A natural language threat intelligence extraction and analysis method and system

Abstract

The present invention discloses a natural language threat intelligence extraction and analysis method and system, which relates to the field of natural language technology. The system comprises a data collection module, a data preprocessing module, a threat identification module, a feature extraction module, a threat analysis module and an intelligence generation module which are executed in sequence. The technical key points are as follows: in-depth analysis is performed on high-priority threat events, and various parameters are integrated to calculate the estimated threat level, which can not only quickly reflect the severity of the current high-priority threat event, but also provide priority focus points for subsequent prediction of the corresponding time period with high-density threats in the next time period. Combined with early warning signals and attention mechanisms, the response speed and ability of the security team to threat events are improved. When potential threats are discovered, the security team can take quick action and respond effectively, thereby reducing the impact and losses caused by network security threat events.

Description

Technical Field

[0001] The present invention relates to the field of natural language technology, and in particular to a natural language threat intelligence extraction and analysis method and system. Background Art

[0002] Natural language refers to the language used by humans in daily life, such as English, Chinese, French, etc.; it is different from computer language; using natural language for threat intelligence analysis; threat intelligence analysis usually involves processing large amounts of text data, such as: network security incident reports security blogs and forum articles social media posts malware code hacker forum conversations These data usually exist in the form of natural language, so they need to be analyzed with the help of natural language processing technology; natural language processing (NLP) technology can help us: extract key information: extract key information from the text, such as the attacker's name, attack target, attack method, attack time, etc.

[0003] Currently, in response to network security, natural language processing technology is used to analyze various network events or data and extract intelligence about threats or tools, such as hacker attacks and system vulnerability intrusions reported by the news media. A large number of such events usually require rapid text processing, but omissions may occur during processing. Considering efficiency issues, some events with high threat levels may be omitted or ignored, while some events with low threat levels are given priority. This will result in the inability to meet the rapid response processing of events with different threat levels. At the same time, the computing resources used in system analysis and processing cannot be reasonably allocated, which may further affect the efficiency and accuracy of network security protection. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] In view of the shortcomings of the prior art, the present invention provides a natural language threat intelligence extraction and analysis method and system, which conducts in-depth analysis of high-priority threat events and integrates various parameters to calculate the estimated threat level. It can not only quickly reflect the severity of the current high-priority threat event, but also provide priority focus points for subsequent predictions of the corresponding time periods with high-density threats in the next time period. Combined with early warning signals and attention mechanisms, it improves the security team's response speed and ability to threat events, and solves the problems raised in the background technology.

[0006] (II) Technical solution

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0008] A natural language threat intelligence extraction and analysis system, the system comprising:

[0009] The data collection module uses data collection technology to obtain network security data;

[0010] Data preprocessing module, preprocessing network security data;

[0011] The threat identification module performs preliminary threat identification on pre-processed network security data, uses a lightweight NLP model to identify threat signals, and builds a rule engine to classify threat signals and generate threat events corresponding to high and low priorities;

[0012] The feature extraction module combines NLP technology and named entity recognition technology to extract feature information from threat events;

[0013] The threat analysis module uses a machine learning model to train data based on several known threat events. The machine learning model predicts the threat category based on the extracted features; conducts in-depth analysis of high-priority threat events and executes corresponding strategies based on the results of the in-depth analysis; and temporarily stores low-priority threat events.

[0014] Intelligence generation module generates readable threat intelligence reports.

[0015] Furthermore, data collection technologies include crawler technology, API technology, subscription and platform sharing, and the sources of network security data include: security blogs and forums, hacker forums, news media, social media and vulnerability databases.

[0016] Furthermore, the process of preprocessing network security data includes: cleaning, word segmentation, part-of-speech tagging, named entity recognition, and semantic analysis.

[0017] Furthermore, the lightweight NLP model adopts keyword matching technology and uses a predefined keyword library for matching;

[0018] Keyword library: a predefined library containing attack-related keywords and phrases; Key attack keywords: identify strong attack intentions, including but not limited to: "exploit", "malware", "ransomware" and "botnet"; Non-key attack keywords: identify potential attack intentions, including but not limited to: "scan", "probe", "injection" and "bypass";

[0019] In the rule engine that is built, the matching definition is as follows:

[0020] High priority: the data contains at least 2 key attack keywords, or contains 1 key attack keyword and at least 1 non-key attack keyword; low priority: the data contains 1 key attack keyword and no non-key attack keywords, or only contains non-key attack keywords.

[0021] Furthermore, the characteristic information extracted from the threat event includes: time, location, attacker, target, attack method, vulnerability and tool.

[0022] Furthermore, the process of using machine learning models to predict threat types is as follows:

[0023] Data preparation: Collect data on known threat events; process the data, perform word segmentation and stem extraction on text data, and convert it into digital features; standardize the feature vectors and normalize the numerical features to between 0 and 1;

[0024] Feature engineering: select feature information for feature combination and construct new features;

[0025] Filter out the required features through feature selection methods;

[0026] Model selection: Select support vector machine as the machine learning model;

[0027] Model training: Divide the prepared data into training sets and test sets; use the training set to train the selected model;

[0028] Model evaluation: Use the test set to evaluate the trained model and select the best model based on the evaluation results;

[0029] Prediction: Use the trained model to predict new threat event descriptions and obtain threat types.

