Threat intelligence trust analysis system and method based on machine learning

Abstract

The present application relates to the field of intelligent analysis technology, and specifically discloses a threat intelligence trust analysis system and method based on machine learning, which first builds a network threat intelligence library containing the latest malware means, attack patterns, malicious domain names, malicious websites, and malicious IP addresses, extracts contextual semantic association features of the intelligence to be analyzed through deep learning technology, and compares and analyzes the contextual semantic association features of the intelligence to be analyzed with the features of the network threat intelligence library to determine whether the intelligence to be analyzed is trustworthy. In this way, the collected intelligence can be automatically analyzed for credibility, thereby helping security teams or analysts to better understand threat intelligence and take corresponding response measures in a timely manner.

Description

Technical Field

[0001] The present application relates to the field of intelligent analysis technology, and more specifically, to a threat intelligence trusted analysis system and method based on machine learning. Background Art

[0002] In recent years, with the continuous development of information technology and the development of network security technology, whether it is the emergence of new network forms such as 5G communication and the Internet of Things, or the emergence of new service models represented by online social networks, while providing convenience to people, it also continues to show the characteristics of openness, heterogeneity, mobility and credibility. However, while enjoying these services, the Internet also makes people face huge losses and harm caused by illegal network penetration.

[0003] In the field of network security, the analysis and identification of threat intelligence is one of the important means to prevent and respond to network attacks. However, due to the complexity of information, existing threat intelligence analysis methods generally have problems such as insufficient identification accuracy, and there is no effective analysis method for threat intelligence in the field of network security.

[0004] Therefore, a threat intelligence trusted analysis system and method based on machine learning is expected. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a threat intelligence trust analysis system and method based on machine learning, which first constructs a network threat intelligence library containing the latest malware means, attack patterns, malicious domain names, malicious websites, and malicious IP addresses, and extracts contextual semantic association features of the intelligence to be analyzed through deep learning technology, and compares the contextual semantic association features of the intelligence to be analyzed with the features of the network threat intelligence library to determine whether the intelligence to be analyzed is credible. In this way, the collected intelligence can be automatically analyzed for credibility, thereby helping security teams or analysts to better understand threat intelligence and take corresponding response measures in a timely manner.

[0006] Accordingly, according to one aspect of the present application, a threat intelligence trust analysis system based on machine learning is provided, which includes:

[0007] An intelligence acquisition module is used to build a network threat intelligence library and obtain intelligence to be analyzed, wherein the network threat intelligence library contains the latest malware methods, attack patterns, malicious domain names, malicious websites, and malicious IP addresses;

[0008] A semantic understanding module for the intelligence to be analyzed, used for passing the intelligence to be analyzed through a context encoder including an embedding layer to obtain a plurality of intelligence semantic feature vectors;

[0009] A Gaussian fusion module, used for fusing the plurality of intelligence semantic feature vectors based on a Gaussian density map to obtain an intelligence context semantic association feature matrix;

[0010] A multi-scale semantic association feature extraction module, used for passing the intelligence context semantic association feature matrix through a convolutional neural network model including multiple hybrid convolutional layers to obtain a multi-scale intelligence semantic association feature matrix;

[0011] A network threat intelligence feature matrix construction module, used to generate a network threat intelligence feature matrix based on the network threat intelligence library;

[0012] A comparative analysis module, used for performing feature engineering parameterization fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix to obtain a classification feature matrix;

[0013] The analysis result generation module is used to pass the classification feature matrix through a classifier to obtain a classification result, and the classification result is used to represent the probability value of the credibility of the intelligence to be analyzed.

[0014] In the above-mentioned threat intelligence trusted analysis system based on machine learning, the semantic understanding module of the intelligence to be analyzed includes: a word segmentation unit, which is used to perform word segmentation on the intelligence to be analyzed to obtain multiple intelligence data items; an embedding unit, which is used to use the learnable embedding matrix of the word embedding layer to perform word embedding encoding on the text data of each intelligence data item in the multiple intelligence data items to obtain multiple word embedding vectors; a data integration unit, which is used to add the numerical data of each intelligence data item in the multiple intelligence data items to the tail of each word embedding vector to obtain multiple intelligence embedding vectors; a context encoding unit, which is used to use the converter-based Bert model of the context encoder to perform global context semantic encoding on the multiple intelligence embedding vectors to obtain multiple intelligence semantic feature vectors.

[0015] In the above-mentioned threat intelligence trusted analysis system based on machine learning, the context encoding unit includes: a one-dimensional arrangement subunit, which is used to arrange the multiple intelligence embedding vectors in one dimension to obtain an intelligence global embedding vector; a self-attention generation subunit, which is used to calculate the product between the intelligence global embedding vector and the transposed vector of each intelligence embedding vector in the multiple intelligence embedding vectors to obtain multiple self-attention association matrices; a standardized self-attention subunit, which is used to standardize each self-attention association matrix in the multiple self-attention association matrices to obtain multiple standardized self-attention association matrices; a weight generation subunit, which is used to pass each standardized self-attention association matrix in the multiple standardized self-attention association matrices through an activation function to obtain multiple probability values; a weight application subunit, which is used to weight each intelligence embedding vector in the multiple intelligence embedding vectors with each probability value in the multiple probability values ​​as a weight to obtain the multiple intelligence semantic feature vectors.

