A cloud service platform multi-dimensional threat intelligence source evaluation and sharing method and system

Abstract

The application relates to a cloud service platform multi-dimensional threat intelligence source evaluation and sharing method and system, and belongs to the network security field, which comprises the following steps: collecting multi-source threat intelligence data; performing consistency processing on multi-source threat intelligence data with different structures; according to the multi-source threat intelligence data after the consistency processing, taking data characteristics, platform characteristics and economic characteristics as analysis dimensions, analyzing and evaluating each threat intelligence source; and sharing the analysis and evaluation results to each related threat intelligence source. The multi-source heterogeneous threat intelligence data is adjusted into a unified format standard through the consistency processing on the multi-source threat intelligence data with different structures. The data characteristics, platform characteristics and economic characteristics are taken as the analysis dimensions to comprehensively analyze and evaluate each threat intelligence source, so that the decision difficulty of users is reduced, and the actual effect of threat intelligence in network security application is improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of security technology, and particularly relates to a cloud service platform multi-dimensional threat intelligence source evaluation and sharing method and system. BACKGROUND

[0002] Currently, threat intelligence is evidence-based knowledge about existing or potential threats to IT or information assets, including context, mechanism, indicators, inferences, and actionable recommendations, which can provide decision-making basis for threat response. These threat intelligence data bear the task of in-depth insight into the nature, source and potential impact of network threats. With the help of threat intelligence data, the attacker's action path in cyberspace can be restored, and highly practical insights can be provided for network security decision-makers, so as to formulate more accurate countermeasures in the complex network attack environment. A single threat intelligence data source cannot provide comprehensive and accurate information, which limits the effectiveness of network security defense. Therefore, threat intelligence sharing has become an inevitable trend.

[0003] However, the existing threat intelligence lacks a unified format standard. In the face of massive and multi-source threat intelligence, users often feel decision-making pressure and have difficulty in determining which information is more critical, which not only increases the difficulty of decision-making, but also may weaken the actual effect of threat intelligence in network security applications. SUMMARY

[0004] In view of the deficiencies of the prior art, the purpose of the present application is to provide a cloud service platform multi-dimensional threat intelligence source evaluation and sharing method and system, which uniformly processes multi-source threat intelligence data of different structures, and adjusts multi-source heterogeneous threat intelligence data to a unified format standard. Taking data characteristics, platform characteristics and economic characteristics as analysis dimensions, each threat intelligence source is comprehensively analyzed and evaluated, the decision-making difficulty of users is reduced, the actual effect of threat intelligence in network security applications is improved, strong support is provided for the planning and implementation of network security defense, and the network threat environment is adapted to the increasingly complex network threat environment.

[0005] In a first aspect of the present application, a cloud service platform multi-dimensional threat intelligence source evaluation and sharing method is provided, comprising:

[0006] S1, collecting multi-source threat intelligence data;

[0007] S2, uniformly processing the multi-source threat intelligence data of different structures;

[0008] S3, according to the uniformly processed multi-source threat intelligence data, taking data characteristics, platform characteristics and economic characteristics as analysis dimensions, analyzing and evaluating each threat intelligence source;

[0009] S4, sharing the analysis evaluation result to each relevant threat intelligence source.

[0010] Further, the S1 specifically comprises:

[0011] S101, establishing the contact between the cloud service platform and each threat intelligence source;

[0012] S102, periodically collecting the threat intelligence data automatically through the API interface provided by the threat intelligence source.

[0013] Further, the S2 specifically comprises:

[0014] S201, performing data screening on the multi-source threat intelligence data, and retaining the data related to the specific threat intelligence field;

[0015] S202, performing format conversion on the multi-source threat intelligence data, and converting the data format of the multi-source threat intelligence into a general standard format;

[0016] S203, performing data cleaning on the multi-source threat intelligence data; the data cleaning comprises removing duplicate data, data error correction, and processing missing values;

[0017] S204, performing mapping processing on the multi-source threat intelligence data, classifying and mapping the data to a unified reference framework according to the threat level or attack type;

[0018] S205, performing timestamp synchronization processing on the multi-source threat intelligence data, and keeping the timestamps of each threat intelligence data consistent.