[0030] Furthermore, the process of in-depth analysis of high-priority threat events is as follows:

[0031] Perform threat severity assessment on each high-priority threat event, obtain the assessment parameter data set of each high-priority threat event, and perform dimensionless processing on the assessment parameter data to generate a threat severity estimate corresponding to each high-priority threat event. Issue a warning signal for high-priority threat events whose threat severity estimate exceeds a preset standard threshold. Mark the time points corresponding to the high-priority threat events on the timeline within a predetermined time period T in chronological order, and then use a sliding window algorithm combined with a preset density threshold to identify the time period when the threat event density exceeds the density threshold, and trigger the attention mechanism based on the analysis results of the time period.

[0032] Furthermore, the evaluation parameter data set includes the number of keywords, threat complexity, and the difference between the time when the threat event occurred and the current time; the acquisition process of threat complexity is:

[0033] Second, build a rule engine to extract targets, attack methods, and attackers from the extracted feature information and define them as key factors. Then assign corresponding weights and scores to each key factor, and keep the weights and scores synchronized.

[0034] Target: Core system, assigned weight 3 > general system, assigned weight 2 > network, assigned weight 1;

[0035] Attack method: Zero-day vulnerability, assigned weight 3> known vulnerability, assigned weight 2> port scan, assigned weight 1;

[0036] Attacker: known hacker organizations are assigned a weight of 3 > unknown organizations are assigned a weight of 2 > individual attacks are assigned a weight of 1;

[0037] Multiply the score of each factor by its weight and add up all the results to get the threat complexity;

[0038] The threat severity estimate for each high priority threat event is generated based on the following formula:

[0039]

[0040] In the formula, Gw represents the estimated value of threat level, s represents the number of keywords, and tc represents the complexity of threat. represents the time decay factor, ch represents the difference between the time when the threat event occurs and the current time, and G represents the time constant.

[0041] Furthermore, the process of identifying the time period when the threat event density exceeds the density threshold is as follows:

[0042] Timeline marking: Mark high-priority threat events on the timeline in chronological order;

[0043] Sliding window algorithm: A sliding window algorithm is used to calculate the density of high-priority threat events in each time period;

[0044] Density threshold: Set the density threshold for the density of high-priority threat events, i.e. three events per hour;

[0045] Identify high-density time periods: The sliding window moves on the timeline, calculates the number of high-priority threat events in each window, and compares it with the density threshold to identify the time period when the density of high-priority threat events exceeds the density threshold;

[0046] Processing of several high-density time periods: When M high-density time periods are identified, the threat level estimates of high-priority threat events in each time period are averaged to obtain an average value;

[0047] The attention mechanism is triggered according to the analysis results of the time period. When the value of M is 1, the high-density time period is paid attention to in the next time period T; when the value of M exceeds 1, the average value corresponding to each high-density time period is compared. In the next time period T, the attention priority of different high-density time periods is positively correlated with the size of the corresponding average value, and the corresponding high-density time period with the largest average value is paid attention to first;

[0048] The process of executing corresponding strategies based on the results of in-depth analysis is as follows:

[0049] When a warning signal is issued for a high-priority threat event whose estimated threat level exceeds the preset standard threshold, network security personnel are reminded to respond; if any problems or threats are found during the attention process, security personnel are immediately reminded to respond.

[0050] A natural language threat intelligence extraction and analysis method comprises the following steps:

[0051] S1. Use data collection technology to obtain network security data;

[0052] S2. Preprocessing network security data;

[0053] S3. Perform preliminary threat identification on the pre-processed network security data, use lightweight NLP models to identify threat signals, and build a rule engine to classify threat signals and generate threat events corresponding to high and low priorities;

[0054] S4. Combine NLP technology and named entity recognition technology to extract feature information from threat events;

[0055] S5. Use machine learning models to train based on data from several known threat events. The machine learning models predict threat categories based on extracted features. Perform in-depth analysis on high-priority threat events and execute corresponding strategies based on the in-depth analysis results. Temporarily store low-priority threat events.

[0056] S6. Generate readable threat intelligence reports.

[0057] (III) Beneficial effects

[0058] The present invention provides a natural language threat intelligence extraction and analysis method and system, which has the following beneficial effects:

[0059] The multi-source data collection strategy ensures the comprehensiveness and real-time nature of network security data, providing rich data support for subsequent threat identification and protection. The combination of lightweight NLP models and rule engines enables fast and accurate threat identification of network security data, and can prioritize threat signals, helping security teams prioritize high-priority threats, thus improving the efficiency and accuracy of network security protection to a certain extent.

[0060] Through the application of machine learning models, we have achieved automated and intelligent analysis of network security data, improving the efficiency and accuracy of threat identification. This helps security teams quickly screen out potential threat events from massive amounts of data and prioritize them.

[0061] Conducting in-depth analysis of high-priority threat events and integrating various parameters to calculate the estimated threat level can not only quickly reflect the severity of the current high-priority threat event, but also provide priority focus points for subsequent predictions of the corresponding time periods with high-density threats in the next time period. Combined with early warning signals and attention mechanisms, the security team's response speed and ability to threat events are improved. When potential threats are discovered, the security team can take quick action and respond effectively, thereby reducing the impact and losses caused by network security threat events. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A modular schematic diagram of a natural language threat intelligence extraction and analysis system of the present invention;

[0063] Figure 2 The present invention is a flowchart of the steps of a natural language threat intelligence extraction and analysis method. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] Research and development concept:

[0066] First, the definition of natural language threat intelligence extraction and analysis is:

[0067] Refers to the process of extracting threat intelligence from unstructured text data (such as news reports, social media posts, forum discussions, etc.) using natural language processing (NLP) technology; the application scenario of the designed analysis system is: network security, that is, identifying threats such as network attacks, malware, and vulnerability exploits; the detailed modular design of the analysis system will be elaborated in detail in the subsequent embodiments;

[0068] Secondly, the practical problems or directions to be solved in designing the natural language threat intelligence extraction and analysis system are:

[0069] At present, the identification of threat events mostly relies on keyword matching or preliminary NLP technology, but the processing speed needs to be taken into account during the identification process. Therefore, omissions may occur when a large number of events are processed quickly. Considering the efficiency issue, some events with high threat levels may be omitted or ignored, while some events with low threat levels are given priority. The commonly used solutions in the industry are usually just: using real-time data stream analysis and real-time data stream analysis technology to quickly process a large amount of text data to meet the rapid response processing of events with different threat levels. It does not consider the subdivision of threat events of different degrees to ensure that the analysis and computing resources can be given priority to events with high threat levels to meet the actual analysis needs and better manage limited computing resources.

[0070] Finally, based on practical problems, the team developed and designed the natural language threat intelligence extraction and analysis system:

[0071] By combining NLP technology, model algorithms and definition rules, we can implement and build an analysis system for network security, making natural language threat intelligence extraction and analysis an emerging technology, promoting its broad application prospects. By continuously improving NLP technology and combining it with technical solutions in specific scenarios, we can effectively improve the efficiency and accuracy of threat intelligence analysis.

[0072] Embodiment 1:

[0073] See also Figure 1 , this embodiment provides a natural language threat intelligence extraction and analysis system, which includes a data collection module, a data preprocessing module, a threat identification module, a feature extraction module, a threat analysis module and an intelligence generation module that are executed in sequence. The entire system is designed for the scenario of network security;

[0074] The following is a detailed description and explanation of each module:

[0075] Data collection module:

[0076] Use data collection technology to obtain network security data;

[0077] Among them, data collection technologies include crawler technology, API technology, subscription, and platform sharing;

[0078] Crawler technology: a technology that uses programs to automatically crawl web page content from the Internet. It usually simulates browser behavior, sends requests, receives responses, parses web page structure, and extracts required data; API technology: API is an application programming interface, which is a set of defined rules and specifications that allow different applications to communicate with each other and exchange data; Subscription: RSS and Atom are a network information publishing format that allows users to subscribe to updated information on websites; Platform sharing: Security intelligence sharing refers to a mechanism for security teams to collaborate and share security information, such as threat intelligence, attack indicators, vulnerability information, etc.

[0079] Example of the entire application:

[0080] Combining the above technologies, we can build a complete information collection system. We can use crawler technology to regularly crawl information from specific websites, such as news, industry reports, etc. We can use APIs to obtain data from social media platforms, such as user activities, hot topics, etc. We can subscribe to RSS subscriptions of security information websites to obtain the latest security vulnerabilities and attack incidents in a timely manner. We can also cooperate with security intelligence sharing platforms to obtain the latest threat intelligence and attack indicators.

[0081] Sources of cybersecurity data include:

[0082] Security blogs and forums: e.g. Hacker News, ThreatPost, SecurityWeek;

[0083] Hacker forums: e.g. Exploit.in, Null Byte;

[0084] News media: such as BBC, CNN, Reuters, focusing on security reports;

[0085] Social media: such as Twitter, Reddit, Telegram, etc., to follow discussions on security-related topics;

[0086] Vulnerability database: such as the CVE (Common Vulnerabilities and Exposures) database.

[0087] Data preprocessing module:

[0088] Preprocess network security data;

[0089] The preprocessing process includes: cleaning, word segmentation, part-of-speech tagging, named entity recognition, and semantic analysis;

[0090] It should be noted that cleaning: remove HTML tags, special characters and repeated content; word segmentation: split the text into words; part-of-speech tagging: tag each word with a part-of-speech, such as nouns, verbs and adjectives; named entity recognition: identify entities in the text, such as names of people, places and organizations; name semantic analysis: analyze the semantics of the text, such as themes and emotions.

[0091] Threat Identification Module:

[0092] Perform preliminary threat identification on pre-processed network security data, use lightweight NLP models to identify threat signals, and build a rule engine to classify threat signals and generate threat events corresponding to high and low priorities;

[0093] Among them, the lightweight NLP model adopts keyword matching technology, uses a pre-defined keyword library for matching, and identifies words and phrases related to network attacks, malware, and vulnerability exploits. This keyword matching is the lightweight NLP model, which is used to quickly identify potential threat signals;

[0094] Keyword library: a predefined library containing attack-related keywords and phrases;

[0095] Key attack keywords: Identify strong attack intent, including: "exploit", "malware", "ransomware" and "botnet";

[0096] Non-critical attack keywords: Identify potential attack intent, such as "scan", "probe", "injection" and "bypass";

[0097] In the rule engine that is built, the matching definition is as follows:

[0098] High priority: the data contains at least 2 key attack keywords, or contains 1 key attack keyword and at least 1 non-key attack keyword; Low priority: the data contains 1 key attack keyword and no non-key attack keywords, or only contains non-key attack keywords (it should be noted that in addition to key attack keywords, at least 1 non-key attack keyword is usually included, and data with neither key attack keywords nor non-key attack keywords will not be processed);

[0099] For example:

[0100] The keyword library is:

[0101]

[0102] Sample data: 1. "We have detected a possible exploit attempt on ournetwork." - High priority (contains 1 key attack keyword and 1 non-key attack keyword); 2. "Thesystem has been infected with malware." - Low priority (contains 1 key attack keyword); 3. "An attacker tried to bypass our security measures." - Low priority (contains 1 non-key attack keyword); 4. "The network is experiencing unusual scanning activity." - Low priority (contains 1 non-key attack keyword); 5. "There are multiple systems infected withransomware." - High priority (contains 2 key attack keywords);

[0103] The advantages of rule engines are:

[0104] Simple and easy to implement: The rule engine is simple to understand, easy to develop and maintain; Fast identification: The keyword matching speed is fast and potential threats can be quickly identified; Scalability: The keyword library can be expanded and updated as needed.

