Threat intelligence attack pattern identification method, electronic device, and storage medium

Abstract

The application relates to the field of network security, in particular to a threat intelligence attack mode identification method, an electronic device and a storage medium. The identification method comprises the following steps: acquiring a plurality of target text data carrying ATT&CK technology and a plurality of attack modes corresponding to the ATT&CK technology; for each target text data, analyzing the sentences in the target text data to obtain sample sentences meeting preset requirements; identifying the sample sentences by using a pre-trained model, and determining the sample sentences related to the attack modes as to-be-processed sentences; determining a first embedding vector corresponding to each attack mode and a second embedding vector corresponding to each to-be-processed sentence; for each to-be-processed sentence, determining the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector; and for each to-be-processed sentence, determining the attack mode corresponding to the minimum weighted distance as the attack mode corresponding to the to-be-processed sentence.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to a threat intelligence attack pattern identification method, an electronic device, a storage medium and a computer program product. BACKGROUND

[0002] Currently, network attacks are increasing. Understanding the actions taken by attackers enables security analysts to monitor similar behavior and improve defense mechanisms to prevent penetration of networks and systems. MITRE refers to this overall strategy used by attackers to compromise the confidentiality, integrity, and availability of an organization's assets as Tactics Techniques and Procedures (TTP). As advanced persistent threats (APT) have become very complex, defense strategies must evolve from a strategy mainly based on post-event investigation and response to a strategy that integrates network threat intelligence. Sharing threat tactics and techniques is an excellent intermediate channel for understanding network threats discovered by attackers and organizations. After detecting an attack, security analysts will strictly analyze the available evidence representing and evaluating threats and patterns, including the TTP of the attacker. This information is called Cyber Threat Intelligence (CTI) and is shared freely through blogs, bulletins, news, and reports or through paid subscriptions. When other organizations obtain this CTI, they need to rely on security experts to understand and extract relevant intelligence from the CTI. The detection speed of threat intelligence is slow, and the cost of manual work is high. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a threat intelligence attack pattern identification method for quickly detecting threats, an electronic device, a storage medium and a computer program product.

[0004] To achieve the above-mentioned purpose, the first aspect of the present application provides a threat intelligence attack pattern identification method, the identification method comprising:

[0005] Obtaining a plurality of target text data carrying ATT&CK techniques and a plurality of attack patterns corresponding to the ATT&CK techniques;

[0006] For each target text data, the sentences in the target text data are parsed to obtain sample sentences meeting preset requirements;

[0007] The pre-trained model is used to identify the sample sentences, and the sample sentences related to the attack patterns are determined as to-be-processed sentences;

[0008] Determine the first embedding vector corresponding to each attack pattern and the second embedding vector corresponding to each to-be-processed sentence;

[0009] For each to-be-processed sentence, determine the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector;

[0010] For each to-be-processed sentence, determine the attack mode corresponding to the minimum weighted distance as the attack mode corresponding to the to-be-processed sentence.

[0011] In the embodiment of the present application, for each target text data, the sentences in the target text data are parsed to obtain sample sentences meeting the preset requirements, including: for each target text data, dividing the sentences included in the target text data and having a word group number greater than a first preset number to obtain a plurality of first sentences, wherein each first sentence includes a word group number less than the first preset number and greater than a second preset number; determining all sentences in the target text data and having a word group number less than the first preset number and greater than the second preset number, and the first sentences as sample sentences.

[0012] In the embodiment of the present application, the first embedding vector includes a first sub-vector and a second sub-vector, and determining the first embedding vector corresponding to each attack mode includes: obtaining attack mode information of a plurality of attack modes corresponding to the ATT&CK technology, wherein the attack mode information includes a mode title and a mode description; for each attack mode, determining the first sub-vector corresponding to the mode title of the attack mode and the second sub-vector corresponding to the mode description of the attack mode through the pre-trained model.