[0019] Further, the S3 specifically comprises:

[0020] S301, in the data characteristic dimension, evaluating the advantages and disadvantages of each threat intelligence source by analyzing the threat intelligence data provided by each threat intelligence source;

[0021] S302, in the platform characteristic dimension, evaluating the advantages and disadvantages of each threat intelligence source by analyzing the applicability of each threat intelligence source;

[0022] S303, in the economic characteristic dimension, evaluating the advantages and disadvantages of each threat intelligence source by analyzing the subscription fee, additional service cost, and data acquisition cost and input of each threat intelligence source.

[0023] Further, the S301 specifically comprises:

[0024] S3011, calculating the number of each threat intelligence data, and performing normalization processing on the number:

[0025] The calculation formula of the quantity is:

[0026]

[0027] Wherein, N represents the quantity of threat intelligence, T represents the total number of periods of the validity period, n t represents the quantity of threat intelligence published by the threat intelligence source in a period;

[0028] The calculation formula of the normalization processing of the quantity is:

[0029]

[0030] Wherein, P1 represents the normalization result of the quantity, N i represents the total amount of threat intelligence of the i-th threat intelligence source, N min represents the minimum value of the total amount of threat intelligence data in the threat intelligence source, N max represents the maximum value of the total amount of threat intelligence data in the threat intelligence source;

[0031] S3012, determine the type of the threat intelligence data;

[0032] S3013, evaluate the attribute coverage rate of the threat intelligence data:

[0033]

[0034] Wherein, P2 represents the attribute coverage rate of the threat intelligence data, x i represents the number of attributes contained in each threat intelligence, y i represents the number of attributes that each threat intelligence should contain;

[0035] S3014, evaluate the timeliness of the threat intelligence data:

[0036]

[0037] Wherein, P3 represents the timeliness of the threat intelligence data, m i represents the number of threat intelligence shared by the i-th threat intelligence source and other threat intelligence sources, mint i represents the number of threat intelligence published by the i-th threat intelligence source earliest among the shared threat intelligence, S represents the total number of threat intelligence sources;

[0038] S3015, evaluate the repetition rate of the threat intelligence data:

[0039]

[0040] Wherein, P4 represents the repetition rate of the threat intelligence data, r trepresents the number of threat intelligence published by a threat intelligence source in a period and the threat intelligence published in the valid period;

[0041] S3016, evaluating the contribution rate of the threat intelligence data:

[0042]

[0043] Wherein, P5 represents the contribution rate of the threat intelligence data, N j represents the total amount of other threat intelligence sources, and Num represents the total amount of the current threat intelligence source;

[0044] S3017, evaluating the similarity of the threat intelligence data:

[0045]

[0046] Wherein, P6 represents the similarity of the threat intelligence data;

[0047] S3018, evaluating the unique contribution amount of the threat intelligence data, and performing normalization processing on the unique contribution amount:

[0048] The calculation formula of the unique contribution amount of the threat intelligence data is:

[0049]

[0050] Wherein, N d represents the unique contribution amount of the threat intelligence data;

[0051] The calculation formula of the normalization processing on the unique contribution amount is:

[0052]

[0053] Wherein, P7 represents the normalization result of the unique contribution amount, represents the unique contribution amount of the jth threat intelligence source, represents the minimum value of the unique contribution amount in all threat intelligence sources, represents the maximum value of the unique contribution amount in all threat intelligence sources;

[0054] S3019, according to the number, type, attribute coverage rate, timeliness, repetition rate, contribution rate, similarity and unique contribution amount of the threat intelligence, evaluating the advantages and disadvantages of each threat intelligence source.

[0055] The second aspect of the application provides a cloud service platform multi-dimensional threat intelligence source evaluation and sharing, comprising:

[0056] The acquisition module is used for acquiring multi-source threat intelligence data;

[0057] a processing module, configured to perform consistent processing on the multi-source threat intelligence data of different structures;

[0058] an evaluation module, configured to perform analysis and evaluation on each threat intelligence source according to the multi-source threat intelligence data after consistent processing, with data characteristics, platform characteristics and economic characteristics as analysis dimensions;

[0059] a sharing module, configured to share analysis and evaluation results to each relevant threat intelligence source.