[0016] In the above-mentioned threat intelligence trusted analysis system based on machine learning, the Gaussian fusion module includes: a Gaussian density map construction unit, which is used to construct the Gaussian density map of the multiple intelligence semantic feature vectors using the following fusion formula; wherein the fusion formula is: Wherein, μ represents the positional mean vector between the plurality of intelligence semantic feature vectors, and the value of each position of σ represents the variance between the feature values ​​at each position in the plurality of intelligence semantic feature vectors, represents the Gaussian density probability function, x represents the variable of the Gaussian density map; a Gaussian discretization unit is used to discretize the Gaussian distribution of each position of the Gaussian density map to obtain the intelligence context semantic association feature matrix.

[0017] In the above-mentioned threat intelligence trusted analysis system based on machine learning, each hybrid convolution layer of the convolutional neural network model includes a parallel first convolution branch structure, a second convolution branch structure, a third convolution branch structure and a fourth convolution branch structure, and a multi-scale fusion structure connected to the first to fourth convolution branch structures, wherein the first convolution branch uses a first convolution kernel having a first size, the second convolution branch uses a second convolution kernel having a first size and a first void ratio, the third convolution branch uses a third convolution kernel having a first size and a second void ratio, and the fourth convolution branch uses a fourth convolution kernel having a first size and a third void ratio.

[0018] In the above-mentioned threat intelligence trusted analysis system based on machine learning, the multi-scale semantic association feature extraction module is used to: use each mixed convolution layer of the convolutional neural network model to respectively perform the following on the input data in the forward pass of the layer: perform multi-scale convolution encoding on the input data to obtain a multi-scale convolution feature map; perform pooling processing on the multi-scale convolution feature map along the channel dimension to generate a pooling feature map; perform nonlinear activation processing on the pooling feature map to generate an activation feature map; wherein the output of the last layer of the convolutional neural network model including multiple mixed convolution layers is the multi-scale intelligence semantic association feature matrix.

[0019] In the above-mentioned threat intelligence trust analysis system based on machine learning, the comparative analysis module is used to: perform feature engineering parameterization fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix to obtain a classification feature matrix using the following fusion formula; wherein the fusion formula is:

[0020]

[0021] Wherein, M1 represents the multi-scale intelligence semantic association feature matrix, M2 represents the network threat intelligence feature matrix, represents the mean matrix between the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix, exp(·) represents the exponential operation of the matrix, log represents the logarithmic function value with base 2, represents the positional addition of matrices, Represents the positional subtraction of matrices, M c Represents the classification feature matrix.

[0022] According to another aspect of the present application, a threat intelligence trust analysis method based on machine learning is provided, which includes:

[0023] Building a network threat intelligence library and obtaining intelligence to be analyzed, wherein the network threat intelligence library contains the latest malware methods, attack patterns, malicious domain names, malicious websites, and malicious IP addresses;

[0024] Passing the intelligence to be analyzed through a context encoder including an embedding layer to obtain a plurality of intelligence semantic feature vectors;

[0025] Based on the Gaussian density map, the plurality of intelligence semantic feature vectors are fused to obtain an intelligence context semantic association feature matrix;

[0026] Passing the intelligence context semantic association feature matrix through a convolutional neural network model including multiple hybrid convolutional layers to obtain a multi-scale intelligence semantic association feature matrix;

[0027] Generate a network threat intelligence feature matrix based on the network threat intelligence library;

[0028] Performing feature engineering parameterization fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix to obtain a classification feature matrix;

[0029] The classification feature matrix is ​​passed through a classifier to obtain a classification result, and the classification result is used to represent the probability value of the credibility of the intelligence to be analyzed.

[0030] Compared with the prior art, the machine learning-based threat intelligence trust analysis system and method provided by this application first builds a network threat intelligence library containing the latest malware methods, attack patterns, malicious domain names, malicious websites, and malicious IP addresses, extracts contextual semantic association features of the intelligence to be analyzed through deep learning technology, and compares the contextual semantic association features of the intelligence to be analyzed with the features of the network threat intelligence library to determine whether the intelligence to be analyzed is trustworthy. In this way, the collected intelligence can be automatically analyzed for credibility, thereby helping security teams or analysts to better understand threat intelligence and take corresponding response measures in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0032] Figure 1 It is a block diagram of a threat intelligence trusted analysis system based on machine learning according to an embodiment of the present application.

[0033] Figure 2 Schematic diagram of the architecture of a threat intelligence trusted analysis system based on machine learning according to an embodiment of the present application.