[0013] In the embodiment of the present application, for each to-be-processed sentence, determining the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector includes: for each to-be-processed sentence, determining the weighted distance d between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector according to the first sub-vector and the second sub-vector included in the first embedding vector corresponding to each attack mode, and the second embedding vector corresponding to the to-be-processed sentence through formula (1) i :

[0014] d i =w cos(v sent ,v i title )+(1-w)cos(v sent ,v i desc ) Formula (1)

[0015] Wherein, w is a weight, v sent is the second embedding vector corresponding to the to-be-processed sentence, v i title is the first sub-vector included in the first embedding vector corresponding to the i-th attack mode, v idesc The second sub-vector included in the first embedding vector corresponds to the i th attack mode.

[0016] In the embodiment of the application, the pre-training model is used to identify the sample sentences, and the sample sentences related to the attack mode are determined as the to-be-processed sentences. Specifically, a first preset mark and a second preset mark are inserted at the beginning and the end of each sample sentence, respectively, and then the sample sentence is input into the pre-training model to output a third embedding vector corresponding to the sample sentence through the pre-training model. Then, for each sample sentence, the third embedding vector corresponding to the sample sentence is input into a classifier model to output a correlation probability of the sample sentence and the attack mode. If the correlation probability is greater than a preset probability, the sample sentence is determined to be related to the attack mode.

[0017] In the embodiment of the application, the method further includes a training step of the classifier model. The training step includes: obtaining historical sample data, the historical sample data including a plurality of historical sample sentences and a historical correlation probability of each historical sample sentence and the attack mode; determining a historical embedding vector corresponding to each historical sample sentence; for each historical sample sentence, inputting the historical embedding vector corresponding to the historical sample sentence into the to-be-trained classifier model to obtain a predicted correlation probability between the historical sample sentence and the attack mode output by the to-be-trained classifier model; comparing the predicted correlation probability with the historical correlation probability; and adjusting parameters of the to-be-trained classifier model according to a comparison result to train the to-be-trained classifier model.

[0018] In the embodiment of the application, the adjusting of the parameters of the to-be-trained classifier model according to the comparison result to train the to-be-trained classifier model includes: obtaining an absolute value of a difference between the predicted correlation probability and the historical correlation probability; adjusting the parameters of the to-be-trained classifier model if the absolute value is higher than a first preset difference value; determining that the predicted correlation probability is qualified if the absolute value is lower than the first preset difference value; and determining that the training of the to-be-trained classifier model is completed if a qualified rate of the predicted correlation probability reaches a preset proportion.

[0019] The second aspect of the application provides an electronic device, comprising: a processor, and a memory connected with the processor in communication;

[0020] The memory stores computer execution instructions;

[0021] The processor executes the computer execution instructions stored in the memory to implement the attack mode identification method of threat intelligence according to any one of the above embodiments.

[0022] The third aspect of the present application provides a machine readable storage medium, the machine readable storage medium stores instructions, the instructions cause the processor to be configured to perform the attack pattern identification method of threat intelligence according to any one of the above embodiments when executed by the processor.

[0023] The fourth aspect of the present application provides a computer program product, comprising a computer program, the computer program implements the attack pattern identification method of threat intelligence according to any one of the above embodiments when executed by the processor.

[0024] Through the above technical solution, the text carrying the ATT&CK technology is acquired to obtain the target text, and the target text is parsed to obtain the to-be-processed sentence related to the attack pattern, and the embedding vector corresponding to each to-be-processed sentence is determined. The processor can also acquire a plurality of attack patterns corresponding to the ATT&CK technology, and determine the embedding vector corresponding to each attack pattern. For each to-be-processed sentence, the weighted distance between the embedding vector of the to-be-processed sentence and the embedding vector corresponding to each attack pattern is determined according to the embedding vector of the to-be-processed sentence and the embedding vector corresponding to each attack pattern, and the attack pattern corresponding to the to-be-processed sentence is determined through the weighted distance. By mapping the sentence to the attack pattern to deal with the large-scale threat detection task, the threat detection speed and detection accuracy are improved.

