A method, device, electronic device and storage medium for detecting threat intelligence

Abstract

The present invention relates to the field of network security, and specifically to a method, device, electronic device and storage medium for detecting threat intelligence. The present application can quickly determine whether the target intelligence data is threat intelligence by pre-calculating the hash value of the target intelligence data and matching it with a pre-built threat intelligence sample set. Compared with the traditional antivirus software detection method, the time and computing resources required for detection can be reduced. Secondly, by calculating the hash value combination of the threat intelligence samples in the threat intelligence sample set, and using the hash value combination to construct N arrays, the threat type of the target intelligence data can be accurately identified. It is conducive to helping enterprises to timely identify and respond to different types of network threats and improve network security.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method, device, electronic device and storage medium for detecting threat intelligence. Background Art

[0002] In the corporate office scenario, operators may inadvertently trigger the running of malicious programs or visit malicious websites when using terminal devices in the corporate office network, such as: unsafe downloads and installations on malicious websites, or clicking malicious links, etc. As a result, the company's office equipment may face security threats. The current traditional method is to install antivirus software on terminal devices to prevent the running of malicious programs or the access to malicious websites.

[0003] However, traditional antivirus software needs to analyze and extract features of network threats before updating the antivirus engine. This process usually requires the support of professional security researchers and powerful computing resources. It is not only time-consuming, but also unable to accurately detect the type of threat intelligence generated by network threats. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a threat intelligence detection method, device, electronic device and storage medium to solve the problem that traditional antivirus software takes a long time to detect network threats and cannot accurately detect the type of threat intelligence generated by network threats.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting threat intelligence, the method comprising:

[0006] Get the target intelligence data to be detected in the current client;

[0007] Obtaining a target hash value combination corresponding to the target intelligence data;

[0008] Matching the target hash value combination with a pre-constructed hash array to obtain a target array hit by each hash value in the hash value combination, wherein the hash array is constructed based on a hash value combination of intelligence data of different threat types;

[0009] The target threat type corresponding to the target intelligence data is determined according to the position information of the target array in the hash array.

[0010] In a second aspect, an embodiment of the present invention provides a threat intelligence detection device, the device comprising:

[0011] The first acquisition module is used to acquire the target intelligence data to be detected;

[0012] A second acquisition module is used to acquire a target hash value combination corresponding to the target intelligence data; wherein the target hash value combination includes k hash values ​​calculated based on a preset algorithm for the target intelligence data, where k is a natural number;

[0013] A matching module, used to match the target hash value combination with N pre-constructed arrays respectively to obtain matching results; wherein the N arrays are constructed based on the hash value combination of the threat intelligence sample set, each array includes k element groups, N is a natural number and N is determined based on the number of threat types in the threat intelligence sample set;

[0014] The determination module is used to determine whether the target intelligence data is threat intelligence based on the matching result, and determine the threat type if it is threat intelligence.

[0015] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, computer instructions being stored in the memory, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0016] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method of the first aspect or any corresponding embodiment thereof.

[0017] This application can quickly determine whether the target intelligence data is threat intelligence by pre-calculating the hash value of the target intelligence data and matching it with a pre-built threat intelligence sample set. Compared with traditional antivirus software detection methods, this application can greatly reduce the time and computing resources required for detection. Secondly, by calculating the hash value combination of the threat intelligence samples in the threat intelligence sample set and using the hash value combination to build N arrays, the threat type of the target intelligence data can be accurately identified. It is conducive to helping enterprises to identify and respond to different types of network threats in a timely manner and improve network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a schematic diagram of a system framework according to some embodiments of the present invention;

[0020] Figure 2 is a flowchart of a method for detecting threat intelligence according to some embodiments of the present invention;

[0021] Figure 3 is a flowchart of a method for detecting threat intelligence according to some embodiments of the present invention;

[0022] Figure 4 is a flowchart of a method for detecting threat intelligence according to some embodiments of the present invention;

[0023] Figure 5 is a flowchart of a method for detecting threat intelligence according to some embodiments of the present invention;

[0024] Figure 6 is a structural block diagram of a threat intelligence detection device according to an embodiment of the present invention;

[0025] Figure 7 It is a schematic diagram of the hardware structure of the electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0027] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0028] Herein, unless explicitly stated, executing a step “in response to A” does not mean executing the step immediately after “A” but may include one or more intermediate steps.

[0029] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0030] It is understandable that before using the technical solutions disclosed in the various embodiments of the present disclosure, the types, scopes of use, usage scenarios, etc. of the information involved in the present disclosure should be informed to relevant users and their authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations. The relevant users may include any type of right holders, such as individuals, enterprises, and groups.

[0031] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly prompt the relevant user that the operation requested to be performed will require obtaining and using the information of the relevant user, so that the relevant user can independently choose whether to provide information to software or hardware such as an electronic device, application, server or storage medium that executes the operation of the technical solution of the present disclosure based on the prompt message.

[0032] As an optional but non-limiting implementation, in response to receiving an active request from a relevant user, a prompt message is sent to the relevant user, for example, in the form of a pop-up window, in which the prompt message may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to select "agree" or "disagree" to provide information to the electronic device.

[0033] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0034] Office security usually involves the security management of networks, identities, and terminals. By implementing private network networking, access control, terminal management in private networks, and information security protection, digital office can be made safer, more efficient, and easier to use. Security management at the network level can ensure that private networks such as office networks can operate safely and efficiently, thereby ensuring that business data can be safely transmitted and stored. Security management at the identity level can improve the efficiency and security of identity authentication for users accessing private networks. Security management at the terminal level can achieve unified management of terminal devices within the private network, data leakage prevention, and terminal threat protection, thereby ensuring the security of corporate data.

[0035] In actual applications, the security management of networks, identities, and terminals can achieve technical linkage in multiple technical branches such as networking strategies, network access and control, remote access, unified terminal management, terminal detection and response, enterprise data leakage prevention, and identity authentication management, making digital office simpler, more efficient, and easier to implement.