[0105] Summary: The keyword matching-based rule engine is a lightweight threat identification model that is suitable for quickly identifying potential threat signals and prioritizing data based on the number and type of keywords contained in the data.

[0106] By adopting the above technical solutions, the multi-source data collection strategy ensures the comprehensiveness and real-time nature of network security data, providing rich data support for subsequent threat identification and protection. The combination of lightweight NLP models and rule engines enables fast and accurate threat identification of network security data, and can prioritize threat signals, which helps security teams prioritize high-priority threats and improves the efficiency and accuracy of network security protection to a certain extent.

[0107] Feature extraction module:

[0108] Combine NLP technology and named entity recognition (NER) technology to extract feature information from threat events;

[0109] The characteristic information extracted from the threat event includes: time, location, attacker, target, attack method, vulnerability and tool;

[0110] It should be noted that time: extract the time when the threat event occurred; location: extract the location where the threat event occurred; attacker: extract the identity information of the threat party (that is, the attacker); target: extract the name and type of the attack target; attack method: extract the attack method, such as phishing, ransomware, etc.; vulnerability: extract the vulnerability information exploited in the attack; tools: extract the tools and techniques used in the attack;

[0111] Specifically, NLP technology is used to extract the time and location of threat events; Named Entity Recognition (NER) technology is used to extract attackers, targets, attack methods, vulnerabilities, and tools in threat events;

[0112] To fully extract the time, location, attacker, target, attack method, vulnerability, and tool from the threat event description, multiple technologies must be combined. A single technology cannot meet all requirements because different features have different characteristics:

[0113] Regarding time and place:

[0114] It is necessary to understand the semantics of time and place, such as "yesterday", "last week", and "server room". Natural language processing (NLP) technology can be used to identify time and place, such as converting "yesterday" into a specific date and "server room" into a specific address. If necessary, the location navigation system can be combined to obtain address information.

[0115] Regarding attackers, targets, attack methods, vulnerabilities, and tools:

[0116] These features are often professional terms that require domain knowledge. They can be identified and classified using the aforementioned keyword extraction and named entity recognition (NER) technologies combined with security domain knowledge bases, such as threat intelligence libraries and vulnerability libraries. For example, to identify "Cobalt Strike" as an attack tool, it is necessary to combine the security domain knowledge base to confirm that it is an attack tool rather than other types of information.

[0117] For example:

[0118] Assume that the threat event is described as:

[0119] >"2023-10-26 10:00:00 - Attacker 'APT-41' exploited the 'CVE-2023-4567' vulnerability to attack the 'server' of a 'financial company' using the 'Cobalt Strike' tool.";

[0120] NLP: The identification time is "2023-10-26 10:00:00", the attacker is identified as "APT-41", and the target is identified as "financial company"; Keyword extraction: Extract the keywords "vulnerability", "server", and "tool"; NER: Identify "CVE-2023-4567" as vulnerability information and "Cobalt Strike" as tool information; Knowledge base: Query the security intelligence library to confirm that "APT-41" belongs to the attacker organization and that "Cobalt Strike" is an attack tool;

[0121] Summary: By combining multiple technologies, it is possible to completely extract the time, location, attacker, target, attack method, vulnerability, and tool from the threat event description. It is necessary to select the appropriate technology combination according to the specific situation and continuously optimize it.

[0122] Threat Analysis Module:

[0123] Using machine learning models, training is performed based on data from several known threat events. The machine learning models predict threat categories based on extracted features. In-depth analysis is performed on high-priority threat events, and corresponding strategies are executed based on the in-depth analysis results. Low-priority threat events are temporarily stored for subsequent secondary analysis as needed.

[0124] The process of using machine learning models to predict threat types is as follows:

[0125] Data preparation: Collect a large amount of data on known threat events, including threat event descriptions, feature vectors, and corresponding threat type labels; process the data, i.e., perform word segmentation and stem extraction on text data and convert them into digital features; standardize the feature vectors and normalize the numerical features to between 0 and 1;

[0126] Feature engineering: Select appropriate features, i.e. time, location, attacker, target, attack method, vulnerability, and tool, and combine features based on domain knowledge and experience, such as "attacker" + "attack method", "target" + "vulnerability", to construct new features; use feature selection methods, such as information gain and chi-square test, to select features that contribute significantly to the classification effect;

[0127] Model selection: Select a suitable machine learning model, for example: Support vector machine (SVM): suitable for high-dimensional data classification, and has a good classification effect on linearly inseparable data (this model is used as the machine learning model in this embodiment); Decision tree: easy to understand and explain, suitable for processing discrete features; Random forest: by constructing multiple decision trees, it reduces the risk of overfitting and improves the robustness of the model; Neural network: can process complex features and has strong nonlinear fitting capabilities;