[0025] Other features and advantages of the embodiments of the present application will be described in detail in the following specific implementation part. BRIEF DESCRIPTION OF DRAWINGS

[0026] The accompanying drawings are used to provide a further understanding of the embodiments of the present application, and constitute a part of the specification, and are used to explain the embodiments of the present application together with the following specific implementation, but do not constitute a limitation to the embodiments of the present application. In the drawings:

[0027] Figure 1 The flowchart of the attack pattern identification method of threat intelligence according to the embodiments of the present application is schematically shown;

[0028] Figure 2 The structural block diagram of an electronic device according to the embodiments of the present application is schematically shown;

[0029] Figure 3 The internal structure diagram of a computer device according to the embodiments of the present application is schematically shown. DETAILED DESCRIPTION

[0030] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It should be understood that the specific implementation described herein is only used to illustrate and explain the embodiments of the present application, and is not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0031] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative positional relationship, motion condition, etc. between components in a certain specific posture (as shown in the drawings), and if the specific posture changes, the directional indications will also change accordingly.

[0032] In addition, if the embodiments of the present application involve descriptions such as "first", "second", etc., the descriptions of "first", "second", etc. are only for description purposes, and cannot be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features. Therefore, the features limited by "first", "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of each embodiment can be combined with each other, but it must be based on the fact that a person of ordinary skill in the art can implement it, and when the combination of technical solutions contradicts each other or cannot be implemented, it should be considered that the combination of technical solutions does not exist and is not within the scope of protection claimed by the present application.

[0033] In the technical solutions of the present application, the acquisition, transmission, storage, use, processing, etc. of data comply with the relevant provisions of national laws and regulations. In addition, it should be noted that in the embodiments of the present application, some industry existing solutions, components, models, etc. may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solutions of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0034] Figure 1 The flowchart of the method for identifying the attack mode of threat intelligence is schematically shown. As shown in Figure 1 In an embodiment of the present application, a method for identifying the attack mode of threat intelligence is provided, comprising the following steps:

[0035] Step 101, obtaining a plurality of target text data carrying ATT&CK technology and a plurality of attack modes corresponding to the ATT&CK technology;

[0036] Step 102, for each target text data, parsing the sentences in the target text data to obtain sample sentences meeting the preset requirements;

[0037] In step 103, the pre-trained model is used to identify the sample sentences, and the sample sentences related to the attack patterns are determined as the to-be-processed sentences.

[0038] In step 104, the first embedding vector corresponding to each attack pattern and the second embedding vector corresponding to each to-be-processed sentence are determined.

[0039] In step 105, for each to-be-processed sentence, the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector is determined.

[0040] In step 106, for each to-be-processed sentence, the attack pattern corresponding to the minimum weighted distance is determined as the attack pattern corresponding to the to-be-processed sentence.

[0041] The processor can obtain a plurality of text data carrying the ATT&CK technology as target text data. For example, the processor can collect articles and reports related to the ATT&CK technology from a website as target text data by network crawling, and the processor can obtain a plurality of attack patterns corresponding to the ATT&CK technology, for example, the processor can obtain all attack patterns related to the ATT&CK technology. The processor can analyze the sentences in each target text data to obtain sample sentences meeting the preset requirements. After obtaining the sample sentences by analysis, the processor can identify all the sample sentences by using a pre-trained model, so as to determine the sentences carrying the attack patterns corresponding to the ATT&CK technology in the sample sentences, and determine the sample sentences related to the attack patterns as to-be-processed sentences.

[0042] After obtaining the plurality of attack models corresponding to the ATT&CK techniques, the processor can determine the first embedding vector corresponding to each attack mode. The processor can also determine the second embedding vector corresponding to the to-be-processed sentence related to the attack mode in the sample sentence. For each to-be-processed sentence, the processor can determine the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and the first embedding vector corresponding to each attack mode. The processor can determine the attack mode corresponding to the first embedding vector with the minimum weighted distance as the attack mode corresponding to the to-be-processed sentence. For example, assume that the attack modes include an A attack mode, a B attack mode, a C attack mode, and a D attack mode. The processor can determine the first embedding vector corresponding to each attack mode. The processor can determine the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and the first embedding vector corresponding to each attack mode. Assume that the processor determines that the weighted distance between the second embedding vector of the to-be-processed sentence and the first embedding vector corresponding to the A attack mode is the minimum. The processor can determine that the attack mode corresponding to the to-be-processed sentence is the A attack mode. The processor can also determine the attack mode corresponding to the first embedding vector with a weighted distance less than a preset threshold as the attack mode corresponding to the to-be-processed sentence by setting the preset threshold.