[0036] In the corporate office scenario, the company's office equipment includes computers, notebooks and other terminal devices, which are usually connected to the Internet and use various software and browsers for office work. However, operators may inadvertently run malicious programs or visit malicious websites, causing the company's office equipment to face threat intelligence. Among them, malicious programs can be viruses, Trojans, worms, etc., which may be implanted in email attachments, downloaded files, unsafe websites, or induce operators to click through social engineering means. Once malicious programs are run on terminal devices, they may steal user information, damage file systems, obtain user activities, or spread uncontrollably to other devices. At the same time, malicious websites refer to websites controlled by hackers or criminal organizations, which may contain malware, phishing links or other fraudulent activities. When operators visit these websites, their computers may be infected, resulting in data leakage, account theft or other malicious activities.

[0037] At the same time, threat intelligence usually contains a large amount of information, which usually needs to be stored on the server side and provide an API for the terminal device to query the server side. However, when the query request volume is large, the server side API becomes a bottleneck, affecting the query efficiency, especially in the environment of private deployment of security management software, the client may not be able to directly access the Internet, or the privately deployed server may not be able to carry a large number of query requests, resulting in the inability to identify threat intelligence, affecting the network security of corporate office equipment.

[0038] Therefore, in the enterprise office scenario, it is crucial to prevent and respond to threat intelligence of malicious programs and malicious websites. Figure 1 , the architecture includes: a server 101 and multiple terminal devices 102. A client corresponding to the security management software is deployed on each terminal device, and the client is used to detect the threat intelligence existing on the terminal device. Specifically, the server 101 is used to run the server of the security management software, and the server is used to collect threat intelligence samples, and build N arrays according to the threat intelligence samples and the threat types of the threat intelligence samples. Then, the constructed N arrays are deployed on the clients of each terminal device 102, so that the client can detect the threat intelligence on the terminal device according to the N arrays in an offline state, and determine the threat type of the threat intelligence.

[0039] In this embodiment, a method for detecting threat intelligence is provided, which is applied to a client of security management software deployed on a terminal device in the above system architecture. Figure 2 FIG. 1 is a flowchart of a method for detecting threat intelligence according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0040] Step S11, obtaining the target intelligence data to be detected.

[0041] In the disclosed embodiment, the client of the security management software can obtain various threat intelligence data located on the terminal device by scanning and detecting the terminal device at multiple levels, including information on the operating system, application software, malware, network connection and user behavior, so as to help enterprises identify and respond to potential security threats. Specifically, the client can scan the operating system of the terminal device and its related information to obtain intelligence data, and the related information includes the operating system type, version number, patch level, etc. The client can scan the application software installed on the terminal device and obtain their version information. Intelligence data can be obtained by comparing with known vulnerability databases. The client can scan files and processes on the terminal device to detect whether there are malicious activities such as viruses, malware, spyware, etc., and obtain intelligence data. In addition, the client can also record the user's behavior on the terminal device, such as login records, file operation records, web browsing records, etc., to obtain threat intelligence.

[0042] Step S12, obtaining a target hash value combination corresponding to the target intelligence data; wherein the target hash value combination includes k hash values ​​calculated based on a preset algorithm for the target intelligence data, where k is a natural number.

[0043] In an embodiment of the present disclosure, before obtaining the target hash value combination corresponding to the target intelligence data, the method also includes: obtaining a whitelist sent by the server, wherein the whitelist includes multiple preset intelligence data; matching the target intelligence data with multiple intelligence data in the whitelist; if there is intelligence data matching the target intelligence data in the whitelist, determining that the target intelligence data is normal intelligence; or, if there is intelligence data matching the target intelligence data in the whitelist, performing a detection on the target intelligence data.

[0044] Specifically, the client can establish a connection with the server and send a request to obtain the whitelist. The server will respond to the client's request and send the whitelist data to the client. The whitelist is a collection that contains multiple preset intelligence data. These preset intelligence data are intelligence data that are detected by other clients and belong to threat types, but do not match the hash array collection in the server.

[0045] The client will compare the target intelligence data to be detected with multiple intelligence data in the whitelist. The target intelligence data can be a file, process, or network traffic, etc. If the target intelligence data can find matching intelligence data in the whitelist, then the client can determine that the target intelligence data is normal and safe data, because the intelligence data in the whitelist is defined as non-threatening data that does not match the hash array set in the server. If the target intelligence data does not have matching data in the whitelist, then the client needs to perform further detection on the target intelligence data.

[0046] Through the above steps, the client can use the whitelist to make a preliminary judgment on the target intelligence data, treat the intelligence data identified as in the whitelist as normal intelligence, and further detect the intelligence that does not match to identify potential threats. This can reduce the repeated detection of known normal data and improve detection efficiency.

[0047] In the disclosed embodiment, obtaining a target hash value combination corresponding to target intelligence data includes the following steps A1-A3:

[0048] Step A1, performing hash calculation on the target intelligence data using a preset hash algorithm to obtain a first target hash value and a second target hash value;

[0049] In one embodiment of the present disclosure, the hash algorithm used is the murmur3 algorithm. The intelligence data is calculated using the algorithm, which generates two target hash values, namely the first target hash value hash1 and the second target hash value hash2. Murmur3 is a non-encrypted hash function with fast calculation and low conflict rate. The specific calculation steps are as follows: pass the target intelligence data as input to the murmur3 algorithm. The murmur3 algorithm processes and calculates the input data to generate a 32-bit target hash value. This 32-bit target hash value is assigned to the variable hash1, i.e., the first target hash value. The input data is processed and calculated again to generate another 32-bit target hash value. This 32-bit target hash value is assigned to the variable hash2, i.e., the second target hash value.