[0060] Further, the collection module is specifically configured to:

[0061] establish a connection between the cloud service platform and each threat intelligence source;

[0062] periodically collect threat intelligence data automatically through an API interface provided by the threat intelligence source.

[0063] Further, the processing module is specifically configured to:

[0064] perform data screening on the multi-source threat intelligence data, and retain data related to a specific threat intelligence field;

[0065] perform format conversion on the multi-source threat intelligence data, and convert data formats of the multi-source threat intelligence into a universal standard format;

[0066] perform data cleaning on the multi-source threat intelligence data; the data cleaning includes removing duplicate data, data error correction and handling missing values;

[0067] perform mapping processing on the multi-source threat intelligence data, and map data with threat levels and / or attack types to a unified reference framework;

[0068] perform timestamp synchronization processing on the multi-source threat intelligence data, and keep timestamps of each threat intelligence data consistent.

[0069] Further, the evaluation module is specifically configured to:

[0070] in the data characteristic dimension, evaluate advantages and disadvantages of each threat intelligence source by analyzing threat intelligence data provided by each threat intelligence source;

[0071] in the platform characteristic dimension, evaluate advantages and disadvantages of each threat intelligence source by analyzing applicability of each threat intelligence source;

[0072] in the economic characteristic dimension, evaluate advantages and disadvantages of each threat intelligence source by analyzing subscription fees, additional service costs, data acquisition costs and inputs of each threat intelligence source.

[0073] Further, the evaluation module is specifically configured to:

[0074] calculate a quantity of each threat intelligence data, and normalize the quantity:

[0075] The calculation formula of the quantity is:

[0076]

[0077] Wherein, N represents the quantity of threat intelligence, T represents the total number of periods of the validity period, n t represents the quantity of threat intelligence published by the threat intelligence source in one period;

[0078] The calculation formula for normalizing the quantity is:

[0079]

[0080] Wherein, P1 represents the normalized result of the quantity, N i represents the total amount of threat intelligence of the i-th threat intelligence source, N min represents the minimum value of the total amount of threat intelligence data in the threat intelligence source, N max represents the maximum value of the total amount of threat intelligence data in the threat intelligence source;

[0081] Determine the type of the threat intelligence data;

[0082] Evaluate the attribute coverage of the threat intelligence data:

[0083]

[0084] Wherein, P2 represents the attribute coverage of the threat intelligence data, x i represents the number of attributes contained in each threat intelligence, y i represents the number of attributes that each threat intelligence should contain;

[0085] Evaluate the timeliness of the threat intelligence data:

[0086]

[0087] Wherein, P3 represents the timeliness of the threat intelligence data, m i represents the number of threat intelligence shared by the i-th threat intelligence source and other threat intelligence sources, mint i represents the number of threat intelligence published by the i-th threat intelligence source earliest among the shared threat intelligence, and S represents the total number of threat intelligence sources;

[0088] Evaluate the repetition rate of the threat intelligence data:

[0089]

[0090] Wherein, P4 represents the repetition rate of threat intelligence data, r t represents the number of threat intelligence published by a threat intelligence source in a period and the threat intelligence published in the effective period;

[0091] Assess the contribution rate of the threat intelligence data:

[0092]

[0093] Wherein, P5 represents the contribution rate of threat intelligence data, N j represents the total amount of other threat intelligence sources, Num represents the total amount of the current threat intelligence source;

[0094] Assess the similarity of the threat intelligence data:

[0095]

[0096] Wherein, P6 represents the similarity of threat intelligence data;

[0097] Assess the unique contribution amount of the threat intelligence data, and normalize the unique contribution amount:

[0098] The calculation formula of the unique contribution amount of the threat intelligence data is:

[0099]

[0100] Wherein, N d represents the unique contribution amount of threat intelligence data;

[0101] The calculation formula of the normalized processing of the unique contribution amount is:

[0102]

[0103] Wherein, P7 represents the normalized result of the unique contribution amount, represents the unique contribution amount of the jth threat intelligence source, represents the minimum value of the unique contribution amount in all threat intelligence sources, represents the maximum value of the unique contribution amount in all threat intelligence sources;

[0104] According to the number, kind, attribute coverage rate, timeliness, repetition rate, contribution rate, similarity and unique contribution amount of threat intelligence, the advantages and disadvantages of each threat intelligence source are evaluated.