[0043] In an embodiment, for each target text data, the sentences in the target text data are parsed to obtain sample sentences meeting preset requirements, including: for each target text data, dividing the sentences included in the target text data and having a number of word groups greater than a first preset number to obtain a plurality of first sentences, wherein each first sentence includes a number of word groups less than the first preset number and greater than a second preset number; and determining all sentences in the target text data and having a number of word groups less than the first preset number and greater than the second preset number, and the first sentences as the sample sentences.

[0044] After obtaining the plurality of target text data, the processor can identify, for each target text data, a sentence whose number of word groups included in the target text data is greater than the first preset number, and divide the sentence whose number of word groups is greater than the first preset number to obtain a plurality of first sentences, wherein the first sentence includes a number of word groups less than the first preset number and greater than the second preset number. The processor can determine all sentences in the target text data whose number of word groups is less than the first preset number and greater than the second preset number and the first sentences obtained by division as sample sentences corresponding to the target text data. For example, assuming that there are 100 sentences in a target text data, the processor identifies that the number of word groups of 10 sentences exceeds the first preset number, and the processor can divide the 10 sentences to obtain first sentences whose number of word groups is less than the first preset number and greater than the second preset number. Assuming that the processor identifies that the number of sentences in the target text data whose number of word groups is less than the first preset number and greater than the second preset number is 50, the processor can determine the 50 sentences and the first sentences obtained by division as sample sentences corresponding to the target text data.

[0045] In an embodiment, the first embedding vector includes a first sub-vector and a second sub-vector, and determining the first embedding vector corresponding to each attack mode includes: obtaining attack mode information of a plurality of attack modes corresponding to the ATT&CK technology, wherein the attack mode information includes a mode title and a mode description; for each attack mode, determining, by the pre-trained model, the first sub-vector corresponding to the mode title of the attack mode and the second sub-vector corresponding to the mode description of the attack mode.

[0046] The processor can determine the first embedding vector corresponding to each attack mode, wherein the first embedding vector includes a first sub-vector and a second sub-vector. The processor can obtain attack mode information of a plurality of attack modes corresponding to the ATT&CK technology, wherein the attack mode information includes a mode title and a mode description, that is, the processor can obtain the mode title and the mode description of each attack mode corresponding to the ATT&CK technology. For each attack mode, the processor can determine, by the pre-trained model, the first sub-vector corresponding to the mode title of the attack mode and the second sub-vector corresponding to the mode description of the attack mode.

[0047] In an embodiment, for each to-be-processed sentence, the weighted distance d between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector is determined by formula (1) according to the first sub-vector and the second sub-vector included in the first embedding vector corresponding to each attack mode and the second embedding vector corresponding to the to-be-processed sentence. i :

[0048] d i =w cos(v sent , v ititle )+(1-w)cos(v sent ,v i desc ) Formula (1)

[0049] wherein w is a weight, v sent is the second embedding vector corresponding to the to-be-processed sentence, v i title is the first sub-vector included in the first embedding vector corresponding to the i-th attack mode, and v i desc is the second sub-vector included in the first embedding vector corresponding to the i-th attack mode.

[0050] The processor can determine the first sub-vector and the second sub-vector included in the first embedding vector corresponding to each attack mode, and for each to-be-processed sentence, the processor can determine the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector according to the first sub-vector and the second sub-vector corresponding to each attack mode and the first embedding vector corresponding to the to-be-processed sentence by Formula (1) i =w cos(v sent ,v i title )+(1-w)cos(v sent ,v i desc ). Wherein w is a weight, v sent is the second embedding vector corresponding to the to-be-processed sentence, v i title is the first sub-vector included in the first embedding vector corresponding to the i-th attack mode, and v i desc is the second sub-vector included in the first embedding vector corresponding to the i-th attack mode.

