instance t x The frequency of occurrence in m j Indicates the jth mark bit, 1≤j≤n, Indicates the mark bit m j The semantic representation of p(M j ) indicates the mark bit m j In the relation instance t x The frequency of occurrence in .

[0083] Step 3.1, Relationship instance clustering: Based on the semantic representation obtained in (3-1), a divisive hierarchical clustering method is used to group semantically similar instances into one category. The specific algorithm is described as follows:

[0084] (1) Initialize each class to contain only one relationship instance: Construct N classes, each of which contains only one relationship instance.

[0085] (2) Calculate the Euclidean distance between the two classes and obtain the Euclidean distance matrix. According to the number of relationship instances contained in the class, the Euclidean distance between the two classes is calculated as follows:

[0086] If both classes contain only one relation instance, the Euclidean distance is calculated as follows:

[0087]

[0088] Where, d(t x , t y ) is the Euclidean distance between the two classes in the current case, Represents a relation instance t x The semantic representation of Represents a relation instance t y Semantic representation of

[0089] If one of the two classes contains only one relationship instance and the other class contains multiple relationship instances, the Euclidean distance is calculated as follows:

[0090]

[0091] Where, d(T x , t y ) is the Euclidean distance between the two classes in the current case, T x represents class x, Indicates T x The semantic representation of the i-th relation instance in T x The number of relation instances in

[0092] If both classes contain multiple relationship instances, the Euclidean distance is calculated as follows:

[0093]

[0094] Where, d(T x , T y ) is the Euclidean distance between the two classes in the current case, T y represents class y, Indicates T y The semantic representation of the jth relation instance in T y The number of relation instances in .

[0095] When calculating for the first time, since each class contains only one relationship instance, an N*N dimensional Euclidean distance matrix can be obtained.

[0096] (3) According to the merging rule (for example, merging the two classes with the smallest distance values), determine whether the Euclidean distance between the two classes meets the merging conditions. If so, merge the two classes as a new class and add it to the Euclidean distance matrix. Delete the original two classes in the Euclidean distance matrix to update the Euclidean distance matrix and execute the next step. If not, execute the next step directly.

[0097] (4) Determine whether the Euclidean distance judgment between all classes is completed. If it is completed, proceed to the next step; otherwise, take the two classes that have not been judged and execute step (3).

[0098] (5) Determine whether the preset iterative stopping condition is met (for example, the number of split categories reaches the set threshold). If so, end and output the final class to complete the relationship instance clustering; otherwise, return to step (2) to continue execution.

[0099] Step 3.3, attack template acquisition: After obtaining the clustering results, the relationship instance in the class containing only a single relationship instance is regarded as an attack template. For the class with more than 1 relationship instances, the majority fusion algorithm is used to approximate the final attack template of the category.

[0100] In the current application scenario, each relation instance is considered as a character sequence, and each word in it is considered as a whole for comparison. The specific algorithm is as follows:

[0101] (1) Take the word part in the relation instance, and replace the word in the word part that serves as the mark bit with the entity type to which the mark bit belongs according to the mark bit part.

[0102] (2) Initialize an empty sequence S and take the word part of each relation instance in a class as a sequence as input.

[0103] (3) Select the element e that appears the most times on the left of all input sequences and add it to the sequence S. If the number of times the elements on the left appear the most times is the same, then select the element that appears first (for example, according to the order of the relationship instances in the class) as element e and add it to the sequence S.

[0104] (4) Delete element e from the input sequence where it is located.

[0105] (5) Repeat steps (3) and (4) until all input sequences are empty, and use the final sequence S as the attack template for the current class. It should be noted that the final template may not be a standard sentence expression, but the dependency relationship between the entities in it reflects the similar structure of the relationship instances in the category to a certain extent. Table 3 shows an example of obtaining an attack template.

[0106] Table 3 Example of obtaining attack template

[0107]

[0108] It should be noted that the subscripts in the relationship instances in Table 3 are only for the convenience of observing the entities and the entity types to which they belong. There are no subscripts in the actual relationship instance expressions. According to the relationship instances in the table, after executing step (1), the two relationship instances become Attacker may attempt to write the contents of File and File to enable offline password cracking and Attacker for files being accessed that may attempt to write the contents of File and File to enable offline password cracking. Then compare the leftmost elements of the two relationship instances. The first element of both is Attacker. Therefore, Attacker is added to sequence S and Attacker is deleted, so that the relationship instances become may attempt to write the contents of File and File to enable offline password cracking and for files being accessed that may attempt to write the contents of File and File to enable offline password cracking.

[0109] Then, we continue to compare the leftmost elements of the two relationship instances. Since the current leftmost elements are may and for, and they both appear once, we take the element that appears first, may, and add it to sequence S. We delete may from the first relationship instance and continue to compare the leftmost elements of the two relationship instances. The final elements added to sequence S are Attacker mayattempt to write the contents of File and File to enable offline password cracking. Therefore, we use this as the final attack template.

