A twitter-based exploit intelligence awareness and extraction method

Abstract

The application discloses a Twitter-based vulnerability exploitation intelligence perception and extraction method, which comprises the following steps: acquiring a Twitter list containing CTI expert users as an initial set through input of the CTI expert users; calculating user scores to obtain a set of CTI expert users; acquiring tweets of the CTI expert users by using a Twitter API and extracting structured information, and judging whether the tweets contain vulnerability exploitation intelligence; judging whether the tweets contain vulnerability exploitation intelligence by using ChatGPT and extracting entity information from the tweets; extracting vulnerability information, vulnerability exploitation information and software asset information from the tweet text data related to vulnerability intelligence by using three different prompts; refining complete structured vulnerability intelligence by applying a prompt optimization strategy; and using the tweets containing vulnerability exploitation intelligence to find new CTI-related Twitter lists. The new Twitter lists are merged with existing Twitter lists, and Twitter list and user scores are recalculated to update the set of CTI expert users. The method can perceive vulnerability exploitation intelligence in time and has high accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security and data mining, and particularly relates to a vulnerability exploitation intelligence acquisition method based on Twitter List. BACKGROUND

[0002] With the continuous expansion of the scale of Internet application, the number of vulnerabilities presents an explosive growth, and the vulnerability is one of the fundamental reasons for causing many security attacks. A small vulnerability (such as Log4j remote code execution vulnerability) can be enough to cause an earthquake in the entire software supply chain, and even threaten the security of critical information infrastructure. Timely perception and understanding of vulnerability intelligence, and rapid response and repair are the key to ensuring the security of software systems. However, the current vulnerability perception mode relying on the disclosure of NVD and other public vulnerability databases has great limitations. On the one hand, only relying on NVD and other public vulnerability databases to perceive vulnerability information has serious lag. Therefore, it is of great significance to obtain vulnerability exploitation intelligence from multiple sources in a timely manner.

[0003] Twitter is one of the important sources of vulnerability intelligence disclosure. Twitter has a large and diverse user group, and scholars often share information, media and resources on Twitter. Network security practitioners and network security enthusiasts and even hacker groups also communicate on Twitter. Studies have shown that the release time of some tweets disclosing vulnerability information is earlier than the release time of the corresponding vulnerability in CVE, and the disclosure time interval ranges from 1 day to 148 days, and the vulnerability damage ranges from medium 4.9 points to 9.9 points according to the CVSS score. As can be seen, the security-related data obtained from Twitter has both high accessibility and timeliness.

[0004] However, extracting exploit intelligence from Twitter faces challenges. First, Twitter is a high-traffic social media platform, with an average of 500 million tweets posted daily, or 3,500 tweets per minute. However, only a small percentage of these tweets are related to security intelligence. Extracting exploit intelligence from Twitter requires significant resources for tweet filtering, and it's crucial to avoid screening all tweets on the platform to improve efficiency. Second, Twitter's hashtag feature can filter out security-related tweets. Tweets are typically tagged with "#topic," such as "#CVE" or "#vulnerability," which can be used to find security-related tweets. However, not all hashtags are accurate. Furthermore, only about 50% of CTI-related tweets have security-related hashtags, and the accuracy of these hashtags is relatively low. Therefore, a more effective method for extracting exploit intelligence from Twitter needs to be designed. Finally, tweets are often unstructured text. Due to the length limit of Twitter posts, tweets generally do not contain vulnerability details or POC-related descriptions. This information often needs to be obtained from the URL linked in the tweet and further structured to extract the structured information describing the vulnerability exploitation, including vulnerability ID, vulnerability type, software, software version, vendor, POC, etc. Summary of the Invention

[0005] To address the issue that existing CTI-related tweets rarely include security-related subject tags, and those that do have subject tags have low accuracy, this invention proposes a Twitter-based vulnerability exploitation intelligence perception and extraction method. This method can effectively obtain vulnerability exploitation intelligence from Twitter. This invention is implemented through the following technical solutions.

[0006] A method for detecting and extracting vulnerability exploitation intelligence based on Twitter, characterized by the following steps:

[0007] Step 1) Using several CTI expert users as input, use the Twitter API to obtain a Twitter List containing these users as the initial Twitter List set;

[0008] Step 2) Calculate the Twitter List rating and the user ratings contained in the Twitter List, and filter to obtain a set of CTI expert users;

[0009] Step 3) Use the Twitter API to obtain tweets posted by CTI expert users, and extract structured information from the tweets based on the text of the tweets and the external web pages linked to the tweets to determine whether the tweets contain vulnerability exploitation intelligence.

[0010] Step 4) Use ChatGPT to determine whether the tweets obtained in Step 3) contain exploit intelligence. For relevant tweets, ChatGPT will be used to extract entity information.