[0051] In an embodiment, the identifying of the sample sentences by the pre-training model and the determining of the sample sentences related to the attack mode as the to-be-processed sentences include: inserting a first preset mark and a second preset mark at the beginning and the end of each sample sentence respectively, and inputting to the pre-training model to output the third embedding vector corresponding to each sample sentence by the pre-training model; for each sample sentence, inputting the third embedding vector corresponding to the sample sentence to the classifier model to output the related probability of the sample sentence and the attack mode; for each sample sentence, in the case that the related probability is greater than a preset probability, determining that the sample sentence is related to the attack mode.

[0052] The processor can identify the sample sentences by using the pre-trained model, and determine the sample sentences related to the attack pattern as the to-be-processed sentences. The processor can insert a first preset mark and a second preset mark at the beginning and the end of each sample sentence respectively to distinguish each sample sentence, and input the distinguished sample sentences into the pre-trained model to output a third embedding vector corresponding to each sample sentence by using the pre-trained model. For each sample sentence, the processor can input the third embedding vector corresponding to each sample sentence into a classifier model to output a correlation probability of each sample sentence with the attack pattern by using the classifier model. After obtaining the correlation probability of each sample sentence with the attack pattern by using the classifier model, for each sample sentence, if the correlation probability of the sample sentence with the attack pattern is greater than a preset probability, the processor determines that the sample sentence is a to-be-processed sentence related to the attack pattern. If the correlation probability of the sample sentence with the attack pattern is less than or equal to the preset probability, the processor determines that the sample sentence is not a sentence related to the attack pattern, and thus the sample sentence does not need to be determined as a to-be-processed sentence.

[0053] For example, the processor can obtain a sample sentence set D = {x1, x2, …, xN} from the sample sentences parsed from the target text data, where xi represents the i-th sentence in the target text data. Assuming that the processor sets the first preset mark as [CLS] and the second preset mark as [SEP], after inserting the first preset mark and the second preset mark into each sample sentence, the sample sentence set can become m} where x i represents the i-th sentence in the target text data. Assuming that the processor sets the first preset mark as [CLS] and the second preset mark as [SEP], after inserting the first preset mark and the second preset mark into each sample sentence, the sample sentence set can become to distinguish each sample sentence in the sample sentence set, and then input the distinguished sample sentences into the pre-trained model to obtain a third embedding vector corresponding to each sample sentence.

[0054] In an embodiment, the method further comprises a training step of the classifier model, the training step comprising: obtaining historical sample data, the historical sample data comprising a plurality of historical sample sentences and a historical correlation probability of each historical sample sentence with an attack pattern; determining a historical embedding vector corresponding to each historical sample sentence; inputting, for each historical sample sentence, the historical embedding vector corresponding to the historical sample sentence into the classifier model to be trained to obtain a predicted correlation probability between the historical sample sentence and the attack pattern output by the classifier model to be trained; comparing the predicted correlation probability with the historical correlation probability; and adjusting parameters of the classifier model to be trained according to a comparison result to train the classifier model to be trained. In an embodiment, adjusting the parameters of the classifier model to be trained according to the comparison result to train the classifier model to be trained comprises: obtaining an absolute value of a difference between the predicted correlation probability and the historical correlation probability; adjusting the parameters of the classifier model to be trained in a case where the absolute value is higher than a first preset difference value; determining that the predicted correlation probability is qualified in a case where the absolute value is lower than the first preset difference value; and determining that the training of the classifier model to be trained is completed in a case where a qualified rate of the predicted correlation probability reaches a preset proportion.

[0055] Before the processor identifies the sample sentence using the classifier model, the processor can train the classifier model. The processor can obtain historical sample data, where the historical sample data can comprise a plurality of historical sample sentences and a historical correlation probability of each historical sample sentence with an attack pattern. The processor can determine a historical embedding vector corresponding to each historical sample sentence. For each historical sample sentence, the processor can input the historical embedding vector corresponding to the historical sample sentence into the classifier model to be trained, thereby obtaining a predicted correlation probability between the historical sample sentence and the attack pattern output by the classifier model to be trained. The processor can compare the predicted correlation probability of each historical sample sentence with the historical correlation probability, and adjust parameters of the classifier model to be trained according to a comparison result to train the classifier model to be trained.