[0128] Model training: Divide the prepared data into training sets and test sets; use the training set to train the selected model and adjust the model parameters so that the model can learn the patterns and regularities in the data;

[0129] Model evaluation: Use the test set to evaluate the trained model. The evaluation indicators include: Precision: the proportion of samples predicted as positive examples that are actually positive examples; Recall: the proportion of samples predicted as positive examples among all positive examples; F1-score: the harmonic mean of precision and recall; Based on the evaluation results, select the best model and optimize it;

[0130] Prediction: Use the trained model to predict the new threat event description and obtain the threat type;

[0131] For example:

[0132] Assume that we have collected a large amount of threat event data and constructed the following feature vector:

[0133] {

[0134] "time": "2023-10-26 10:00:00",

[0135] "Location": "Country X",

[0136] "Attacker": "APT-41",

[0137] "target": "financial company",

[0138] "Attack method": "Vulnerability Exploitation",

[0139] "Vulnerability": "CVE-2023-4567",

[0140] "Tool": "Cobalt Strike"

[0141] }

[0142] At the same time, we already know that this incident is a "vulnerability exploit" attack;

[0143] We use this data to train the SVM model and make predictions for new threat event descriptions:

[0144] {

[0145] "time": "2023-10-27 14:00:00",

[0146] "Location": "Country X",

[0147] "Attacker": "hacker group",

[0148] "Target": "XX institution",

[0149] "Attack method": "Denial of service attack",

[0150] "Vulnerability": "CVE-2023-4568",

[0151] "Tool": "Mirai"

[0152] }

[0153] The trained SVM model predicts that the event is a "denial of service attack" based on the feature vector;

[0154] In summary, using machine learning models to predict threat types requires steps such as data preparation, feature engineering, model selection, model training, model evaluation, and prediction. By continuously optimizing models and feature engineering, the accuracy and reliability of model predictions can be improved.

[0155] The process of in-depth analysis of high-priority threat events is as follows:

[0156] Perform threat severity assessment on each high-priority threat event, obtain the assessment parameter data set of each high-priority threat event, perform dimensionless processing on the assessment parameter data, generate the threat severity estimate corresponding to each high-priority threat event, and issue a warning signal for the high-priority threat event whose threat severity estimate exceeds the preset standard threshold; and mark the time points corresponding to the high-priority threat events on the timeline in chronological order within the predetermined time period T, and then use the sliding window algorithm combined with the preset density threshold to identify the time period when the threat event density exceeds the density threshold, and trigger the attention mechanism according to the analysis results of the time period; the above-mentioned time period T is usually selected as one day;

[0157] The evaluation parameter data set includes the number of keywords, threat complexity, and the difference between the threat event occurrence time and the current time. The acquisition process of threat complexity is as follows:

[0158] Second, build a rule engine to extract targets, attack methods, and attackers from the extracted feature information, define these features as key factors, and assign corresponding weights and scores to each key factor, and keep the weights and scores synchronized;

[0159] Target: core system (weight 3) > general system (weight 2) > network (weight 1);

[0160] Attack method: zero-day vulnerability (weight 3) > known vulnerability (weight 2) > port scan (weight 1);

[0161] Attackers: known hacker groups (weight 3) > unknown groups (weight 2) > individual attacks (weight 1);

[0162] It should be noted that core systems refer to the most critical information systems in an enterprise or organization that are essential to business operations. These systems usually store or process highly sensitive or core business data, such as financial data, customer information, and key business logic. Once these systems are attacked or data is leaked, they may have a serious impact on the organization's operations, financial stability, reputation, etc.; ordinary systems refer to information systems that are less important or sensitive than core systems. Although these systems also support the daily operations of the organization, even if problems occur, their impact is relatively small and will not directly threaten the survival or core business functions of the organization; network refers to a system that connects multiple computing devices, servers, terminals, etc. together through physical or wireless connections to achieve data exchange, resource sharing, and communication. In modern society, the network has become the infrastructure for information transmission and interaction. Whether it is an internal enterprise network or the Internet, it carries a large amount of data traffic and communication activities.

[0163] Zero-day vulnerabilities: refers to security vulnerabilities that have not been publicly disclosed and for which software vendors have not yet released patches. Since these vulnerabilities are not widely known, attackers can use them to launch quick and covert attacks on the system, posing extremely high security risks to the target system; Known vulnerabilities: refers to security vulnerabilities that have been publicly disclosed and for which software vendors have released corresponding patches. The existence of these vulnerabilities is known, but if patches are not applied in time or other protective measures are not taken, they may still be exploited by attackers; Port scanning: used to detect open ports and services on the target computer. Through port scanning, attackers can understand the network configuration and possible weaknesses of the target system and prepare for subsequent attack activities; Although port scanning itself does not directly constitute an attack, it is usually the first step before an attacker launches an attack.