[0011] Step 5) Extract vulnerability information, exploitation information, and software asset information from the tweet text data related to vulnerability intelligence using three different types of prompts;

[0012] Step 6) Combine the prompt engineering method with the prompt optimization strategy to optimize the original prompt and further extract complete structured vulnerability intelligence from text data and code data;

[0013] Step 7) Tweets containing exploit intelligence will be used to find new CTI-related Twitter lists;

[0014] Step 8) Merge the new Twitter List with the existing Twitter List and recalculate the Twitter List and user ratings to update the CTI expert user set.

[0015] The aforementioned Twitter-based vulnerability exploitation intelligence detection and extraction method is characterized in that step 2) of obtaining the set of CTI expert users by calculating user ratings specifically includes the following steps:

[0016] Step 21) Calculate a score for each Twitter List, taking into account descriptive relevance metrics, tweet relevance metrics, popularity metrics, comprehensiveness metrics, and the credibility metrics of the Twitter List owner.

[0017] Step 22) Filter out the Twitter Lists with high scores based on their ratings;

[0018] Step 23) Extract the users included in the selected high-scoring Twitter List and calculate the score for each user, which includes user list metrics, user tweet metrics, and user real-time metrics.

[0019] Step 24) Based on the user scores calculated in Step 23), select users with high scores as CTI expert users.

[0020] The aforementioned Twitter-based vulnerability exploitation intelligence detection and extraction method is characterized in that step 2) of obtaining the ranking of important nodes in the graph using a quantitative index algorithm includes the following steps:

[0021] Step 61) further extract vulnerability intelligence related entities using ChatGPT in combination with the vulnerability type modification prompt obtained after the extraction of vulnerability itself information in step 5);

[0022] Step 62) further extract vulnerability intelligence related entities from the vulnerability code or exploit code obtained after the extraction of vulnerability itself information and exploit information using the prompt in step 5) using ChatGPT.

[0023] The present application adopts the above technical solution and has the following beneficial effects:

[0024] (1) The method first dynamically identifies and adds CTI expert users based on TwitterList and user historical tweets, achieving incremental Twitter vulnerability intelligence source collection. This method does not rely on public vulnerability databases, so it can avoid related policy risks and lag problems.

[0025] (2) The method determines whether the tweet contains vulnerability intelligence by analyzing the tweet text and external links contained in the tweet, and then uses a large language model and a prompt to extract structured vulnerability intelligence. This method makes the timeliness of vulnerability perception within 24 hours, the accuracy of vulnerability perception above 93%, and the accuracy of structured extraction above 90%.

[0026] (3) The present application proposes a new method for evaluating Twitter List and CTI expert users. This method uses multiple related indicators and combines real-time data obtained from Twitter API to effectively find Twitter List and CTI expert users related to vulnerability intelligence.

[0027] (4) The method uses a large language model ChatGPT to filter and extract vulnerability intelligence, which can effectively reduce the cost of data labeling and model training, improve the detection speed of vulnerability intelligence, and further improve the accuracy of structured vulnerability intelligence extraction and refinement by optimizing the prompt.

[0028] (5) The present application has been verified by large-scale experimental evaluation, and has strong practical value and broad application prospects. At the same time, the structured vulnerability intelligence obtained can be directly converted into STIX2 format, which is convenient for importing into OpenCTI system to realize further analysis and processing of vulnerability intelligence. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 The figure is the overall flowchart of the vulnerability intelligence perception and extraction method based on Twitter of the embodiments of the present application.

[0030] Figure 2 The schematic diagram of the key part pseudo code of the Twitter-based exploit intelligence perception and extraction method of the embodiment of the application.

[0031] Figure 3 The system architecture diagram of the Twitter-based exploit intelligence perception and extraction method of the embodiment of the application. DETAILED DESCRIPTION

[0032] The application will be further described in detail below in combination with the drawings and specific embodiments.

[0033] The application proposes a Twitter-based exploit intelligence perception and extraction method, which is a method for perceiving and extracting exploit intelligence by using the Twitter platform. The method first identifies and adds CTI expert users based on Twitter List and the historical tweets published by users, realizes incremental Twitter vulnerability intelligence source collection; then judges whether the tweet contains exploit intelligence by analyzing the tweet text and the external link contained in the tweet; finally, uses a large language model and Prompt refinement technology to extract exploit intelligence into structured data. As shown in Figure 1 and Figure 2 Figure 1 is the overall flowchart of the Twitter-based exploit intelligence perception and extraction method of the embodiment of the application, Figure 2 is the formal pseudo code description of the overall flow of the Twitter-based exploit intelligence perception and extraction method of the embodiment of the application, and the method specifically includes the following steps:

[0034] Step 1) Take several CTI expert users U as input, and use Twitter API to obtain the Twitter List containing these users as the initial Twitter List set L.