[0034] Figure 3 It is a block diagram of a semantic understanding module for intelligence to be analyzed in a threat intelligence trusted analysis system based on machine learning according to an embodiment of the present application.

[0035] Figure 4 It is a block diagram of a context encoding unit in a threat intelligence trusted analysis system based on machine learning according to an embodiment of the present application.

[0036] Figure 5 It is a block diagram of a Gaussian fusion module in a threat intelligence trusted analysis system based on machine learning according to an embodiment of the present application.

[0037] Figure 6 The present invention is a flowchart of a method for credible threat intelligence analysis based on machine learning according to an embodiment of the present application. DETAILED DESCRIPTION

[0038] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0039] Figure 1 It is a block diagram of a threat intelligence trusted analysis system based on machine learning according to an embodiment of the present application. Figure 2 FIG. 1 is a schematic diagram of the architecture of a threat intelligence trust analysis system based on machine learning according to an embodiment of the present application. Figure 1 and Figure 2 As shown, according to the embodiment of the present application, the threat intelligence trusted analysis system 100 based on machine learning includes: an intelligence acquisition module 110, which is used to build a network threat intelligence library and obtain intelligence to be analyzed, wherein the network threat intelligence library contains the latest malware methods, attack modes, malicious domain names, malicious websites, and malicious IP addresses; a semantic understanding module 120 for the intelligence to be analyzed, which is used to pass the intelligence to be analyzed through a context encoder including an embedding layer to obtain multiple intelligence semantic feature vectors; a Gaussian fusion module 130, which is used to fuse the multiple intelligence semantic feature vectors based on a Gaussian density map to obtain an intelligence context semantic association feature matrix; a multi-scale semantic association feature extraction module 140, used to pass the intelligence context semantic association feature matrix through a convolutional neural network model including multiple mixed convolutional layers to obtain a multi-scale intelligence semantic association feature matrix; a network threat intelligence feature matrix construction module 150, used to generate a network threat intelligence feature matrix based on the network threat intelligence library; a comparative analysis module 160, used to perform feature engineering parameterized fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix to obtain a classification feature matrix; an analysis result generation module 170, used to pass the classification feature matrix through a classifier to obtain a classification result, and the classification result is used to represent the probability value of the credibility of the intelligence to be analyzed.

[0040] In the above-mentioned machine learning-based threat intelligence trusted analysis system 100, the intelligence acquisition module 110 is used to build a network threat intelligence library and obtain intelligence to be analyzed, wherein the network threat intelligence library contains the latest malware methods, attack patterns, malicious domain names, malicious websites, and malicious IP addresses. Cyber ​​Threat Intelligence refers to information related to network security collected, analyzed, and interpreted from various sources. This information may include data from malware, hacker activities, network attacks, vulnerability exploits, cybercrime organizations, and other threatening behaviors. Collecting network threat intelligence can help organizations understand current and potential network threats so that they can take appropriate measures to protect their information assets and network infrastructure.

[0041] Threat intelligence can be divided into internal threat intelligence, external threat intelligence and open source threat intelligence from the source. Internal threat intelligence refers to internal security data from security and compliance systems such as network security monitoring systems, intrusion detection systems (IDS / IPS), logging, and incident response within an enterprise or organization. These data provide records of threats and network attacks faced by internal network activities of the organization, which can help the organization find evidence of previously unrecognized internal or external threats. External threat intelligence refers to threat information about new threats, vulnerability exploits, malware activities, and other network attacks provided by external sources, including public security announcements, vulnerability databases, hacker forums, social media, professional security research institutions, government agencies, other organizations or industry partners that cooperate with the organization, etc. By sharing information about threat activities, attack trends, and defense strategies, the overall network security capabilities can be enhanced. Open source threat intelligence refers to information from publicly accessible sources, such as websites, blogs, social media, news reports, etc. on the Internet.

[0042] Since open-source threat intelligence may come from anonymous users, unverified websites, social media posts, etc., it usually does not go through a rigorous verification process. Compared with traditional intelligence sources, open-source threat intelligence lacks professional review and verification mechanisms, so it may contain false, misleading or inaccurate content. Especially in a rapidly changing network environment, due to the timeliness of information, some intelligence may have expired or no longer apply. Moreover, the information of open-source threat intelligence may be tampered with by malicious actors to spread false information or mislead analysts, which may cause analysts to make wrong judgments based on wrong information.

[0043] Although the credibility of open source threat intelligence is relatively low, it can still serve as an important supplement to threat intelligence collection. When using open source threat intelligence or other unverified intelligence, the accuracy and credibility of the information can be confirmed by comparing and verifying it with information from other reliable sources. Based on this, in the technical solution of the present application, a network threat intelligence library is first constructed, where the network threat intelligence library contains the latest malware methods, attack patterns, malicious domain names, malicious websites, and malicious IP addresses from reliable information sources. Then, obtain the intelligence to be analyzed.