[0164] Known hacker groups: refer to organizations that have been identified and widely reported and specialize in illegal network activities. These organizations usually have superb hacking skills and rich attack experience, and can launch complex network attacks to cause significant damage to target systems; Unknown organizations: refer to organizations or groups that have not yet been identified or reported and may engage in network attack activities. The existence and specific activities of these organizations are often difficult to track and confirm, but their existence increases the uncertainty of network security; Personal attacks: refer to network attacks launched by individual hackers or technology enthusiasts against specific targets or systems. These attacks may be for personal interests, revenge or other non-commercial purposes. Their scale and scope of influence are relatively small, but they may still cause damage to the victim's information system;

[0165] For all unknown situations, set the weight and score to 2;

[0166] Multiply the score of each factor by its weight and add up all the results to get the threat complexity;

[0167] For example: Data 1: "We detected an attempt to exploit a zero-dayvulnerability on our core server, potentially by a known hacker group."; Target: Core system (weight 3); 3 points = 9; Attack method: Zero-day vulnerability (weight 3); 3 points = 9; Attacker: Known hacker group (weight 3); 3 points = 9; Threat complexity = 9 + 9 + 9 = 27;

[0168] Data 2: "A script was found attempting to scan our network for openports."; Target: Network (weight 1); 1 point = 1; Attack method: Port scan (weight 1); 1 point = 1; Attacker capability: Unknown organization (weight 2); 2 points = 2; Threat complexity = 1 + 1 + 2 = 4;

[0169] Through this simple calculation, we can see that the threat complexity of data 1 is significantly higher than that of data 2, which means that the attack of data 1 may be more difficult to defend and handle, and needs more attention;

[0170] The threat severity estimate for each high priority threat event is generated based on the following formula:

[0171]

[0172] In the formula, Gw represents the estimated value of the threat level, s represents the number of keywords, the more keywords there are, the more complex the threat event is, the wider the scope may be, and therefore the higher the threat level is, tc represents the complexity of the threat, the more complex the threat is, the greater its harm is, represents the time decay factor. The longer the threat event occurs, the weaker its influence is, so time decay is required. ch represents the difference between the time when the threat event occurs and the current time. G represents the time constant, which can be adjusted according to the actual situation. It is a common technical means for those skilled in the art, so it is not described here. The value range of the time constant is 15~30. Usually, the setting value of the time constant is 30 days, that is, one month, which is convenient for subsequent calculations.

[0173] Example: Assume that a threat event description contains 5 keywords, the threat complexity is 3 points, the difference between the threat event occurrence time and the current time is 10 days, and the time constant is set to 30 days;

[0174] Threat level estimate = 5 * 3 * exp(-10 / 30)

[0175] = 15 * 0.7408

[0176] = 11.11;

[0177] Explanation: The number of keywords is 5, the threat complexity is 3, and the time decay factor is 0.7408. Since the threat event occurred recently, the time decay factor is close to 1, so the estimated threat level is high.

[0178] In issuing a warning signal for a high-priority threat event whose estimated threat level exceeds a preset standard threshold, the preset standard threshold is used to determine whether the corresponding high-priority threat event is urgent, and the standard threshold is set based on historical data analysis. When a historical high-priority threat event belongs to a hot topic, the minimum value of the estimated threat level corresponding to each hot topic is counted and used as the standard threshold. The principle of determining a hot topic is that if the threat event is ranked in the top three in terms of heat value in the search engine, it means that the threat event belongs to a hot topic;

[0179] The process of identifying the time period when the threat event density exceeds the density threshold is as follows:

[0180] Timeline Marking: Mark high-priority threat events on the timeline in chronological order, for example:

[0181]

[0182] Sliding window algorithm: A sliding window algorithm is used to calculate the density of high-priority threat events in each time period. The sliding window size can be set according to actual conditions, such as 1 hour.

[0183] Density threshold: Set a density threshold for the density of high-priority threat events, such as more than 3 events per hour;

[0184] Identify high-density time periods: The sliding window moves on the timeline, calculates the number of high-priority threat events in each window, and compares it with the density threshold to identify the time period when the density of high-priority threat events exceeds the density threshold;

[0185] Processing of several high-density time periods: When M high-density time periods are identified, the threat level estimates of high-priority threat events in each time period are averaged to obtain an average value;

[0186] The attention mechanism is triggered according to the analysis results of the time period. When the value of M is 1, the high-density time period is paid attention to in the next time period T; when the value of M exceeds 1, the average value corresponding to each high-density time period is compared. In the next time period T, the attention priority of different high-density time periods is positively correlated with the size of the corresponding average value, and the corresponding high-density time period with the largest average value is paid attention to first;

[0187] The process of executing corresponding strategies based on the results of in-depth analysis is as follows:

[0188] When a warning signal is issued for a high-priority threat event whose estimated threat level exceeds the preset standard threshold, network security personnel are reminded to take defensive measures; if any problems or threats are found during the attention process, security personnel are also reminded to respond in a timely manner.

[0189] By adopting the above technical solutions and applying machine learning models, we can achieve automated and intelligent analysis of network security data, improve the efficiency and accuracy of threat identification, and help security teams quickly screen out potential threat events from massive data and prioritize them.

[0190] Conducting in-depth analysis of high-priority threat events and integrating various parameters to calculate the estimated threat level can not only quickly reflect the severity of the current high-priority threat event, but also provide priority focus points for subsequent predictions of the corresponding time periods with high-density threats in the next time period. Combined with early warning signals and attention mechanisms, the security team's response speed and ability to threat events are improved. When potential threats are discovered, the security team can take quick action and respond effectively, thereby reducing the impact and losses caused by network security threat events.

[0191] The corresponding strategies are implemented according to the analysis results, which enhances the pertinence and effectiveness of security defense. This helps the security team to take more accurate and effective defense measures when dealing with complex and changing network threats.

[0192] Intelligence generation module:

[0193] Generate readable threat intelligence reports: including threat type, threat severity estimate, time, location, attacker, target, attack method, vulnerability and tool.