[0105] The present application has the following advantages:

[0106] The method and system of the present application process different structures of multi-source threat intelligence data consistently, adjust multi-source heterogeneous threat intelligence data into a unified format standard, take data characteristics, platform characteristics and economic characteristics as analysis dimensions, comprehensively analyze and evaluate each threat intelligence source, reduce the decision difficulty of users, improve the actual effect of threat intelligence in network security application, provide strong support for the planning and implementation of network security defense, and adapt to the increasingly complex network threat environment. BRIEF DESCRIPTION OF DRAWINGS

[0107] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application. In the drawings:

[0108] Figure 1 A flowchart of a cloud service platform multi-dimensional threat intelligence source evaluation and sharing method provided by an embodiment of the present application;

[0109] Figure 2 A structural diagram of a cloud service platform multi-dimensional threat intelligence source evaluation and sharing system provided by an embodiment of the present application;

[0110] Figure 3 A threat intelligence source multi-dimensional evaluation framework diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0111] In order to make the personnel in the art better understand the technical solutions in the embodiments of the present application, the technical solutions of the present application will be described clearly and completely in conjunction with the drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. It should be understood that these descriptions are exemplary, and are not used to limit the scope of the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor should belong to the scope of protection of the present application.

[0112] In addition, in the following description, the description of well-known structures and techniques is omitted to avoid unnecessary confusion of the concepts disclosed in the present application.

[0113] In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the system or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application. In addition, the terms "first", "second", "third" are only for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "mounting", "connecting", "connecting" should be broadly understood, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be the communication between two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0114] The exemplary embodiments will be described in detail herein, with examples shown in the drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Rather, they are merely examples of methods and systems consistent with some aspects of the present application as detailed in the appended claims.

[0115] The present application provides a cloud service platform multi-dimensional threat intelligence source evaluation and sharing method and system, which solves the problem that existing threat intelligence lacks a unified format standard. In the face of massive, multi-source threat intelligence, users often feel decision-making pressure and have difficulty in determining which information is more critical, which not only increases the difficulty of decision-making, but also may weaken the actual effect of threat intelligence in network security applications and the like.

[0116] Method embodiments

[0117] Reference Description Figure 1 , shows a flowchart of a cloud service platform multi-dimensional threat intelligence source evaluation and sharing method provided by an embodiment of the present application.

[0118] The cloud service platform multi-dimensional threat intelligence source evaluation and sharing method provided by the embodiment of the present application comprises:

[0119] Specifically, the method comprises steps S1 to S4.

[0120] S1: Collecting multi-source threat intelligence data.

[0121] Among them, the threat intelligence data (Threat-Intelligence) is the evidence-based knowledge about the existing or potential threats faced by IT or information assets, including context, mechanism, indicator, inference and feasible suggestions, which can provide decision basis for threat response.

[0122] In one possible implementation, S1 specifically includes:

[0123] S101: Establish the contact between the cloud service platform and each threat intelligence source.

[0124] In the present application, by integrating threat intelligence data from multiple sources, including public intelligence library, professional suppliers, malware detection system, hacker community and social media, etc., the platform can obtain extensive intelligence from different fields and channels, enhancing the comprehensive perception of the threat surface.

[0125] S102: Through the API interface provided by the threat intelligence source, regularly collect threat intelligence data automatically.

[0126] In the present application, automatic data collection ensures the timely update of threat intelligence. By regularly grabbing the latest data through the API interface, the platform can learn about the latest threat intelligence events and evolution in real time, improving the reaction speed and efficiency.

[0127] Specifically, with the powerful ability of the cloud service platform, close cooperation with various data sources is established, realizing extensive and in-depth threat intelligence collection. These data sources span multiple fields, such as public intelligence library, leading threat intelligence suppliers, malware detection system, professional hacker community and social media, etc. Among them, some intelligence sources provide API interface, allowing the cloud service platform to regularly and automatically grab the latest data. In addition, the cloud service platform can also independently collect internal threat intelligence when performing its core business. This kind of information may come from internal monitoring tools of the platform, user interaction, network traffic insight, etc., providing a valuable and unique intelligence data layer for the present application.