[0044] In the above-mentioned threat intelligence trusted analysis system 100 based on machine learning, the semantic understanding module 120 of the intelligence to be analyzed is used to pass the intelligence to be analyzed through a context encoder including an embedding layer to obtain multiple intelligence semantic feature vectors. In order to better understand and interpret the contextual semantic features of the intelligence to be analyzed, the context encoder is further used to semantically encode the intelligence to be analyzed. It should be understood that the context encoder is a neural network model for processing text data. It usually consists of two main components: an embedding layer (Embedding Layer) and a context encoder (Context Encoder). The embedding layer is a layer used to convert text data into a continuous vector representation. It maps each word or character to a low-dimensional vector space to capture the semantic information and contextual relationship of the vocabulary, thereby converting discrete text data into a continuous vector representation, which is convenient for subsequent calculation and processing. The context encoder is a neural network model for learning contextual information of text data. It semantically encodes the text to capture the semantic relationship and contextual information in the text.

[0045] In one example of the present application, the context encoder is a converter-based Bert model, which is a pre-trained language model proposed by Google in 2018. It learns a general language representation by pre-training on a large-scale text corpus. The BERT model adopts a two-stage training method. First, pre-training is performed on a large-scale unlabeled text, and a general language representation is learned through the Masked Language Model (MLM) and Next Sentence Prediction (NSP) tasks. Then, fine-tuning is performed on a specific task, and the BERT model is used as a feature extractor or additional task-specific layers are added thereto for training. The core of the BERT model is the Transformer architecture, which consists of multiple encoder layers. Each encoder layer contains a multi-head self-attention mechanism and a feedforward neural network. The self-attention mechanism allows the model to consider all positions in the input sequence simultaneously during the encoding process, thereby capturing global contextual information, and performing deep context encoding on the input sequence through the stacking of multiple encoder layers.

[0046] In the technical solution of the present application, the converter-based Bert model takes the embedding vector sequence output by the embedding layer as input, performs semantic encoding on the embedding vector sequence, and adaptively applies different weights to each embedding vector based on the self-attention mechanism to generate a fixed-length vector representing the semantic features of each data item, thereby obtaining multiple intelligence semantic feature vectors.

[0047] Figure 3 FIG. 1 is a block diagram of a semantic understanding module of intelligence to be analyzed in a threat intelligence trust analysis system based on machine learning according to an embodiment of the present application. Figure 3 As shown, the semantic understanding module 120 of the intelligence to be analyzed includes: a word segmentation unit 121, which is used to perform word segmentation processing on the intelligence to be analyzed to obtain multiple intelligence data items; an embedding unit 122, which is used to use the learnable embedding matrix of the word embedding layer to perform word embedding encoding on the text data of each intelligence data item in the multiple intelligence data items to obtain multiple word embedding vectors; a data integration unit 123, which is used to add the numerical data of each intelligence data item in the multiple intelligence data items to the end of each word embedding vector to obtain multiple intelligence embedding vectors; a context encoding unit 124, which is used to use the converter-based Bert model of the context encoder to perform global context semantic encoding on the multiple intelligence embedding vectors to obtain multiple intelligence semantic feature vectors.

[0048] Figure 4 FIG. 1 is a block diagram of a context encoding unit in a threat intelligence trust analysis system based on machine learning according to an embodiment of the present application. Figure 4As shown, the context encoding unit 124 includes: a one-dimensional arrangement subunit 1241, which is used to arrange the multiple intelligence embedding vectors in one dimension to obtain a global intelligence embedding vector; a self-attention generation subunit 1242, which is used to calculate the product between the global intelligence embedding vector and the transposed vector of each intelligence embedding vector in the multiple intelligence embedding vectors to obtain multiple self-attention association matrices; a standardized self-attention subunit 1243, which is used to standardize each self-attention association matrix in the multiple self-attention association matrices to obtain multiple standardized self-attention association matrices; a weight generation subunit 1244, which is used to pass each standardized self-attention association matrix in the multiple standardized self-attention association matrices through an activation function to obtain multiple probability values; a weight application subunit 1245, which is used to weight each intelligence embedding vector in the multiple intelligence embedding vectors with each probability value in the multiple probability values ​​as a weight to obtain the multiple intelligence semantic feature vectors.

[0049] In the above-mentioned threat intelligence trusted analysis system 100 based on machine learning, the Gaussian fusion module 130 is used to fuse the multiple intelligence semantic feature vectors based on the Gaussian density map to obtain the intelligence context semantic association feature matrix. Considering that the intelligence semantic feature vectors of each individual intelligence data item may not be able to fully capture the complex relationship of the intelligence global, the multiple intelligence semantic feature vectors are further fused based on the Gaussian density map. Gaussian density map (Gaussian Density Map) is a probability distribution map used to represent the association strength between different elements. It calculates the similarity or association between elements based on the Gaussian function (also known as the normal distribution), and has good mathematical properties and statistical characteristics, wherein the value of each element represents the association strength between the element and other elements. Through the construction of the Gaussian density map, the semantic association between each intelligence data item can be converted into a probability distribution, providing a more accurate basis for subsequent analysis and decision-making. Specifically, first, the mean and variance between the eigenvalues ​​of each position of the multiple intelligence semantic feature vectors are calculated, and the mean vector and the variance vector are used as inputs of the Gaussian function to construct a Gaussian density map, wherein each element represents the association strength between two intelligence semantic feature vectors. Then, the Gaussian density map is discretized to generate an intelligence context semantic association feature matrix containing context semantic association information between various intelligence data items.