[0056] The processor can obtain an absolute value of a difference between the predicted correlation probability of each historical sample sentence and the historical correlation probability. In a case where the absolute value is higher than a first preset difference value set by the processor, the processor adjusts the parameters of the classifier model to be trained. In a case where the absolute value is lower than the first preset difference value, the processor determines that the predicted correlation probability is qualified. When a qualified rate of the predicted correlation probability output by the classifier model to be trained reaches a preset proportion, the processor can determine that the training of the classifier model to be trained is completed.

[0057] In an embodiment, as Figure 2As shown, an electronic device 200 is provided, comprising: a processor 201, and a memory 202 connected with the processor 201 in communication; the memory 202 stores computer execution instructions; the processor 201 executes the computer execution instructions stored in the memory 202 to realize the threat intelligence attack pattern identification method according to any one of the above embodiments.

[0058] The technical solution described above first acquires the text carrying the ATT&CK technology to obtain a target text, then analyzes the target text to obtain attack pattern related to-be-processed sentences, and determines the embedding vector corresponding to each to-be-processed sentence. The processor can also acquire a plurality of attack patterns corresponding to the ATT&CK technology, and determine embedding vectors corresponding to the mode title and mode description of the attack pattern. For each to-be-processed sentence, the weighted distance between the embedding vector of the to-be-processed sentence and the embedding vector corresponding to the attack pattern is determined according to the embedding vector of the to-be-processed sentence and the embedding vector corresponding to the mode title and mode description of each attack pattern, and the attack pattern corresponding to the to-be-processed sentence is determined through the weighted distance. By mapping the sentences to attack patterns to deal with large-scale threat detection tasks, the threat detection speed and detection accuracy are improved.

[0059] The memory can include non-persistent memory in a computer readable medium, random access memory (RAM), and / or non-volatile memory such as read-only memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip. Those skilled in the art can understand that, Figure 2 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0060] In one embodiment, a machine readable storage medium is provided, the machine readable storage medium has instructions stored thereon, the instructions, when executed by a processor, cause the processor to be configured to perform the threat intelligence attack pattern identification method according to any one of the above embodiments.

[0061] In one embodiment, a computer program product is provided, comprising a computer program, the computer program, when executed by a processor, implements the threat intelligence attack pattern identification method according to any one of the above embodiments.

[0062] In one embodiment, a computer device is provided, which can be a server, and the internal structure diagram of the computer device can be as shown in Figure 3As shown in the figure. The computer device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operating system B01 and the computer program B02 in the non-volatile storage medium A04 to run. The database of the computer device is used to store related data of attack patterns. The network interface A02 of the computer device is used to communicate with external terminals through network connection. The computer program B02 is executed by the processor A01 to realize a threat intelligence attack pattern identification method.

[0063] The embodiment of the present application provides a device, which comprises a processor, a memory and a program stored in the memory and executable on the processor, and the processor realizes the following steps when executing the program: obtaining a plurality of target text data carrying ATT&CK techniques and a plurality of attack patterns corresponding to the ATT&CK techniques; for each target text data, analyzing the sentences in the target text data to obtain sample sentences meeting preset requirements; identifying the sample sentences by a pre-trained model, and determining the sample sentences related to the attack patterns as to-be-processed sentences; determining a first embedding vector corresponding to each attack pattern and a second embedding vector corresponding to each to-be-processed sentence; for each to-be-processed sentence, determining the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector; and for each to-be-processed sentence, determining the attack pattern corresponding to the minimum weighted distance as the attack pattern corresponding to the to-be-processed sentence.

[0064] In one embodiment, for each target text data, the sentences in the target text data are analyzed to obtain sample sentences meeting preset requirements, including: for each target text data, dividing the sentences in the target text data, the number of word groups of which is greater than a first preset number, to obtain a plurality of first sentences, wherein each first sentence includes a number of word groups less than the first preset number and greater than a second preset number; and determining all sentences in the target text data, the number of word groups of which is less than the first preset number and greater than the second preset number, and the first sentences as sample sentences.