[0128] In the present application, establishing such a multi-source integrated and automatically collected threat intelligence platform can not only improve the perception ability and reaction speed of the security team to threats, but also support more effective threat intelligence analysis and decision making, thereby enhancing the overall security protection capability.

[0129] Reference is made to the accompanying drawings Figure 3 , which shows a multi-dimensional evaluation framework of threat intelligence sources provided by the embodiment of the present application.

[0130] S2: Consistent processing of multi-source threat intelligence data with different structures.

[0131] In one possible implementation, S2 specifically includes:

[0132] S201: Data screening on multi-source threat intelligence data, retaining data related to specific threat intelligence fields.

[0133] S202: Format conversion on multi-source threat intelligence data, converting the data format of multi-source threat intelligence into a universal standard format.

[0134] S203: Data cleaning on multi-source threat intelligence data. Data cleaning includes removing duplicate data, data error correction, and handling missing values.

[0135] S204: Mapping processing on multi-source threat intelligence data, mapping data with threat levels and / or attack types to a unified reference framework.

[0136] In the present application, by mapping data from different sources to a unified reference framework (S204), it is easier to compare and analyze the threat levels, attack types, etc. in different data sources, and to provide more accurate security posture analysis for security teams.

[0137] S205: Time stamp synchronization processing on multi-source threat intelligence data, keeping the time stamps of each threat intelligence data consistent.

[0138] In the present application, the time stamps of each threat intelligence data are kept consistent, thereby helping security teams to more accurately understand the sequence and timeline of threat events. This temporal consistency can significantly improve the response speed and decision-making efficiency of events. At the same time, data screening, format conversion, data cleaning and mapping processing can ensure that the threat intelligence data obtained from different sources is consistent in quality and structure. This can reduce noise, errors and inconsistencies in the data, and improve the credibility and usability of the data.

[0139] Further, through consistency processing, the quality, consistency and operability of multi-source threat intelligence data can be effectively improved, thereby enhancing the ability of security teams to identify, analyze and respond to threats, and thus improving the overall security protection level and efficiency.

[0140] S3: According to the multi-source threat intelligence data after consistency processing, taking data characteristics, platform characteristics and economic characteristics as analysis dimensions, analyzing and evaluating each threat intelligence source.

[0141] In one possible implementation, S3 specifically includes:

[0142] S301: In the data characteristic dimension, by analyzing the threat intelligence data provided by each threat intelligence source, the advantages and disadvantages of each threat intelligence source are evaluated.

[0143] It should be noted that the number is one of the simplest and most intuitive dimensions for measuring threat intelligence sources, directly presenting the size of the data. Evaluating the number of threat intelligence data is key to understanding the richness of information. Larger number of intelligence data may provide a more comprehensive threat profile, but it is necessary to ensure that the quality is not affected. Excessive threat intelligence may contain noise or irrelevant information, resulting in reduced analysis efficiency. Considering the quality and quantity of intelligence, ensure that there is enough data and high-quality data. Therefore, it is necessary to analyze the number of threat intelligence data.

[0144] In one possible implementation, S301 specifically includes:

[0145] S3011: Calculate the number of each threat intelligence data, and normalize the number:

[0146] The calculation formula of the number is:

[0147]

[0148] Where N represents the number of threat intelligence, T represents the total number of periods of validity, n t represents the number of threat intelligence published by the threat intelligence source in a period.

[0149] The calculation formula for normalizing the number is:

[0150]

[0151] Where P1 represents the normalized result of the number, N i represents the total amount of threat intelligence of the i-th threat intelligence source, N min represents the minimum value of the total amount of threat intelligence data in the threat intelligence source, N max represents the maximum value of the total amount of threat intelligence data in the threat intelligence source.

[0152] S3012: Determine the type of threat intelligence data.

[0153] Specifically, evaluating the type of threat intelligence data is key to understanding the scope of threats. Threat intelligence data covers a variety of different threat types, such as malware, cyber attacks, threat vulnerabilities, social engineering, and malicious domain name and IP intelligence, etc. The more data types provided by the threat intelligence source, the more comprehensive and multi-angle network threat profile can be built, and the wider the protection range ultimately produced.