[0050] Figure 5 FIG. 1 is a block diagram of a Gaussian fusion module in a threat intelligence trust analysis system based on machine learning according to an embodiment of the present application. Figure 5As shown, the Gaussian fusion module 130 includes: a Gaussian density map construction unit 131, which is used to construct the Gaussian density map of the multiple intelligence semantic feature vectors using the following fusion formula; wherein the fusion formula is: Wherein, μ represents the positional mean vector between the plurality of intelligence semantic feature vectors, and the value of each position of σ represents the variance between the feature values ​​at each position in the plurality of intelligence semantic feature vectors, represents the Gaussian density probability function, x represents the variable of the Gaussian density map; the Gaussian discretization unit 132 is used to discretize the Gaussian distribution of each position of the Gaussian density map to obtain the intelligence context semantic association feature matrix.

[0051] In the above-mentioned threat intelligence trusted analysis system 100 based on machine learning, the multi-scale semantic association feature extraction module 140 is used to pass the intelligence context semantic association feature matrix through a convolutional neural network model containing multiple mixed convolutional layers to obtain a multi-scale intelligence semantic association feature matrix. In order to extract and characterize the semantic association features of the intelligence global at different scales, the intelligence context semantic association feature matrix is ​​further subjected to multi-scale feature mining through a convolutional neural network model. The convolutional neural network model is a deep learning model that can automatically learn and extract important features in the intelligence context semantic association feature matrix. In particular, in the technical solution of the present application, the convolutional neural network model includes multiple mixed convolutional layers, which perform convolution operations on input data at different scales by using convolution kernels with different void rates. This model structure can better extract features from the input data, and gradually improve the abstraction level of the features through stacked convolutional layers, pooling layers and activation functions. By applying multiple mixed convolutional layers, intelligence semantic association features are extracted at different levels of abstraction. Shallow convolutional layers can capture local semantic association features, while deeper convolutional layers can capture more abstract and global semantic association features, thereby providing richer and more diverse intelligence feature representations, further improving the accuracy of the credibility analysis of the intelligence to be analyzed, while reducing the dimension of the features and improving computational efficiency.

[0052] Accordingly, in a specific example, each hybrid convolution layer of the convolutional neural network model includes a parallel first convolution branch structure, a second convolution branch structure, a third convolution branch structure, and a fourth convolution branch structure, as well as a multi-scale fusion structure connected to the first to fourth convolution branch structures, wherein the first convolution branch uses a first convolution kernel having a first size, the second convolution branch uses a second convolution kernel having a first size and a first dilation rate, the third convolution branch uses a third convolution kernel having a first size and a second dilation rate, and the fourth convolution branch uses a fourth convolution kernel having a first size and a third dilation rate.

[0053] Specifically, the multi-scale semantic association feature extraction module 140 is used to: use each mixed convolution layer of the convolutional neural network model to respectively perform the following on the input data in the forward pass of the layer: perform multi-scale convolution encoding on the input data to obtain a multi-scale convolutional feature map; perform pooling processing on the multi-scale convolutional feature map along the channel dimension to generate a pooled feature map; perform nonlinear activation processing on the pooled feature map to generate an activation feature map; wherein the output of the last layer of the convolutional neural network model including multiple mixed convolution layers is the multi-scale intelligence semantic association feature matrix.

[0054] In the above-mentioned threat intelligence trusted analysis system 100 based on machine learning, the network threat intelligence feature matrix construction module 150 is used to generate a network threat intelligence feature matrix based on the network threat intelligence library. Here, the encoding process of the network threat intelligence feature matrix is ​​consistent with the encoding process of the analysis intelligence. That is, based on the network threat intelligence library, a network threat intelligence feature matrix with multi-scale contextual semantic association features between each intelligence data item is generated. More specifically, first, the network threat intelligence library is passed through a context encoder including an embedding layer to obtain a plurality of network threat intelligence semantic feature vectors. Then, the plurality of network threat intelligence semantic feature vectors are fused based on a Gaussian density map to obtain a network threat intelligence context semantic association feature matrix. Then, the network threat intelligence context semantic association feature matrix is ​​passed through a convolutional neural network model including multiple hybrid convolutional layers to obtain the network threat intelligence feature matrix.