[0035] Step 2) Calculate the score of the Twitter List and the score of the users contained in the Twitter List based on the description correlation index, the tweet correlation index, the popularity index, the comprehensiveness index and the credibility index of the Twitter List owner, and screen to obtain a set of CTI expert users. The specific implementation process includes the following steps:

[0036] Step 21) Define a set of regular expressions closely related to CTI, which is used to measure the correlation between the description of a given Twitter List and CTI.

[0037] ​Step 22) Score the user based on the Twitter List the user belongs to and the past tweets the user has posted.

[0038] Step 23) Define the comprehensive score of a Twitter List as the sum of all Twitter List indicators divided by their average values.

[0039] Step 3) Use the Twitter API to obtain the tweets T posted by the CTI expert user, and extract structured information from the tweets based on the text of the tweets and the external web pages linked by the tweets to determine whether the tweets contain exploit intelligence.

[0040] Step 4) Use the rule-based method and ChatGPT based on large language models to determine whether the tweets obtained in step 3) contain exploit intelligence. For relevant tweets, use ChatGPT to extract entity information.

[0041] Step 5) Use three different prompts to extract vulnerability information, exploit information, and software asset information from the Twitter text data T2 related to vulnerability intelligence.

[0042] Step 6) Combine the prompt optimization strategy to optimize the original prompt and further extract complete structured vulnerability intelligence from the text data and code data. Convert the structured vulnerability intelligence obtained into STIX format and import it into the OpenCTI system. The OpenCTI system architecture is as follows Figure 3 OpenCTI is an open-source platform that allows organizations to manage their network threat intelligence knowledge and observable data.

[0043] Step 7) Tweets containing exploit intelligence will be used to find new CTI-related Twitter Lists Lt.

[0044] Step 8) Merge the new Twitter List with the existing Twitter List and recalculate the Twitter List and user scores to update the CTI expert user set.

[0045] The above only describes the preferred embodiments of the present application, but the specific embodiments described herein are only used to explain the present application and do not limit the present application. Any skilled person in the art can make any simple modification, equivalent change and modification to the above embodiments without departing from the principles and spirits of the present application according to the technical essence of the present application, which should be included in the protection scope of the present application.

Claims

1. A Twitter-based exploit intelligence awareness and extraction method, characterized in that, The method comprises the following steps: Step 1) using Twitter API to obtain Twitter Lists containing several CTI expert users as the initial Twitter List set; Step 2) calculating the scores of Twitter Lists and the scores of users contained in the Twitter Lists to obtain a set of CTI expert users; Step 3) using Twitter API to obtain tweets published by the CTI expert users, and extracting structured information from the tweets according to the texts of the tweets and external web pages linked by the tweets to determine whether the tweets contain exploit intelligence; Step 4) using ChatGPT to determine whether the tweets obtained in step 3) contain exploit intelligence, and using ChatGPT to extract entity information from relevant tweets; Step 5) using three different prompts to extract vulnerability information, exploit information and software asset information from the tweet text data related to vulnerability intelligence; Step 6) applying prompt optimization strategies to optimize the original prompts and further refining complete structured vulnerability intelligence from text data and code data by combining the prompt engineering method; Step 7) tweets containing exploit intelligence will be used to find new CTI-related Twitter Lists; Step 8) merging new Twitter Lists with existing Twitter Lists and recalculating the scores of Twitter Lists and users to update the set of CTI expert users.

2. The Twitter based exploit intelligence awareness and extraction method of claim 1, wherein, The specific implementation process of step 2) for obtaining the set of CTI expert users by calculating user scores comprises the following steps: Step 21) calculating the score of each Twitter List, considering the relevance index, tweet relevance index, popularity index, comprehensiveness index and credibility index of the Twitter List owner; Step 22) selecting high-score Twitter Lists according to the scores of the Twitter Lists; Step 23) extracting the users contained in the selected high-score Twitter Lists, calculating the score of each user, which includes the user list index, the user tweet index and the user real-time index; Step 24) selecting high-score users as CTI expert users according to the scores of the users calculated in step 23).

3. The Twitter based exploit intelligence awareness and extraction method of claim 1, wherein, The specific implementation process of step 2) for obtaining the ranking of important nodes in the graph using the quantity index algorithm comprises the following steps: Step 61) modifying the prompt by combining the vulnerability type obtained after extracting vulnerability information in step 5), and further extracting exploit intelligence-related entities using ChatGPT; Step 62) using ChatGPT to further extract exploit intelligence-related entities from the vulnerability code or exploit code obtained after extracting vulnerability information and exploit information using prompts in step 5).

Images