[0065] In one embodiment, the first embedding vector includes a first sub-vector and a second sub-vector. Determining the first embedding vector corresponding to each attack mode includes: obtaining attack mode information of multiple attack modes corresponding to ATT&CK technology, wherein the attack mode information includes mode title and mode description; for each attack mode, determining the first sub-vector corresponding to the mode title of the attack mode and the second sub-vector corresponding to the mode description of the attack mode through a pre-trained model.

[0066] In one embodiment, determining the weighted distance between the second embedding vector corresponding to the statement to be processed and each first embedding vector for each statement to be processed includes: for each statement to be processed, determining the weighted distance d between the second embedding vector corresponding to the statement to be processed and each first embedding vector according to formula (1) based on the first sub-vector and the second sub-vector included in the first embedding vector corresponding to each attack mode, and the second embedding vector corresponding to the statement to be processed. i :

[0067] d i =w cos(v sent v i title )+(1-w)cos(v sent v i desc ) Formula (1)

[0068] Where w is the weight, v sent v is the second embedding vector corresponding to the statement to be processed. i title v is the first sub-vector included in the first embedding vector corresponding to the i-th attack mode. i desc The second sub-vector is included in the first embedding vector corresponding to the i-th attack mode.

[0069] In one embodiment, identifying sample statements related to the attack pattern and determining them as statements to be processed by using a pre-trained model includes: inserting a first preset marker and a second preset marker at the beginning and end of each sample statement, respectively, and inputting them into the pre-trained model to output a third embedding vector corresponding to each sample statement; for each sample statement, inputting the third embedding vector corresponding to the sample statement into a classifier model to output the correlation probability between the sample statement and the attack pattern; and for each sample statement, if the correlation probability is greater than a preset probability, determining that the sample statement is related to the attack pattern.

[0070] In an embodiment, the method further comprises a training step of the classifier model, the training step comprising: obtaining historical sample data, the historical sample data comprising a plurality of historical sample sentences and a historical correlation probability between each historical sample sentence and an attack pattern; determining a historical embedding vector corresponding to each historical sample sentence; inputting, for each historical sample sentence, the historical embedding vector corresponding to the historical sample sentence into the classifier model to be trained to obtain a predicted correlation probability between the historical sample sentence and the attack pattern output by the classifier model to be trained; comparing the predicted correlation probability with the historical correlation probability; and adjusting parameters of the classifier model to be trained according to a comparison result to train the classifier model to be trained.

[0071] In an embodiment, adjusting the parameters of the classifier model to be trained according to the comparison result to train the classifier model to be trained comprises: obtaining an absolute value of a difference between the predicted correlation probability and the historical correlation probability; adjusting the parameters of the classifier model to be trained in a case where the absolute value is higher than a first preset difference value; determining that the predicted correlation probability is qualified in a case where the absolute value is lower than the first preset difference value; and determining that the training of the classifier model to be trained is completed in a case where a qualified rate of the predicted correlation probability reaches a preset proportion.

[0072] Those skilled in the art should understand that embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer usable program code.

[0073] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and combinations of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The functions specified in a flow or multiple flows and / or blocks

[0074] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0075] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0076] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0077] The memory can include non-persistent memory and / or volatile memory, e.g., random access memory (RAM) and / or non-volatile memory, e.g., read-only memory (ROM) or flash memory. The memory is an example of computer-readable media.

[0078] Computer-readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

[0079] It should also be noted that the terms "comprising", "comprises", "including", "includes" or any other variation thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0080] The above embodiments of the present application are only used to illustrate the technical solutions of the present application, and not intended to limit the present application. Although the present application has been described in detail, it should be understood that those skilled in the art can make various modifications and changes without departing from the spirit and scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of the claims of the present application.