[0055] In the above-mentioned threat intelligence trusted analysis system 100 based on machine learning, the comparative analysis module 160 is used to perform feature engineering parameterized fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix to obtain a classification feature matrix. In order to capture the semantic association and change information between the intelligence to be analyzed and the network threat intelligence library, the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix are further fused. By fusing the features of the two, the differences and changes between the intelligence to be analyzed and the threat intelligence information contained in the network threat intelligence library are captured, providing more specific and fine-grained information to help further understand the semantic information and intelligence credibility of the intelligence to be analyzed.

[0056] In particular, in the technical solution of the present application, it is considered that the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix may be obtained through different feature extraction methods or different data sources, so their feature dimensions may be different. For example, the multi-scale intelligence semantic association feature matrix may contain features of multiple scales, while the network threat intelligence feature matrix may only contain limited features. Direct fusion of these two feature matrices will lead to the problem of dimension mismatch, which reduces the feature density of the fused classification feature matrix. Similarly, it is considered that the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix may adopt different feature extraction methods or feature representation methods. For example, the multi-scale intelligence semantic association feature matrix may be obtained through a context encoder and a convolutional neural network model, while the network threat intelligence feature matrix may be generated through a network threat intelligence library. The feature representation methods of these two feature matrices may be inconsistent, including aspects such as the semantic meaning of the features, the distribution of the features, and the scale of the features. Direct fusion of these two feature matrices will lead to the problem of inconsistent feature representation, which reduces the feature density of the fused classification feature matrix. In order to solve the fusion problem of low feature density of the fused feature matrix, the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix are subjected to feature engineering parameterized fusion based on order prior to improve the quality and density of feature representation.

[0057] In view of the fusion problem of low feature density of the fused feature matrix, in the technical solution of the present application, the feature engineering parameterization based on order prior is used to regard the low feature density of the fused feature matrix as a structural imbalance, so as to adopt a structural optimization technology to improve the feature density of the fused feature matrix. Specifically, according to the morphology and characteristics of the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix, a feature engineering parameterization strategy based on order prior is designed to sort and group the feature values ​​of different categories and dimensions according to certain order rules, thereby reducing information redundancy and noise interference in the fusion process. Furthermore, using a structural optimization technology, the support matrix as the mean is selected as the interaction seed, and the point correlation is grown from the interaction center to the interaction endpoint to transform the sparse matching of the feature matrix in dimension and scale into dense matching, thereby improving the feature density of the fused classification feature matrix, thereby improving the classification effect based on the fused classification feature matrix.

[0058] Accordingly, in a specific example, the comparative analysis module 160 is used to: perform feature engineering parameterization fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix using the following fusion formula to obtain a classification feature matrix; wherein the fusion formula is:

[0059]

[0060] Wherein, M1 represents the multi-scale intelligence semantic association feature matrix, M2 represents the network threat intelligence feature matrix, represents the mean matrix between the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix, exp(·) represents the exponential operation of the matrix, log represents the logarithmic function value with base 2, represents the positional addition of matrices, Represents the positional subtraction of matrices, M c Represents the classification feature matrix.

[0061] In the above-mentioned threat intelligence trust analysis system 100 based on machine learning, the analysis result generation module 170 is used to pass the classification feature matrix through the classifier to obtain a classification result, and the classification result is used to represent the probability value of the intelligence to be analyzed being trustworthy. The classifier is a supervised learning method that classifies new unlabeled data by learning patterns and rules from labeled training data and learning the association between features in the training data and corresponding labels. The goal of the classifier is to correctly assign the input data to predefined categories based on its characteristics. Here, by inputting the classification feature matrix into the trained classifier, the classifier can classify the intelligence to be analyzed according to the learned patterns and rules, and give a result representing the credibility. For example, the classifier can output a probability value indicating the probability that the intelligence to be analyzed belongs to a trustworthy category. In this way, the classification result can help decision makers or analysts better evaluate the credibility of the intelligence to be analyzed, and use it as auxiliary information for subsequent decision making or further analysis.

[0062] In summary, according to the embodiment of the present application, the threat intelligence trust analysis system based on machine learning is explained, which first builds a network threat intelligence library containing the latest malware means, attack patterns, malicious domain names, malicious websites, and malicious IP addresses, and extracts contextual semantic association features of the intelligence to be analyzed through deep learning technology, and compares the contextual semantic association features of the intelligence to be analyzed with the features of the network threat intelligence library to determine whether the intelligence to be analyzed is trustworthy. In this way, the collected intelligence can be automatically analyzed for credibility, thereby helping security teams or analysts to better understand threat intelligence and take corresponding response measures in a timely manner.