[0154] S3013: Evaluate the attribute coverage of threat intelligence data:

[0155]

[0156] Wherein, P2 represents the attribute coverage of threat intelligence data, x i represents the number of attributes contained in each piece of threat intelligence, y i represents the number of attributes that each piece of threat intelligence should contain.

[0157] Wherein, the attribute coverage refers to the extent to which various key attributes are covered in the process of converting threat intelligence data into a standard format, reflecting the richness of the information published by the threat intelligence source. These attributes can include attack type, attack source, affected assets, attack method, etc. The high or low attribute coverage directly affects the comprehensiveness and applicability of threat intelligence. High attribute coverage means that threat intelligence can provide more comprehensive information and better analyze the corresponding attack chain and attack method.

[0158] S3014: Evaluate the timeliness of threat intelligence data:

[0159]

[0160] Wherein, P3 represents the timeliness of threat intelligence data, m i represents the number of threat intelligence shared by the i-th threat intelligence source and other threat intelligence sources, mint i represents the number of threat intelligence published by the i-th threat intelligence source earliest among the shared threat intelligence, S represents the total number of threat intelligence sources.

[0161] It should be noted that timeliness is to evaluate the update speed and effective period of threat intelligence data, that is, the time interval between data and actual threat event. Data with high timeliness can provide information about new threats more timely, which helps to take measures as soon as possible. At the same time, in the evaluation process, timeliness is also relative. When a piece of threat intelligence appears earliest in a certain intelligence source, the delay of this threat intelligence for other threat intelligence sources is zero, and the timeliness is the highest.

[0162] S3015: Evaluate the repetition rate of threat intelligence data:

[0163]

[0164] Wherein, P4 represents the repetition rate of threat intelligence data, r t represents the number of threat intelligence published by a threat intelligence source in a period and the number of threat intelligence published in the effective period.

[0165] Among them, the repeatability in the field of threat intelligence refers to the same threat intelligence published by the same threat intelligence source appearing multiple times on the timeline within a certain effective period. This may mean a continuous network attack activity carried out by the same attacker or attack team. The continuous activity of the attacker may mean that they are constantly adapting and adjusting their strategies, and the appearance of such continuous behavior needs to arouse the higher vigilance of the defender. In order to effectively deal with this situation, the defense measures need to be more accurate and targeted.

[0166] S3016: Evaluate the contribution rate of threat intelligence data:

[0167]

[0168] Among them, P5 represents the contribution rate of threat intelligence data, N j represents the total amount of other threat intelligence sources, and Num represents the total amount of the current threat intelligence source.

[0169] Among them, the contribution rate refers to the proportion of the threat intelligence published by a specific intelligence source in the overall threat intelligence data. This indicator reflects the influence and contribution degree of the intelligence source in the process of integrating threat intelligence data by the cloud service platform.

[0170] S3017: Evaluate the similarity of threat intelligence data:

[0171]

[0172] Among them, P6 represents the similarity of threat intelligence data.

[0173] It should be noted that similarity refers to the similarity between the information provided by a specific threat intelligence source and the information provided by other threat intelligence sources in terms of content and features. This concept reveals the consistency and overlap of information between different threat intelligence sources. It should be clear that similarity does not involve information plagiarism between intelligence sources, but highlights the importance of specific threat intelligence and its dissemination and presentation in different sources.

[0174] S3018: Evaluate the unique contribution amount of threat intelligence data and normalize the unique contribution amount:

[0175] The calculation formula of the unique contribution amount of threat intelligence data is:

[0176]

[0177] Among them, N d represents the unique contribution amount of threat intelligence data.

[0178] The calculation formula for normalizing the unique contribution amount is:

[0179]

[0180] wherein P7 represents the normalized result of the unique contribution amount, represents the unique contribution amount of the jth threat intelligence source, represents the minimum value of the unique contribution amount among all threat intelligence sources, represents the maximum value of the unique contribution amount among all threat intelligence sources.

[0181] Specifically, the unique contribution amount of a threat intelligence source refers to the amount of information that the specific source provides that is unique compared to other sources. This concept measures the unique value and information diversity that the intelligence source brings to the threat intelligence ecosystem. By evaluating the unique contribution amount of a threat intelligence source, it is possible to identify the special position of the source in the overall threat intelligence ecosystem. The larger this value, the more prominent the source's ability to obtain threat intelligence information, and the greater its value.