[0050] Step A2, using the first target hash value and the second target hash value to calculate w other target hash values, where w is a natural number;

[0051] Specifically, the calculation formula is: hash_i = hash1 + i × hash2, where i represents the serial number of the target hash value, starting from 3 and increasing until the number of target hash values ​​k is reached. For example: when the number of target hash values ​​is 3, other target hash values ​​include the third target hash value, and the third target hash value is: hash_3 = hash1 + 3 × hash2. When the number of target hash values ​​is 4, other target hash values ​​include the third target hash value and the fourth target hash value, and the third target hash value is: hash_3 = hash1 + 3 × hash2. The fourth target hash value is: hash_4 = hash1 + 4 × hash2. According to the above formula, hash_w is calculated. It can be understood that the relationship between w and k is: w+2 = k.

[0052] Step A3, constructing k target hash values ​​of target intelligence data based on the first target hash value, the second target hash value and w other target hash values.

[0053] Specifically, after obtaining the first target hash value, the second target hash value and other target hash values, a target hash value combination of target intelligence data can be constructed based on the first target hash value, the second target hash value and w other target hash values.

[0054] The disclosed embodiment can obtain different numbers of target hash values ​​according to different threat types and encoding bit numbers, so as to more flexibly deal with different types of threats. At the same time, the first target hash value and the second target hash value are used to calculate other target hash values. In this way, more different target hash values ​​can be obtained under the premise of ensuring data integrity, thereby improving the ability to identify and match threats. Finally, a target hash value combination is constructed based on the first target hash value, the second target hash value and other target hash values. Thereby, different target hash values ​​can be combined to form a more comprehensive and comprehensive target hash value combination, thereby improving the accuracy of identifying and matching threats.

[0055] Step S13, matching the target hash value combination with the pre-constructed N arrays respectively to obtain matching results; wherein the N arrays are constructed based on the hash value combination of the threat intelligence sample set, each array includes k element groups, N is a natural number and N is determined based on the number of threat types in the threat intelligence sample set.

[0056] In an embodiment of the present application, given a threat intelligence sample set, the number of threat types t can be obtained by counting the number of threat samples of different types in the set. Each different threat type corresponds to a unique number ranging from 1 to t. The number of threat types t can be converted into binary form, and the number of bits N of the code can be determined. For example, if t=4, then N=3, because the binary of 4 is 100, which can be represented by at least 3 binary bits. That is, if 001, 010, 011, and 100 are used as the binary codes corresponding to the four threat types, then N=3. Here, by converting the number of each threat type into the corresponding N-bit binary code, the codes corresponding to t threat intelligence types are obtained. After determining the N-bit binary code, the corresponding array can be created according to the value of each binary bit (0 or 1). For example, for a 3-bit binary code, three arrays can be created. Each array includes k element groups, where N is a natural number and N is determined based on the number of threat types in the threat intelligence sample set. The k element groups correspond to k hash values.

[0057] In the embodiment of the present application, the target hash value combination is matched with the pre-built N arrays respectively, and the binary code of N bits is determined according to the matching results, including the following steps B1-B2:

[0058] Step B1, matching the k hash values ​​in the target hash value combination with the k element groups in each of the N arrays one by one, to obtain the target element corresponding to each hash value in the corresponding element group.

[0059] That is, for each of the N arrays, the k hash values ​​in the target hash value combination are matched with the k element groups in the array to obtain the target element corresponding to each hash value in the corresponding element group;

[0060] Specifically, since the number of target hash value combinations and element groups is k, the corresponding element group is determined from the k element groups in each array according to the k hash values ​​in the target hash value combination, and the corresponding target element is found from the corresponding element group. For example: Assume that the target hash value combination includes hash_1, hash_2 and hash3, and the array includes 3 element groups, namely element group 1, element group 2, element group 3, and each element group includes q elements. At this time, it can be determined that hash_1 corresponds to element group 1, hash_2 corresponds to element group 2, and hash_3 corresponds to element group 3. Then, the numerical value corresponding to each hash value is used as an index to determine the target element from the corresponding element group. Specifically, the target element position hit by the hash value is obtained from the element group, and the element corresponding to the target element position is used as the target element. Assume that hash_1=5, hash_2=7 and hash_3=9. The 5th element in element group 1 is used as the target element corresponding to hash_1, the 7th element in element group 2 is used as the target element corresponding to hash_2, and the 9th element in element group 3 is used as the target element corresponding to hash_3.

[0061] Step B2, determining the encoding value corresponding to each array according to the element value of the target element in the array.

[0062] Specifically, obtain the element value of each target element in each array, determine the code value of the current array according to the element value of each target element, and finally obtain the N-bit binary code according to the N code values ​​corresponding to the N arrays. For example: Assume that N is 3. hash_1 = 5, hash_2 = 7 and hash_3 = 9. The 5th element H1 in element group 1 is used as the target element corresponding to hash_1, the 7th element H7 in element group 2 is used as the target element corresponding to hash_2, and the 9th element H9 in element group 3 is used as the target element corresponding to hash_3.

[0063] First, determine whether H5 in element group 1 of the first array is 1, whether H7 in element group 2 of the first array is 1, and whether H9 in element group 3 of the first array is 1. That is, if H5, H7, and H9 in the first array are all 1, then the target hash value combination matches the first array, and the encoding value of the first array is 1. Secondly, for the second array, determine whether H5 in its element group 1 is 1, whether H7 in its element group 2 is 1, and whether H59 in its element group 3 is 1. If at least one of H5, H7, and H9 in the second array is 0, then the target hash value combination does not match the second array, and the encoding value of the second array is 0. Finally, determine whether H5 in element group 1 of the third array is 1, whether H7 in element group 2 of the third array is 1, and whether H9 in element group 3 of the third array is 1. If at least one of H5, H7, and H9 in the third element group is 0, then the target hash value combination does not match the third array, and the encoding value of the third array is 0. In this way, the binary code 100 is obtained.

[0064] Step B3, constructing an N-bit binary code according to the code value corresponding to each of the N arrays, and taking the N-bit binary code as the matching result.

[0065] Specifically, at this time, an N-bit binary code may be directly constructed according to the code value corresponding to each of the root N arrays, and the N-bit binary code may be used as the matching result.