[0110] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0111] The above-described embodiments merely illustrate several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that a person skilled in the art would be able to make numerous modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A method for generating APT attack templates based on network threat intelligence analysis, characterized in that: The APT attack template generation method based on network threat intelligence analysis includes: Step 1: Parse the CTI report to obtain the attack instance; Step 1.1: Filter non-attack statements in the CTI report. Step 1.2: Convert the passive sentences in the attack sentences remaining after filtering into active sentences; Step 1.3: Perform pronoun resolution and verb mapping on the attack statement obtained in step 1.2 to obtain the attack instance corresponding to the CTI report; Step 2: Define entity types, identify and label entities in the attack instance according to the entity types, and use the labeled entities as markers to generalize the words in the attack instance to obtain relationship instances; Step 3: Based on multiple CTI reports, multiple relation instances are obtained. The semantics of words and tags are integrated to obtain the semantic representation of each relation instance. The relation instances are clustered through clustering operations, and attack templates are obtained from relation instances belonging to the same category. The semantic representation of each relation instance obtained by fusing the semantics of the word and the tag bit includes: For the word part in the relation instance, the GloVe model is used to output the word vector representation as the semantic representation of the word For the tag bit part in the relation instance, the BERT model is used to output the tag bit vector representation as the semantic representation of the tag bit. ; Assign different semantic weights based on the frequency of words and tags to obtain the semantic representation of relation instances : ； ； Where, Representing a relationship instance The semantic representation of Indicates the words, , Representing words The semantic representation of Representing words In the relationship instance The frequency of occurrence in Indicates the Marker bits, , Indicates the mark bit The semantic representation of Indicates the mark bit In the relationship instance The frequency of occurrence in .

2. The APT attack template generation method based on network threat intelligence analysis according to claim 1, characterized in that: Filtering non-attack statements in the CTI report includes: Training language representation models; The CTI report is input into the trained language representation model, and the language representation model is used to filter non-attack statements to obtain the remaining attack statements after filtering.

3. The APT attack template generation method based on network threat intelligence analysis according to claim 1, characterized in that: The pronoun resolution includes: using the NeuralCoref pronoun resolution model to obtain pronoun mappings in all attack sentences, and replacing the pronouns in the attack sentences with the antecedent entities they refer to.

4. The method for generating an APT attack template based on network threat intelligence analysis according to claim 1, wherein: The mapping relationship in the verb mapping is as follows: The verbs cat, ls, net, ipconfig, tasklist, schtasks, query, and wmic in the attack statements are mapped to read; the verbs delete, drop, clean, remove, and pop are mapped to unlink; the verbs echo, copy, cp, scp, inject, push, mknod, and dump are mapped to write; the verbs call and start are mapped to exec; the verbs ping, mov, and nc –l are mapped to send; and the verbs kill and stop are mapped to exit.

5. The method for generating an APT attack template based on network threat intelligence analysis according to claim 1, wherein: The entity types include custom entity types and IOC entity types; The custom entity types include attacker, process and file, which are respectively recorded as Attacker, Process and File; the IOC entity types include Vulnerability, MD5, Hash, IP, Registry and E-mail.

6. The method for generating an APT attack template based on network threat intelligence analysis according to claim 5, wherein: Identify and label entities in the attack instance based on entity type, including: For an attack instance, the regular matching method is used to identify the entities in the attack instance and label the IOC entity type to which they belong. The named entity recognition model is used to identify the entities in the attack instance and label the custom entity type to which they belong.

7. The method for generating an APT attack template based on network threat intelligence analysis according to claim 1, wherein: The clustering relationship instance by clustering operation includes: (1) Initialize each class to contain only one relationship instance; (2) Calculate the Euclidean distance between the two classes and obtain the Euclidean distance matrix; (3) Determine whether the Euclidean distance between the two classes meets the merging condition. If so, merge the two classes as a new class and add it to the Euclidean distance matrix. Delete the original two classes in the Euclidean distance matrix and proceed to the next step. If not, proceed directly to the next step. (4) Determine whether the Euclidean distance between all classes has been determined. If so, proceed to the next step. Otherwise, take the two classes that have not been determined and execute step (3). (5) Determine whether the preset iteration stop condition is met. If so, end and output the final class to complete the relationship instance clustering; otherwise, return to step (2) to continue execution.

8. The method for generating an APT attack template based on network threat intelligence analysis according to claim 7, wherein: The calculation of the Euclidean distance between two classes includes: If both classes contain only one relation instance, the Euclidean distance is calculated as follows: ； Where, is the Euclidean distance between the two classes in the current case, Representing a relationship instance The semantic representation of Representing a relationship instance Semantic representation of If one of the two classes contains only one relationship instance and the other class contains multiple relationship instances, the Euclidean distance is calculated as follows: ； Where, is the Euclidean distance between the two classes in the current case, Representation Class , express Middle The semantic representation of a relation instance, for The number of relation instances in If both classes contain multiple relationship instances, the Euclidean distance is calculated as follows: ； Where, is the Euclidean distance between the two classes in the current case, Representation Class , express Middle The semantic representation of a relation instance, for The number of relation instances in .

9. The method for generating an APT attack template based on network threat intelligence analysis according to claim 1, wherein: The acquiring of attack templates from relation instances belonging to the same category includes: For a class that contains only one relation instance, the relation instance in the class is used as an attack template; For a class containing multiple relationship instances, a majority fusion algorithm is used to obtain the final attack template of the class. The majority fusion algorithm includes: (1) Take the word part in the relation instance, and replace the word in the word part as the mark bit with the entity type to which the mark bit belongs according to the mark bit part; (2) Initialize an empty sequence , takes the word part of each relation instance in a class as a sequence as input; (3) Select the element that appears most times on the left side of all input sequences Add to sequence If the number of times the leftmost element appears the same, the element that appears first is selected as the element Add to sequence middle; (4) The elements Remove it from the input sequence; (5) Repeat steps (3) and (4) until all input sequences are empty, and the final sequence Serves as an attack template for the current class.

Images