[0182] S3019: Evaluate the pros and cons of each threat intelligence source according to the number, type, attribute coverage, timeliness, repetition rate, contribution rate, similarity, and unique contribution amount of the threat intelligence.

[0183] In the present application, by evaluating the number, type, attribute coverage, timeliness, repetition rate, contribution rate, similarity, and unique contribution amount, the data quality and richness of each threat intelligence source can be determined. This helps to select the most suitable intelligence source for specific security needs and ensures that the data obtained has practical value for security analysis and decision-making.

[0184] S302: In the platform characteristics dimension, analyze the suitability of each threat intelligence source to evaluate the pros and cons of each threat intelligence source.

[0185] Specifically, the interface of a threat intelligence source refers to its data interaction method, including how to obtain, deliver, and exchange threat intelligence data. The design of the interface affects the efficiency and convenience of data acquisition and whether it can be seamlessly integrated into existing systems. The customizability of a threat intelligence source refers to whether it supports custom configuration and adjustment according to user needs to obtain threat intelligence that best matches their situation. Intelligence sources with high customizability can provide customized threat intelligence data according to specific needs, meeting different security requirements. The accuracy of a threat intelligence source indicates whether the data it provides is true, reliable, and can accurately reflect the current threat situation. The accuracy of the data is crucial for effective security decision-making and threat defense. The false negative rate refers to the possibility that a threat intelligence source may fail to report all threat events in a timely or complete manner. A lower false negative rate means that the source can provide more comprehensive threat information, helping to identify and respond to potential risks early.

[0186] In the present application, the interface design, customizability, accuracy and false negative rate of threat intelligence sources are evaluated to determine their applicability and effectiveness in integration into existing security platforms. This helps to ensure that intelligence sources can be seamlessly integrated into existing security architectures and provide the necessary support for security operations.

[0187] S303: In the economic characteristic dimension, the advantages and disadvantages of each threat intelligence source are evaluated by analyzing the subscription fee, additional service cost, and data acquisition cost and input of each threat intelligence source.

[0188] Specifically, the economic characteristic of a threat intelligence source refers to the costs, benefits and related business factors involved in the intelligence source from an economic perspective. When evaluating economic characteristics, the subscription fee, additional service cost, and data acquisition cost and input of the intelligence source need to be considered. In addition, it is also necessary to consider whether it can bring better threat awareness, risk reduction and decision support to the organization.

[0189] In the present application, analyzing the subscription fee, additional service cost, and data acquisition cost and input can help evaluate the economic benefits of threat intelligence sources. This evaluation helps to select the most cost-effective intelligence sources and ensures the rationality and sustainability of security investment.

[0190] Further, through comprehensive analysis and evaluation, the most suitable threat intelligence sources can be quickly identified and adopted. This helps to improve the security team's awareness and understanding of threat intelligence, and enhances the monitoring and response capabilities of real-time threats, thereby effectively reducing security risks and losses. At the same time, through the analysis of economic characteristics, threat intelligence sources with reasonable prices and superior performance can be selected to maximize the benefits of security investment. At the same time, the evaluation of economic characteristics can also help optimize resource allocation and ensure the rationality and sustainability of cost management in security operations.

[0191] S4: Share the analysis and evaluation results to each relevant threat intelligence source.

[0192] Specifically, by conducting in-depth analysis on the collected threat intelligence data, malicious IP addresses and domain names are identified, and identification rules are developed based on known attack patterns, malicious behavior characteristics, and abnormal network activities. By integrating multiple threat intelligence sources, verification and confirmation are conducted, and verified malicious IP addresses and domain names are added to the blacklist list. After data cleaning and verification, threat intelligence can be converted into a structured format to comprehensively describe various aspects of threats. Subsequently, through in-depth analysis of these data, including detailed analysis of attack chains and attack methods, the attacker's action path and attack strategy can be revealed, providing deep insights for network security decision-makers. The generated blacklist and access rules are deployed to target devices such as firewalls, bastion hosts, etc. through automated deployment tools or scripts. At the same time, the latest blacklist and access rule data are obtained from the cloud service platform in a timely manner to ensure that the rules on the device remain up-to-date. Regularly review the rules on the device to ensure their effectiveness. Remove rules that are no longer needed to optimize performance, while updating the blacklist and access rules on the cloud service platform. Apply threat intelligence data to the security atomic capabilities of the cloud service platform to provide more outstanding security services. By analyzing these data, easy-to-understand security reports can be generated to deliver information about network threats to users, improving their security awareness. Relying on the instant feedback of a large number of customers, the platform can quickly verify and adjust the threat intelligence data. Finally, the processed and analyzed information is provided to other key stakeholders to promote the coordinated defense of the entire network security ecosystem.