[0194] Embodiment 2:

[0195] See also Figure 2 Based on Example 1, this embodiment also provides a natural language threat intelligence extraction and analysis method, including the following specific steps:

[0196] S1. Use data collection technology to obtain network security data;

[0197] S2. Preprocessing network security data;

[0198] S3. Perform preliminary threat identification on the pre-processed network security data, use lightweight NLP models to identify threat signals, and build a rule engine to classify threat signals and generate threat events corresponding to high and low priorities;

[0199] S4. Combine NLP technology and named entity recognition technology to extract feature information from threat events;

[0200] S5. Use machine learning models to train based on data from several known threat events. The machine learning models predict threat categories based on extracted features. Perform in-depth analysis on high-priority threat events and execute corresponding strategies based on the in-depth analysis results. Temporarily store low-priority threat events.

[0201] S6. Generate readable threat intelligence reports.

[0202] In the application, the several formulas involved are all calculated by taking their numerical values ​​after removing the dimensions, and the formulas are established by collecting a large amount of data and performing software simulation to obtain a formula for the most recent actual situation. Some coefficients or weights in the formulas are set by technical personnel in this field according to actual conditions, so they will not be elaborated here.

[0203] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. A person of ordinary skill in the art may appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein may be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution.

[0204] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, and may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0205] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A natural language threat intelligence extraction and analysis system, characterized in that: include: The data collection module uses data collection technology to obtain network security data; Data preprocessing module, preprocessing network security data; The threat identification module performs preliminary threat identification on pre-processed network security data, uses a lightweight NLP model to identify threat signals, and builds a rule engine to classify threat signals and generate threat events corresponding to high and low priorities; The feature extraction module combines NLP technology and named entity recognition technology to extract feature information from threat events; The threat analysis module uses a machine learning model to train data based on several known threat events. The machine learning model predicts the threat category based on the extracted features; conducts in-depth analysis of high-priority threat events and executes corresponding strategies based on the results of the in-depth analysis; and temporarily stores low-priority threat events. The process of in-depth analysis of high-priority threat events is as follows: Perform threat severity assessment on each high-priority threat event, obtain the assessment parameter data set of each high-priority threat event, perform dimensionless processing on the assessment parameter data, generate the threat severity estimate corresponding to each high-priority threat event, and issue a warning signal for the high-priority threat event whose threat severity estimate exceeds the preset standard threshold; and mark the time points corresponding to the high-priority threat events on the timeline in chronological order within the predetermined time period T, and then use the sliding window algorithm combined with the preset density threshold to identify the time period when the threat event density exceeds the density threshold, and trigger the attention mechanism according to the analysis results of the time period; The process of identifying the time period when the threat event density exceeds the density threshold is as follows: Timeline marking: Mark high-priority threat events on the timeline in chronological order; Sliding window algorithm: A sliding window algorithm is used to calculate the density of high-priority threat events in each time period; Density threshold: Set the density threshold for the density of high-priority threat events, i.e. three events per hour; Identify high-density time periods: The sliding window moves on the timeline, calculates the number of high-priority threat events in each window, and compares it with the density threshold to identify the time period when the density of high-priority threat events exceeds the density threshold; Processing of several high-density time periods: When M high-density time periods are identified, the threat level estimates of high-priority threat events in each time period are averaged to obtain an average value; The attention mechanism is triggered according to the analysis results of the time period. When the value of M is 1, the high-density time period is paid attention to in the next time period T; when the value of M exceeds 1, the average value corresponding to each high-density time period is compared. In the next time period T, the attention priority of different high-density time periods is positively correlated with the size of the corresponding average value, and the corresponding high-density time period with the largest average value is paid attention to first; The process of executing corresponding strategies based on the results of in-depth analysis is as follows: When a high-priority threat event with an estimated threat level exceeding the preset standard threshold is issued with an early warning signal, network security staff are reminded to respond; if problems or threats are found during the monitoring process, security staff are also immediately reminded to respond; The evaluation parameter data set includes the number of keywords, threat complexity, and the difference between the threat event occurrence time and the current time; the threat complexity acquisition process is as follows: Second, build a rule engine to extract targets, attack methods, and attackers from the extracted feature information and define them as key factors. Then assign corresponding weights and scores to each key factor, and keep the weights and scores synchronized. Target: Core system, assigned weight 3 > ordinary system, assigned weight 2 > network, assigned weight 1; Attack method: Zero-day vulnerability, assigned weight 3> known vulnerability, assigned weight 2> port scan, assigned weight 1; Attacker: known hacker organizations are assigned a weight of 3 > unknown organizations are assigned a weight of 2 > individual attacks are assigned a weight of 1; Multiply the score of each factor by its weight and add up all the results to get the threat complexity; The threat severity estimate for each high priority threat event is generated based on the following formula: In the formula, Gw represents the estimated value of threat level, s represents the number of keywords, and tc represents the complexity of threat. represents the time decay factor, ch represents the difference between the time when the threat event occurs and the current time, and G represents the time constant; Intelligence generation module generates readable threat intelligence reports.

2. A natural language threat intelligence extraction and analysis system according to claim 1, characterized in that: Data collection technologies include crawler technology, API technology, subscription and platform sharing. The sources of network security data include: security blogs and forums, hacker forums, news media, social media and vulnerability databases.

3. A natural language threat intelligence extraction and analysis system according to claim 2, characterized in that: The process of preprocessing network security data includes: cleaning, word segmentation, part-of-speech tagging, named entity recognition, and semantic analysis.