[0066] The following is a complete example: Assume there are 3 arrays, each array contains k = 3 element groups, each element group includes q = 5 elements, and the value of the element is 0 or 1. The target hash value combination includes: hash_1 = 2, hash_2 = 4 and hash_3 = 1. The three arrays are as follows:

[0067] Array 1: [(1,1,1,0,1),(0,1,0,1,0), (1,1,0,1,0)]

[0068] Array 2: [(0,0,0,1,0),(1,0,1,0,1),(0,1,0,1,0)]

[0069] Array 3: [(0,0,0,0,0),(1,0,0,0,0),(0,0,0,0,0)]

[0070] At this time, we can determine from the first element group in array 1 that hash_1 corresponds to the target element, that is, the second element in the first element group, whose element value is "1". We can determine from the second element group in array 1 that hash_2 corresponds to the target element, that is, the fourth element in the second element group, whose element value is "1". We can determine from the third element group in array 1 that hash_3 corresponds to the target element, that is, the first element in the third element group, whose element value is "1". At this time, we can determine that the element values ​​of the target elements in array 1 are all "1", so the encoding value of array 1 is "1". According to the above scheme, we determine from array 2 that the element values ​​of the target elements are all "0". And we determine from array 3 that the element values ​​of the target elements are all "0". Finally, the binary code is determined to be "100".

[0071] In the above embodiment, the hash value may be set to be a natural number from 1 to q.

[0072] In one embodiment of the present invention, if the target element value of a target element in an array has both "1" and "0", it can be determined that the encoding value of the array is "1". Because in the actual detection process of threat intelligence, there may be false positives and missed detections. Therefore, when the element value of a target element in an array has both "1" and "0", it is first recorded as threat intelligence. The client then sends such intelligence data to the server, and the server detects the type of such intelligence data.

[0073] The embodiment of the present application can quickly and accurately determine the target element corresponding to each hash value by matching the target hash value with the elements in the array. This can avoid traversing the entire array, thereby improving the efficiency of matching. Secondly, the corresponding encoding value is determined according to the element value of the target element in each array, and multiple element values ​​in multiple arrays can be simplified into unique encoding values. The complexity of the encoding and the storage space can be reduced.

[0074] Step S14, judging whether the target intelligence data is threat intelligence according to the matching result, and determining the threat type if it is threat intelligence.

[0075] In an embodiment of the present application, whether the target intelligence data is threat intelligence is determined based on the matching result, and the threat type is determined if it is threat intelligence, including: obtaining a correspondence between a preset N-bit binary code and a preset threat type, and based on the correspondence, determining whether there is a preset binary code consistent with the N-bit binary code; if so, determining that the target intelligence data belongs to threat intelligence, and using the preset threat type corresponding to the N-bit binary code as the threat type of the target intelligence data.

[0076] Specifically, determine the value range of the preset N-bit binary code. For example, if N is 3 bits, the binary code can be one or more of 001, 010, 011, 100, 101, 110, or 111. Then, it is necessary to determine the correspondence between each preset N-bit binary code and the preset threat type. This can be achieved through a mapping table or a dictionary. For example, a mapping table with the following correspondence can be established: 001→threat type 1, 010→threat type 2, 011→threat type 3, 100→threat type 4. Next, the N-bit binary code of the target intelligence data can be compared with the preset N-bit binary code to determine whether there is a matching preset binary code.

[0077] This application can quickly determine whether the target intelligence data is threat intelligence by pre-calculating the hash value of the target intelligence data and matching it with the pre-built threat intelligence sample set. Compared with the traditional antivirus software detection method, this application can greatly reduce the time and computing resources required for detection. Secondly, by calculating the hash value combination of the threat intelligence samples in the threat intelligence sample set and using the hash value combination to build N arrays, the threat type of the target intelligence data can be accurately identified. It is conducive to helping enterprises to timely identify and respond to different types of network threats and improve network security. In addition, the pre-built N arrays are deployed on the client to realize real-time threat identification of target intelligence data in a private deployment environment without waiting for the response of the external server. There is no need for the client to directly access the Internet, which reduces the dependence on the external network, and also reduces the possibility of being attacked, ensuring the security of the client. It solves the security problem caused by the inability of the client to connect to the Internet in a private deployment environment.

[0078] In the embodiment of the present application, N arrays are constructed based on the hash value combination of the threat intelligence sample set, such as Figure 3 As shown, the method comprises the following steps:

[0079] Step S21: Initialize all elements in N arrays to first preset values, wherein each of the N arrays includes k element groups, each element group includes q elements, and q is a natural number.

[0080] In an embodiment of the present application, the elements in the N arrays are initialized to a first preset value, and the first preset value is 0, that is, each element in the N arrays is set to 0. Among them, the N arrays include k element groups, indicating that there are N arrays, each array contains k elements. For example, if N=3, k=4, there are 3 arrays, each array contains 4 elements. Each element group includes q elements, indicating that each element in the array is a tuple, and the tuple contains q elements. For example, if q=2, each tuple consists of 2 elements.

[0081] For example, there are N=3 arrays, each array contains k=3 element groups, each element group includes q=5 elements, and the values ​​of all elements in each array are initialized to 0. The three arrays after initialization are as follows:

[0082] Array 1: [(0,0,0,0,0),(0,0,0,0,0),(0,0,0,0,0)].

[0083] Array 2: [(0,0,0,1,0),(0,0,0,0,0),(0,0,0,0,0)].

[0084] Array 3: [(0,0,0,0,0),(0,0,0,0,0),(0,0,0,0,0)].