Claims

1. A method for identifying attack patterns of threat intelligence, characterized in that, The identification method comprises: obtaining a plurality of target text data carrying ATT&CK techniques and a plurality of attack modes corresponding to the ATT&CK techniques; for each target text data, parsing the sentences in the target text data to obtain sample sentences meeting preset requirements; identifying the sample sentences by a pre-trained model, and determining sample sentences related to attack modes as to-be-processed sentences; determining a first embedding vector corresponding to each attack mode and a second embedding vector corresponding to each to-be-processed sentence; the first embedding vector comprises a first sub-vector and a second sub-vector; for each to-be-processed sentence, determining the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector; for each to-be-processed sentence, determining the attack mode corresponding to the minimum weighted distance as the attack mode corresponding to the to-be-processed sentence. The determination of the first embedding vector corresponding to each attack mode comprises: obtaining attack mode information of the plurality of attack modes corresponding to the ATT&CK techniques, wherein the attack mode information comprises a mode title and a mode description; for each attack mode, determining a first sub-vector corresponding to the mode title of the attack mode and a second sub-vector corresponding to the mode description of the attack mode by a pre-trained model. 2.The method of claim 1, wherein, The parsing of the sentences in the target text data to obtain sample sentences meeting preset requirements comprises: for each target text data, dividing the sentences included in the target text data and having a phrase quantity greater than a first preset quantity to obtain a plurality of first sentences, wherein each first sentence includes a phrase quantity less than the first preset quantity and greater than a second preset quantity; determining all sentences in the target text data and having a phrase quantity less than the first preset quantity and greater than the second preset quantity and the first sentences as the sample sentences. 3.The method of claim 1, wherein, The determination of the weighted distance between the second embedding vector corresponding to the to-be-processed sentence and each first embedding vector for each to-be-processed sentence comprises: According to the first sub-vector and the second sub-vector included in the first embedding vector corresponding to each attack mode and the second embedding vector corresponding to the to-be-processed statement, a weighted distance between the second embedding vector corresponding to the to-be-processed statement and each first embedding vector is determined through formula (1) for each to-be-processed statement : Equation (1) wherein w is a weight, is a second embedding vector corresponding to the to-be-processed sentence, is a first sub-vector included in the first embedding vector corresponding to the i-th attack mode, is a second sub-vector included in the first embedding vector corresponding to the i-th attack mode. 4.The method of claim 1, wherein, The identification of the sample sentences by the pre-trained model to determine sample sentences related to attack modes as to-be-processed sentences comprises: inserting a first preset mark at the beginning and a second preset mark at the end of each sample sentence, and inputting to the pre-trained model to output a third embedding vector corresponding to each sample sentence by the pre-trained model; for each sample sentence, inputting the third embedding vector corresponding to the sample sentence into a classifier model to output a correlation probability of the sample sentence and the attack mode; for each sample sentence, in the case where the correlation probability is greater than a preset probability, determining that the sample sentence is related to the attack mode.

5. The method of identifying attack patterns from threat intelligence according to claim 4, wherein, The method further comprises a training step of the classifier model, the training step comprising: obtaining historical sample data, the historical sample data comprising a plurality of historical sample sentences and a historical correlation probability of each historical sample sentence and an attack mode; determining a historical embedding vector corresponding to each historical sample sentence; For each historical sample sentence, input the historical embedding vector corresponding to the historical sample sentence into the to-be-trained classifier model, and obtain a predicted correlation probability between the historical sample sentence and the attack mode output by the to-be-trained classifier model; Compare the predicted correlation probability with the historical correlation probability; Adjust parameters of the to-be-trained classifier model according to the comparison result to train the to-be-trained classifier model.

6. The method of identifying attack patterns from threat intelligence according to claim 5, wherein, The adjusting of the parameters of the to-be-trained classifier model according to the comparison result to train the to-be-trained classifier model comprises: Obtaining an absolute value of a difference between the predicted correlation probability and the historical correlation probability; In a case where the absolute value is higher than a first preset difference value, adjusting the parameters of the to-be-trained classifier model; In a case where the absolute value is lower than the first preset difference value, determining that the predicted correlation probability is qualified; In a case where a qualified rate of the predicted correlation probability reaches a preset proportion, determining that the training of the to-be-trained classifier model is completed.

7. An electronic device, comprising: Comprise: a processor, and a memory connected with the processor in communication; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the threat intelligence attack mode identification method according to any one of claims 1 to 6.

8. A machine-readable storage medium having stored thereon instructions, the instructions being executable by a machine to cause the machine to: The instructions, when executed by the processor, cause the processor to be configured to perform the threat intelligence attack mode identification method according to any one of claims 1 to 6.

9. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the threat intelligence attack mode identification method according to any one of claims 1 to 6.

Images