[0063] Figure 6 FIG. 1 is a flowchart of a method for credible threat intelligence analysis based on machine learning according to an embodiment of the present application. Figure 6As shown, according to the embodiment of the present application, the threat intelligence trust analysis method based on machine learning includes the following steps: S110, constructing a network threat intelligence library, and obtaining intelligence to be analyzed, wherein the network threat intelligence library contains the latest malware means, attack modes, malicious domain names, malicious websites, and malicious IP addresses; S120, passing the intelligence to be analyzed through a context encoder including an embedding layer to obtain multiple intelligence semantic feature vectors; S130, fusing the multiple intelligence semantic feature vectors based on a Gaussian density map to obtain an intelligence context semantic association feature matrix; S140, passing the intelligence context semantic association feature matrix through a convolutional neural network model including multiple mixed convolutional layers to obtain a multi-scale intelligence semantic association feature matrix; S150, generating a network threat intelligence feature matrix based on the network threat intelligence library; S160, performing feature engineering parameterization fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix to obtain a classification feature matrix; S170, passing the classification feature matrix through a classifier to obtain a classification result, and the classification result is used to represent the probability value that the intelligence to be analyzed is trustworthy.

[0064] Here, those skilled in the art can understand that the specific operations of each step in the above-mentioned threat intelligence trust analysis method based on machine learning have been referred to above. Figures 1 to 5 The description of the machine learning-based threat intelligence trusted analysis system has been introduced in detail, and therefore, its repeated description will be omitted.

[0065] The basic principles of the present application are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present application are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present application. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, not for limitation, and the above details do not limit the present application to being implemented by adopting the above specific details.

[0066] The block diagrams of the devices, apparatuses, equipment, and systems involved in this application are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagram. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open words, referring to "including but not limited to", and can be used interchangeably with them. The words "or" and "and" used here refer to the words "and / or" and can be used interchangeably with them, unless the context clearly indicates otherwise. The words "such as" used here refer to the phrase "such as but not limited to", and can be used interchangeably with them.

[0067] It should also be noted that in the apparatus, device and method of the present application, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present application.

[0068] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present application. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present application. Therefore, the present application is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0069] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present application to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A threat intelligence trust analysis system based on machine learning, characterized in that: include: An intelligence acquisition module is used to build a network threat intelligence library and obtain intelligence to be analyzed, wherein the network threat intelligence library contains the latest malware methods, attack patterns, malicious domain names, malicious websites, and malicious IP addresses; A semantic understanding module for the intelligence to be analyzed, used for passing the intelligence to be analyzed through a context encoder including an embedding layer to obtain a plurality of intelligence semantic feature vectors; A Gaussian fusion module, used for fusing the plurality of intelligence semantic feature vectors based on a Gaussian density map to obtain an intelligence context semantic association feature matrix; A multi-scale semantic association feature extraction module, used for passing the intelligence context semantic association feature matrix through a convolutional neural network model including multiple hybrid convolutional layers to obtain a multi-scale intelligence semantic association feature matrix; A network threat intelligence feature matrix construction module, used to generate a network threat intelligence feature matrix based on the network threat intelligence library; A comparative analysis module, used for performing feature engineering parameterization fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix to obtain a classification feature matrix; An analysis result generating module, used for passing the classification feature matrix through a classifier to obtain a classification result, wherein the classification result is used to represent a probability value of the credibility of the intelligence to be analyzed; Wherein, the Gaussian fusion module includes: A Gaussian density map construction unit, used to construct a Gaussian density map of the plurality of intelligence semantic feature vectors using the following fusion formula; Among them, the fusion formula is: Wherein, μ represents the positional mean vector between the plurality of intelligence semantic feature vectors, and the value of each position of σ represents the variance between the feature values ​​at each position in the plurality of intelligence semantic feature vectors, represents the Gaussian density probability function, and x represents the variable of the Gaussian density map; A Gaussian discretization unit, used for discretizing the Gaussian distribution of each position of the Gaussian density map to obtain the intelligence context semantic association feature matrix; The multi-scale semantic association feature extraction module is used to: use each mixed convolution layer of the convolutional neural network model to perform the following operations on the input data in the forward pass of the layer: Perform multi-scale convolution encoding on the input data to obtain a multi-scale convolution feature map; Performing pooling processing on the multi-scale convolutional feature map along the channel dimension to generate a pooled feature map; Performing nonlinear activation processing on the pooled feature map to generate an activation feature map; The output of the last layer of the convolutional neural network model including multiple hybrid convolutional layers is the multi-scale intelligence semantic association feature matrix; The comparative analysis module is used to perform feature engineering parameter fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix using the following fusion formula to obtain a classification feature matrix; wherein the fusion formula is: Wherein, M1 represents the multi-scale intelligence semantic association feature matrix, M2 represents the network threat intelligence feature matrix, represents the mean matrix between the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix, exp(·) represents the exponential operation of the matrix, log represents the logarithmic function value with base 2, ⊕ represents the positional addition of the matrix, Represents the positional subtraction of matrices, M c Represents the classification feature matrix.