[0085] It should be noted that in the actual process of detecting threat intelligence, false alarms (false positives) may occur. Even if all bits are 1, it may be a coincidence that the key is mistakenly judged to exist in the target set, but in fact the key is not in the target array. There is a relationship between the collision probability and the number of stored binary bits m = k*q, the number of threat intelligence samples v in the threat intelligence sample set (usually in the millions), and the probability of hitting the array ε, as follows:

[0086]

[0087] The current optimal number of element groups is calculated based on the probability of hitting the array. The calculation formula is as follows: Where k is the number of element groups. Finally, the number of elements q in each element group is obtained according to the ratio of the number of threat intelligence samples in the threat intelligence sample set to the number of element groups k.

[0088] Step S22: for each threat intelligence sample in the threat intelligence sample set, at least one target array is determined from N arrays based on the threat type of the threat intelligence sample, and k hash values ​​of the threat intelligence sample are calculated based on a preset algorithm.

[0089] In an embodiment of the present application, a threat intelligence sample set is obtained, and in one embodiment, there are 6 million threat intelligence samples in the set. By selecting the threat intelligence that has been hit recently, the size of the array can be reduced to a certain extent. This can reduce the storage and query load of the client on the array and improve overall performance and efficiency. Secondly, selecting the threat intelligence data that has been hit recently to build multiple arrays can improve the hit rate of the array. Because the data that has been hit recently is more likely to appear again in a short period of time, these data are preferentially built into the array, which can more accurately filter out malicious programs and domain names. Reduce false positives and improve the accuracy and reliability of the system.

[0090] In an embodiment of the present application, N is a natural number and N is determined based on the number of threat types in the threat intelligence sample set, including: obtaining the number of threat types t in the threat intelligence sample set, where t is a natural number; setting t different binary codes corresponding one-to-one to the t threat intelligence types, and the number of bits of the t different binary codes is the same and the number of bits is N; determining the number of arrays to be N.

[0091] Specifically, based on the current threat intelligence sample set, the number of threat types t can be obtained by counting the number of threat samples of different types in the set. Each different threat type corresponds to a unique number ranging from 1 to t. The number of threat types t can be converted into binary form and the number of bits N of the code can be determined. For example, if t=4, then N=3, because the binary of 4 is 100, which requires 3 bits to represent. By converting the number of each threat type into the corresponding N-bit binary code, the codes corresponding to t threat intelligence types are obtained. After determining the N-bit binary code, the corresponding array can be created according to the value of each binary bit (0 or 1). For example, for a 3-bit binary code, three arrays can be created. Each array includes k element groups, where N is a natural number and N is determined based on the number of threat types in the threat intelligence sample set. The k element groups correspond to k hash values.

[0092] In an embodiment of the present application, k hash values ​​of the threat intelligence sample are calculated based on a preset algorithm, including: using a preset hash algorithm to perform hash calculation on the threat intelligence sample to obtain a first hash value and a second hash value; using the first hash value, the second hash value and w other hash values, where w is a natural number; and constructing k hash values ​​of the threat intelligence sample based on the first hash value, the second hash value and w other hash values.

[0093] Specifically, calculate the first hash value hash1: apply the Murmur3 algorithm to the input data to obtain a 32-bit integer value as hash1. Calculate the second hash value hash2: apply the Murmur3 algorithm to the input data to obtain a 32-bit integer value as hash2 again. Define k: represents the number of hash values ​​to be calculated. Calculate other hash values: for i from 1 to n-1, calculate hash_i = hash1 + i × hash2 in sequence. 7. Get a set of hash values: hash_1, hash_2, ..., hash_n, that is, a set of hash values ​​calculated based on the recorded data.

[0094] In one embodiment of the present disclosure, if the binary code corresponding to the threat type of the threat intelligence sample is 100, the first array of the three arrays is the target array. If the binary code corresponding to the threat type of the threat intelligence sample is 011, the second array and the third array of the three arrays are the target arrays.

[0095] Step S23: for each target array, based on the k hash values ​​of the threat intelligence sample, the values ​​of corresponding elements in the k element groups in the target array are set to second preset values.

[0096] In the embodiment of the present application, since the number of hash value combinations and element groups corresponding to the threat intelligence sample is k, the element group corresponding to it is determined from the k element groups in each target array according to the k hash values ​​in the hash value combination, and the corresponding target element is found from the corresponding element group. For example: Assume that the hash value combination of the threat intelligence sample includes hash_1, hash_2 and hash3, and the array includes 3 element groups, namely element group 1, element group 2, element group 3, and each element group includes q elements. At this time, it can be determined that hash_1 corresponds to element group 1, hash_2 corresponds to element group 2, and hash_3 corresponds to element group 3. Then use the numerical value corresponding to each hash value as an index to determine the corresponding element from its corresponding element group.

[0097] Specifically, the element position hit by the hash value is obtained from the element group, and the element corresponding to the element position is used as the target element corresponding to the hash value. Assume that hash_1=2, hash_2=3 and hash_3=4. The second element in element group 1 is used as the element corresponding to hash_1, the third element in element group 2 is used as the element corresponding to hash_2, and the fourth element in element group 3 is used as the element corresponding to hash_3. Then the binary code corresponding to the threat type is obtained. Assume that the threat intelligence sample is "Trojan horse", and the binary code corresponding to the threat type "Trojan horse" is "011". At this time, the element value of the second element in element group 1 in the second array is set to "1", the element value of the third element in element group 2 is set to "1", and the element value of the fourth element in element group 3 is set to "1". And the element value of the second element in element group 1 in the third array is set to "1", the element value of the third element in element group 2 is set to "1", and the element value of the fourth element in element group 3 is set to "1". Since the binary code is "011", the element value of the target element in the first array remains "0". The updated array is as follows:

[0098] Array 1: [(0,0,0,0,0),(0,0,0,0,0),(0,0,0,0,0)].

[0099] Array 2: [(0,1,0,0,0),(0,0,1,0,0),(0,0,0,1,0)].

[0100] Array 3: [(0,1,0,0,0),(0,0,1,0,0),(0,0,0,1,0)].