4. A natural language threat intelligence extraction and analysis system according to claim 3, characterized in that: The lightweight NLP model uses keyword matching technology and uses a predefined keyword library for matching; Keyword library: a predefined library containing attack-related keywords and phrases; Key attack keywords: identify strong attack intentions, including but not limited to: "exploit", "malware", "ransomware" and "botnet"; Non-key attack keywords: identify potential attack intentions, including but not limited to: "scan", "probe", "injection" and "bypass"; In the rule engine that is built, the matching definition is as follows: High priority: the data contains at least 2 key attack keywords, or contains 1 key attack keyword and at least 1 non-key attack keyword; low priority: the data contains 1 key attack keyword and no non-key attack keywords, or only contains non-key attack keywords.

5. A natural language threat intelligence extraction and analysis system according to claim 4, characterized in that: The characteristic information extracted from the threat event includes: time, location, attacker, target, attack method, vulnerability and tool.

6. A natural language threat intelligence extraction and analysis system according to claim 5, characterized in that: The process of using machine learning models to predict threat types is as follows: Data preparation: Collect data on known threat events; process the data, perform word segmentation and stem extraction on text data, and convert it into digital features; Normalize the feature vector and normalize the numerical features to between 0 and 1; feature Engineering: Select feature information for feature combination and construct new features; Filter out the required features through feature selection methods; Model selection: Select support vector machine as the machine learning model; Model training: Divide the prepared data into training sets and test sets; use the training set to train the selected model; Model evaluation: Use the test set to evaluate the trained model and select the best model based on the evaluation results; Prediction: Use the trained model to predict new threat event descriptions and obtain threat types.

7. A method for extracting and analyzing natural language threat intelligence, using any system described in claims 1 to 6, characterized in that: The steps include: S1. Use data collection technology to obtain network security data; S2. Preprocessing network security data; S3. Perform preliminary threat identification on the pre-processed network security data, use lightweight NLP models to identify threat signals, and build a rule engine to classify threat signals and generate threat events corresponding to high and low priorities; S4. Combine NLP technology and named entity recognition technology to extract feature information from threat events; S5. Use machine learning models to train based on data from several known threat events. The machine learning models predict threat categories based on extracted features. Perform in-depth analysis on high-priority threat events and execute corresponding strategies based on the in-depth analysis results. Temporarily store low-priority threat events. The process of in-depth analysis of high-priority threat events is as follows: Perform threat severity assessment on each high-priority threat event, obtain the assessment parameter data set of each high-priority threat event, perform dimensionless processing on the assessment parameter data, generate the threat severity estimate corresponding to each high-priority threat event, and issue a warning signal for the high-priority threat event whose threat severity estimate exceeds the preset standard threshold; and mark the time points corresponding to the high-priority threat events on the timeline in chronological order within the predetermined time period T, and then use the sliding window algorithm combined with the preset density threshold to identify the time period when the threat event density exceeds the density threshold, and trigger the attention mechanism according to the analysis results of the time period; The process of identifying the time period when the threat event density exceeds the density threshold is as follows: Timeline marking: Mark high-priority threat events on the timeline in chronological order; Sliding window algorithm: A sliding window algorithm is used to calculate the density of high-priority threat events in each time period; Density threshold: Set the density threshold for the density of high-priority threat events, i.e. three events per hour; Identify high-density time periods: The sliding window moves on the timeline, calculates the number of high-priority threat events in each window, and compares it with the density threshold to identify the time period when the density of high-priority threat events exceeds the density threshold; Processing of several high-density time periods: When M high-density time periods are identified, the threat level estimates of high-priority threat events in each time period are averaged to obtain an average value; The attention mechanism is triggered according to the analysis results of the time period. When the value of M is 1, the high-density time period is paid attention to in the next time period T; when the value of M exceeds 1, the average value corresponding to each high-density time period is compared. In the next time period T, the attention priority of different high-density time periods is positively correlated with the size of the corresponding average value, and the corresponding high-density time period with the largest average value is paid attention to first; The process of executing corresponding strategies based on the results of in-depth analysis is as follows: When a high-priority threat event with an estimated threat level exceeding the preset standard threshold is issued with an early warning signal, network security staff are reminded to respond; if problems or threats are found during the monitoring process, security staff are also immediately reminded to respond; The evaluation parameter data set includes the number of keywords, threat complexity, and the difference between the threat event occurrence time and the current time; the threat complexity acquisition process is as follows: Second, build a rule engine to extract targets, attack methods, and attackers from the extracted feature information and define them as key factors. Then assign corresponding weights and scores to each key factor, and keep the weights and scores synchronized. Target: Core system, assigned weight 3 > ordinary system, assigned weight 2 > network, assigned weight 1; Attack method: Zero-day vulnerability, assigned weight 3> known vulnerability, assigned weight 2> port scan, assigned weight 1; Attacker: known hacker organizations are assigned a weight of 3 > unknown organizations are assigned a weight of 2 > individual attacks are assigned a weight of 1; Multiply the score of each factor by its weight and add up all the results to get the threat complexity; The threat severity estimate for each high priority threat event is generated based on the following formula: In the formula, Gw represents the estimated value of threat level, s represents the number of keywords, and tc represents the complexity of threat. represents the time decay factor, ch represents the difference between the time when the threat event occurs and the current time, and G represents the time constant; S6. Generate readable threat intelligence reports.

Images