2. The threat intelligence trust analysis system based on machine learning according to claim 1 is characterized in that: The intelligence semantic understanding module to be analyzed includes: A word segmentation unit, used for performing word segmentation processing on the intelligence to be analyzed to obtain multiple intelligence data items; An embedding unit, configured to perform word embedding encoding on the text data of each intelligence data item in the plurality of intelligence data items respectively using a learnable embedding matrix of a word embedding layer to obtain a plurality of word embedding vectors; A data integration unit, configured to add the numerical data of each intelligence data item in the plurality of intelligence data items to the tail of each word embedding vector to obtain a plurality of intelligence embedding vectors; A context encoding unit is used to use the converter-based Bert model of the context encoder to perform global context semantic encoding on the multiple intelligence embedding vectors to obtain multiple intelligence semantic feature vectors.

3. The threat intelligence trust analysis system based on machine learning according to claim 2 is characterized in that: The context encoding unit comprises: a one-dimensional arrangement subunit, configured to perform one-dimensional arrangement on the plurality of intelligence embedding vectors to obtain an intelligence global embedding vector; A self-attention generation subunit, configured to calculate the product between the intelligence global embedding vector and the transposed vector of each intelligence embedding vector in the multiple intelligence embedding vectors to obtain multiple self-attention association matrices; A standardized self-attention subunit, used to standardize each of the multiple self-attention association matrices to obtain multiple standardized self-attention association matrices; A weight generating subunit, configured to obtain a plurality of probability values ​​by passing each of the plurality of standardized self-attention association matrices through an activation function; The weight applying subunit is used to weight each intelligence embedding vector in the multiple intelligence embedding vectors using each probability value in the multiple probability values ​​as a weight to obtain the multiple intelligence semantic feature vectors.

4. The threat intelligence trust analysis system based on machine learning according to claim 3 is characterized in that: Each hybrid convolution layer of the convolutional neural network model includes a parallel first convolution branch structure, a second convolution branch structure, a third convolution branch structure and a fourth convolution branch structure, and a multi-scale fusion structure connected to the first to fourth convolution branch structures, wherein the first convolution branch uses a first convolution kernel having a first size, the second convolution branch uses a second convolution kernel having a first size and a first dilation rate, the third convolution branch uses a third convolution kernel having a first size and a second dilation rate, and the fourth convolution branch uses a fourth convolution kernel having a first size and a third dilation rate.

5. A method for credible analysis of threat intelligence based on machine learning, using the credible analysis system for threat intelligence based on machine learning according to claim 1, characterized in that: include: Build a network threat intelligence library and obtain intelligence to be analyzed, wherein the network threat intelligence library contains the latest malware methods, attack patterns, malicious domain names, malicious websites, and malicious IP addresses; Passing the intelligence to be analyzed through a context encoder including an embedding layer to obtain a plurality of intelligence semantic feature vectors; Based on the Gaussian density map, the plurality of intelligence semantic feature vectors are fused to obtain an intelligence context semantic association feature matrix; Passing the intelligence context semantic association feature matrix through a convolutional neural network model including multiple hybrid convolutional layers to obtain a multi-scale intelligence semantic association feature matrix; Generate a network threat intelligence feature matrix based on the network threat intelligence library; Performing feature engineering parameterization fusion based on order prior on the multi-scale intelligence semantic association feature matrix and the network threat intelligence feature matrix to obtain a classification feature matrix; The classification feature matrix is ​​passed through a classifier to obtain a classification result, and the classification result is used to represent the probability value of the credibility of the intelligence to be analyzed.

6. The threat intelligence trust analysis method based on machine learning according to claim 5 is characterized in that: The intelligence to be analyzed is passed through a context encoder including an embedding layer to obtain multiple intelligence semantic feature vectors, including: Perform word segmentation processing on the intelligence to be analyzed to obtain multiple intelligence data items; Using a learnable embedding matrix of a word embedding layer, respectively performing word embedding encoding on text data of each of the multiple intelligence data items to obtain multiple word embedding vectors; Adding the numerical data of each intelligence data item in the multiple intelligence data items to the tail of each word embedding vector to obtain multiple intelligence embedding vectors; The multiple intelligence embedding vectors are encoded based on global context semantics using the transformer-based Bert model of the context encoder to obtain multiple intelligence semantic feature vectors.

7. The threat intelligence trust analysis method based on machine learning according to claim 6 is characterized in that: Using the transformer-based Bert model of the context encoder to perform global context semantic encoding on the multiple intelligence embedding vectors to obtain multiple intelligence semantic feature vectors, including: Arranging the multiple intelligence embedding vectors in one dimension to obtain an intelligence global embedding vector; Calculating the product of the intelligence global embedding vector and the transposed vector of each intelligence embedding vector in the multiple intelligence embedding vectors to obtain multiple self-attention association matrices; Normalizing each of the plurality of self-attention association matrices to obtain a plurality of standardized self-attention association matrices; Passing each of the plurality of standardized self-attention association matrices through an activation function to obtain a plurality of probability values; Each of the multiple intelligence embedding vectors is weighted using each probability value in the multiple probability values ​​as a weight to obtain the multiple intelligence semantic feature vectors.

Images