[0101] Then, the N arrays are updated in sequence according to the hash value combinations corresponding to the threat intelligence data of each threat type in the threat intelligence sample, until the N arrays are updated using the hash value combinations of all threat intelligence in the threat intelligence sample set, and the final N arrays are obtained. Assume that the final N arrays are as follows:

[0102] Array 1: [(0,0,0,0,0),(1,0,0,0,0),(0,0,0,0,0)].

[0103] Array 2: [(1,1,1,0,1),(0,1,0,1,0), (1,1,0,1,0)].

[0104] Array 3: [(0,1,0,1,0),(1,0,1,0,1),(0,1,0,1,1)].

[0105] It should be noted that after the server completes the construction of the hash array, it will deploy the constructed hash array to the client, so that the client can complete the detection of threat intelligence locally. In addition, the server can also optimize the binary encoding of the threat type to achieve the update of the hash array. The specific operation can be performed through the actual statistical distribution of the number of each threat intelligence. For example, if the number of a certain threat type accounts for a large proportion, the binary bits of this type can be made more dispersed by re-encoding. In addition, the size of the bit array and the number of hash functions can be adjusted according to the actual situation to adapt to the distribution of different types of distributions, and further optimize the grouping strategy of the hash array. This can improve the performance and accuracy of the hash array and make it more adaptable to the actual distribution of the number of threat intelligence.

[0106] In the embodiments of the present disclosure, Figure 4 As shown, after determining the target threat type corresponding to the target intelligence data according to the position information of the target array in the hash array, the method further includes:

[0107] Step S31, sending the target intelligence data and the target threat type to the server, wherein the server is used to verify the target intelligence data, and if the target intelligence data does not match any of the hash arrays in the hash array set, a whitelist update instruction is sent to the client.

[0108] Specifically, the target intelligence data and the target threat type are sent to the server. The target intelligence data includes the key information and description of the target, and the target threat type can also be sent to the server. After receiving the target intelligence data, the server will verify the key information therein. In this scenario, the server will calculate the target hash value combination corresponding to the target intelligence data, and match its hash value combination with each hash array in the hash array set it maintains. If the hash value of the target intelligence data does not match any hash array in the hash array set, it means that the target intelligence data does not belong to the threat type and the whitelist needs to be updated. The server will send a whitelist update instruction to the client, informing the client to perform corresponding operations, such as updating the content of the whitelist.

[0109] Step S32: receiving a whitelist update instruction sent by the server.

[0110] Specifically, the client needs to ensure that the whitelist update instruction sent by the server is successfully received.

[0111] Step S33: based on the whitelist update instruction, update the target intelligence data to the whitelist.

[0112] Specifically, the client needs to parse the instructions sent by the server to understand the updated content and operations. According to the parsed instruction content, the client performs corresponding operations to update the whitelist. For example, it includes adding target intelligence data to the whitelist deployed locally on the client. After completing the update operation, the client should send a confirmation message to the server to ensure that the whitelist update operation is successfully executed.

[0113] The method provided by the embodiment of the present disclosure sends the target intelligence data to the server for verification, which can ensure the validity and integrity of the data. By matching the target intelligence data with a hash array, it is possible to quickly determine whether the data belongs to a known threat type. If the target intelligence data does not match any hash array, the server will send a whitelist update instruction to the client. In this way, the client can update the whitelist in a timely manner and add new target intelligence data to the whitelist to ensure the identification and protection of new threats. By uploading the target intelligence data to the server for verification, unverified data can be prevented from entering the client. Only data that has been verified and stored in the whitelist can be considered credible, thereby improving the security of the network.

[0114] In the embodiments of the present disclosure, Figure 5 As shown, after determining the threat type, the method further includes:

[0115] Step S41, obtaining an intelligence processing strategy corresponding to the target threat type. After determining the threat type, the method further includes:

[0116] Specifically, the client can pre-configure the corresponding processing strategies for each threat type, for example: Virus intelligence processing strategy: For virus threats, it is necessary to update and use the latest antivirus software in a timely manner, perform virus scans and system checks regularly, and repair and isolate infected files and devices in a timely manner. Trojan intelligence processing strategy: For Trojan threats, it is necessary to strengthen network security protection, use firewalls and intrusion detection systems, regularly check and clean infected computers, and strengthen user education and security awareness.

[0117] Worm intelligence processing strategy: To address worm threats, it is necessary to promptly update and use the latest operating system and application patches, strengthen the configuration and management of network security devices, and regularly check and clean infected devices.

[0118] Step S42, processing the target intelligence data according to the intelligence processing strategy to obtain processed target intelligence data.

[0119] Specifically, for virus data, we can extract and analyze virus features and propagation methods, such as virus code, infected file types, and propagation paths. For Trojan data, we can analyze Trojan behaviors and functions, such as data theft and remote control, and identify infected devices and affected data. For worm data, we can analyze the propagation paths and infection ranges of worms, identify infected devices, and take timely isolation and repair measures.

[0120] Step S43, detecting the processed target intelligence data to determine the threat level of the processed target intelligence data to the client.

[0121] Specifically, threat intelligence detection tools or systems are used to analyze and detect the processed target intelligence data. These tools may include threat intelligence platforms, security information and event management systems (SIEM), intrusion detection systems (IDS), intrusion prevention systems (IPS), etc. The threat level of the detected threat intelligence data is determined based on its characteristics, sources, impact range, and other factors. The threat level includes low, medium, and high levels, and can also be more finely classified according to specific circumstances.

[0122] Step S44, performing security processing on the processed target intelligence data according to security measures corresponding to the threat level.

[0123] Specifically, according to the determined threat level, formulate corresponding security measures to deal with the threats brought by the target intelligence data. For example, for low-level threats, you can take detection and warning measures, strengthen network security policies, update firewall rules, etc. For medium-level threats, it may be necessary to strengthen intrusion detection and emergency response capabilities, and patch or upgrade the system. For high-level threats, it may be necessary to take emergency measures immediately, such as isolating infected systems, suspending key services, and notifying relevant parties. Continuously detect and evaluate the implementation effect of security measures, and adjust and optimize security strategies in a timely manner. At the same time, the detected threat intelligence data will be fed back to the relevant team to improve defense measures and enhance security awareness.

[0124] The disclosed embodiment can formulate different intelligence processing strategies in a targeted manner to deal with various threats according to the target threat type. This ensures that different types of threats are handled in a targeted manner, improving processing efficiency and accuracy. Then, the target intelligence data is processed according to the formulated intelligence processing strategy, which can effectively filter, clean or process the data to make it more in line with the needs and security standards of the client. It helps to improve processing efficiency and reduce false alarm rates. Detecting the processed target intelligence data can more accurately assess its threat level to the client. At the same time, by comprehensively considering factors such as the content, source, and characteristics of the processed data, the threat level can be determined more accurately, so that appropriate security measures can be taken. Finally, according to the security measures corresponding to the threat level, corresponding countermeasures can be taken in a targeted manner. This includes but is not limited to security measures such as blocking, isolation, removing malicious code, and strengthening identity authentication to minimize potential risks and losses.

[0125] In this embodiment, a threat intelligence detection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0126] This embodiment provides a threat intelligence detection device, such as Figure 6 As shown, including:

[0127] A first acquisition module 61 is used to acquire intelligence data of a target to be detected;

[0128] A second acquisition module 62 is used to acquire a target hash value combination corresponding to the target intelligence data; wherein the target hash value combination includes k hash values ​​calculated based on a preset algorithm for the target intelligence data, where k is a natural number;

[0129] A matching module 63 is used to match the target hash value combination with N pre-constructed arrays respectively to obtain matching results; wherein the N arrays are constructed based on the hash value combination of the threat intelligence sample set, each array includes k element groups, N is a natural number and N is determined based on the number of threat types in the threat intelligence sample set;

[0130] The determination module 64 is used to determine whether the target intelligence data is threat intelligence according to the matching result, and determine the threat type if it is threat intelligence.

[0131] In an embodiment of the present application, the device also includes: a setting module for obtaining the number t of threat types in the threat intelligence sample set, where t is a natural number; setting t different binary codes corresponding one-to-one to the t threat intelligence types, and the number of bits of the t different binary codes is the same and the number of bits is N; and determining the number of arrays to be N.

[0132] In the embodiment of the present application, the device further includes: a building module, including:

[0133] An initialization submodule, used to initialize the elements in N arrays to first preset values, wherein each array in the N arrays includes k element groups, each element group includes q elements, wherein q is a natural number;

[0134] A calculation submodule, configured to determine, for each threat intelligence sample in the threat intelligence sample set, at least one target array from the N arrays based on the threat type of the threat intelligence sample, and calculate k hash values ​​of the threat intelligence sample based on a preset algorithm;

[0135] A setting submodule is used to set, for each target array, the values ​​of corresponding elements in the k element groups in the target array to second preset values ​​based on the k hash values ​​of the threat intelligence sample.

[0136] In an embodiment of the present application, a calculation submodule is used to perform hash calculation on target intelligence data using a preset hash algorithm to obtain a first hash value and a second hash value; use the first hash value, the second hash value and w other hash values, where w is a natural number; and construct k hash values ​​of a threat intelligence sample based on the first hash value, the second hash value and w other hash values.

[0137] In the embodiment of the present application, the matching module 63 is used to match the k hash values ​​in the target hash value combination with the k element groups in each of the N arrays to obtain the target element corresponding to each hash value in the corresponding element group; determine the encoding value corresponding to the array according to the element value of the target element in each array; construct an N-bit binary code according to the encoding value corresponding to each array in the N arrays, and use the N-bit binary code as the matching result.

[0138] In an embodiment of the present application, the determination module 64 is used to obtain the correspondence between the preset N-bit binary code and the preset threat type, and based on the correspondence, determine whether there is a preset binary code consistent with the N-bit binary code; if so, it is determined that the target intelligence data belongs to threat intelligence, and the preset threat type corresponding to the N-bit binary code is used as the threat type of the target intelligence data.

[0139] In an embodiment of the present application, the method is executed by a client, and the pre-built N arrays are deployed on the client.

[0140] In an embodiment of the present application, the device also includes: a verification module, which is used to obtain a whitelist list sent by the server; match the target intelligence data with multiple intelligence data in the whitelist list; if there is intelligence data matching the target intelligence data in the whitelist list, it is determined that the target intelligence data does not belong to threat intelligence; or, if there is intelligence data matching the target intelligence data in the whitelist list, a detection of the target intelligence data is performed.

[0141] In an embodiment of the present application, the device also includes: an update module, used to send target intelligence data and target threat types to a server, wherein the server is used to verify the target intelligence data, and if the target intelligence data does not match any of the hash arrays in the hash array set, a whitelist update instruction is sent to the client; receiving the whitelist update instruction sent by the server; and updating the target intelligence data to the whitelist list based on the whitelist update instruction.

[0142] In an embodiment of the present application, the device also includes: a processing module, which is used to obtain an intelligence processing strategy corresponding to the target threat type; process the target intelligence data according to the intelligence processing strategy to obtain processed target intelligence data; detect the processed target intelligence data to determine the threat level of the processed target intelligence data to the client; and respond to the processed target intelligence data according to security measures corresponding to the threat level.

[0143] This application can quickly determine whether the target intelligence data is threat intelligence by pre-calculating the hash value of the target intelligence data and matching it with the pre-built threat intelligence sample set. Compared with the traditional antivirus software detection method, this application can greatly reduce the time and computing resources required for detection. Secondly, by calculating the hash value combination of the threat intelligence samples in the threat intelligence sample set and using the hash value combination to build N arrays, the threat type of the target intelligence data can be accurately identified. It is conducive to helping enterprises to timely identify and respond to different types of network threats and improve network security. In addition, the pre-built N arrays are deployed on the client to realize real-time threat identification of target intelligence data in a private deployment environment without waiting for the response of the external server. There is no need for the client to directly access the Internet, which reduces the dependence on the external network, and also reduces the possibility of being attacked, ensuring the security of the client. It solves the security problem caused by the inability of the client to connect to the Internet in a private deployment environment.

[0144] See also Figure 7 , Figure 7 is a schematic diagram of the structure of an electronic device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the electronic device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0145] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0146] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0147] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the use of an electronic device based on the presentation of a small program landing page, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0148] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0149] The electronic device further comprises a communication interface 30 for the electronic device to communicate with other devices or a communication network.

[0150] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0151] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A threat intelligence detection method, characterized in that: The method comprises: Obtain intelligence data of the target to be detected; Obtaining a target hash value combination corresponding to the target intelligence data; wherein the target hash value combination includes k hash values ​​calculated based on a preset algorithm for the target intelligence data, where k is a natural number; Match the target hash value combination with N pre-constructed arrays respectively to obtain matching results; wherein the N arrays are constructed based on the hash value combination of the threat intelligence sample set, each array includes k element groups, N is a natural number and N is determined based on the number of threat types in the threat intelligence sample set; Determining whether the target intelligence data is threat intelligence based on the matching result, and determining the threat type if it is threat intelligence; The method of matching the target hash value combination with the pre-constructed N arrays respectively to obtain a matching result includes: matching the k hash values ​​in the target hash value combination with the k element groups in each of the N arrays to obtain a target element corresponding to each hash value in the corresponding element group; determining a code value corresponding to each array according to the element value of the target element in each array; constructing an N-bit binary code according to the code value corresponding to each of the N arrays, and using the N-bit binary code as the matching result.

2. The method according to claim 1, characterized in that N is a natural number and N is determined based on the number of threat types in the threat intelligence sample set, including: Obtain the number t of threat types in the threat intelligence sample set, where t is a natural number; Set t different binary codes corresponding to the t threat intelligence types one by one, where the number of bits of the t different binary codes is the same and the number of bits is N; The number of arrays is determined to be N.

3. The method according to claim 1 or 2, characterized in that: N arrays are constructed based on the hash value combinations of the threat intelligence sample collection, including: Initialize all elements in N arrays to first preset values, wherein each array in the N arrays includes k element groups, each element group includes q elements, and q is a natural number; For each threat intelligence sample in the threat intelligence sample set, determine at least one target array from the N arrays based on the threat type of the threat intelligence sample, and calculate k hash values ​​of the threat intelligence sample based on the preset algorithm; For each of the target arrays, based on the k hash values ​​of the threat intelligence sample, the values ​​of corresponding elements in the k element groups in the target array are set to second preset values.

4. The method according to claim 3, characterized in that: The calculating k hash values ​​of the threat intelligence sample based on the preset algorithm includes: Performing hash calculation on the threat intelligence sample using a preset hash algorithm to obtain a first hash value and a second hash value; Using the first Hash value and the second Hash value, calculate w other Hash values, where w is a natural number; Construct k hash values ​​of the threat intelligence sample based on the first hash value, the second hash value and w other hash values.

5. The method according to claim 1, characterized in that The determining whether the target intelligence data is threat intelligence according to the matching result, and determining the threat type if it is threat intelligence, includes: Obtain the correspondence between the preset N-bit binary code and the preset threat type, Based on the corresponding relationship, determining whether there is a preset binary code that is consistent with the N-bit binary code; If so, it is determined that the target intelligence data belongs to threat intelligence, and the preset threat type corresponding to the N-bit binary code is used as the threat type of the target intelligence data.

6. The method according to claim 1, characterized in that The method is executed by a client, and the pre-built N arrays are deployed on the client.

7. The method according to claim 6, characterized in that Before obtaining the target hash value combination corresponding to the target intelligence data, the method further includes: Get the whitelist sent by the server; Matching the target intelligence data with multiple intelligence data in the whitelist; If there is intelligence data matching the target intelligence data in the whitelist, it is determined that the target intelligence data does not belong to threat intelligence; or, if there is no intelligence data matching the target intelligence data in the whitelist, a detection of the target intelligence data is performed.

8. The method according to claim 7, characterized in that The method further comprises: Sending the target intelligence data and the target threat type to the server, wherein the server is used to verify the target intelligence data, and if the target intelligence data does not match any of the hash arrays in the hash array set, sending a whitelist update instruction to the client; Receiving a whitelist update instruction sent by the server; Based on the whitelist update instruction, the target intelligence data is updated to the whitelist list.

9. The method according to claim 1, characterized in that: After determining the threat type, the method further includes: Obtaining intelligence processing strategies corresponding to the threat types; Processing the target intelligence data according to the intelligence processing strategy to obtain processed target intelligence data; Detect the processed target intelligence data to determine the threat level of the processed target intelligence data to the client; The processed target intelligence data is securely processed according to security measures corresponding to the threat level.

10. A threat intelligence detection device, characterized in that: The device comprises: The first acquisition module is used to acquire the target intelligence data to be detected; A second acquisition module is used to acquire a target hash value combination corresponding to the target intelligence data; wherein the target hash value combination includes k hash values ​​calculated based on a preset algorithm for the target intelligence data, where k is a natural number; A matching module, used to match the target hash value combination with N pre-constructed arrays respectively to obtain matching results; wherein the N arrays are constructed based on the hash value combination of the threat intelligence sample set, each array includes k element groups, N is a natural number and N is determined based on the number of threat types in the threat intelligence sample set; wherein the target hash value combination is matched with the pre-constructed N arrays respectively to obtain matching results, including: matching the k hash values ​​in the target hash value combination with the k element groups in each of the N arrays to obtain the target element corresponding to each hash value in the corresponding element group; determining the code value corresponding to the array according to the element value of the target element in each array; constructing an N-bit binary code according to the code value corresponding to each of the N arrays, and using the N-bit binary code as the matching result; The determination module is used to determine whether the target intelligence data is threat intelligence based on the matching result, and determine the threat type if it is threat intelligence.

11. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 9 by executing the computer instructions.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 9.

Images