[0193] In the present invention, by sharing the results of analysis and evaluation to relevant threat intelligence sources, cross-organizational coordinated defense can be achieved, accelerating attack detection and response speed, improving the scientificity and effectiveness of security decisions, optimizing security services and user support, and promoting the coordinated operations of the entire security ecosystem, thereby significantly enhancing the network security capabilities and resistance of organizations.

[0194] The present invention has the following beneficial effects:

[0195] The method and system of the present invention consistently process multi-source threat intelligence data of different structures, adjusting multi-source heterogeneous threat intelligence data to a unified format standard. Taking data characteristics, platform characteristics, and economic characteristics as analysis dimensions, comprehensive analysis and evaluation of each threat intelligence source is conducted, reducing the decision-making difficulty of users, improving the actual effect of threat intelligence in network security applications, and providing strong support for the planning and implementation of network security defense, adapting to the increasingly complex network threat environment.

[0196] System embodiment

[0197] Reference attached to the specification Figure 2Fig. 1 shows a structural schematic diagram of a cloud service platform multi-dimensional threat intelligence source evaluation and sharing system according to an embodiment of the present application.

[0198] The cloud service platform multi-dimensional threat intelligence source evaluation and sharing system 20 according to an embodiment of the present application comprises:

[0199] A collection module 201 configured to collect multi-source threat intelligence data;

[0200] A processing module 202 configured to perform consistency processing on the multi-source threat intelligence data of different structures;

[0201] An evaluation module 203 configured to perform analysis and evaluation on each threat intelligence source according to the multi-source threat intelligence data after consistency processing, with data characteristics, platform characteristics and economic characteristics as analysis dimensions;

[0202] A sharing module 204 configured to share the analysis and evaluation results to each related threat intelligence source.

[0203] Further, the collection module 201 is specifically configured to:

[0204] establish a connection between the cloud service platform and each threat intelligence source;

[0205] automatically collect threat intelligence data regularly through an API interface provided by the threat intelligence source.

[0206] Further, the processing module 202 is specifically configured to:

[0207] perform data screening on the multi-source threat intelligence data, and retain data related to a specific threat intelligence field;

[0208] perform format conversion on the multi-source threat intelligence data, and convert the data format of the multi-source threat intelligence into a universal standard format;

[0209] perform data cleaning on the multi-source threat intelligence data; the data cleaning comprises removing duplicate data, data error correction and processing missing values;

[0210] perform mapping processing on the multi-source threat intelligence data, and map data with threat levels and / or attack types to a unified reference framework;

[0211] perform timestamp synchronization processing on the multi-source threat intelligence data, and keep the timestamps of each threat intelligence data consistent.

[0212] Further, the evaluation module 203 is specifically configured to:

[0213] In the data characteristic dimension, the advantages and disadvantages of each threat intelligence source are evaluated by analyzing the threat intelligence data provided by each threat intelligence source.

[0214] In the platform characteristic dimension, the advantages and disadvantages of each threat intelligence source are evaluated by analyzing the applicability of each threat intelligence source.

[0215] In the economic characteristic dimension, the advantages and disadvantages of each threat intelligence source are evaluated by analyzing the subscription fee, additional service cost, and data acquisition cost and input of each threat intelligence source.

[0216] Further, the evaluation module 203 is specifically configured to:

[0217] calculate the quantity of each threat intelligence data, and normalize the quantity:

[0218] The calculation formula of the quantity is:

[0219]

[0220] wherein N represents the threat intelligence quantity, T represents the total number of the period of validity, n t represents the number of threat intelligence published by the threat intelligence source in a period;

[0221] The calculation formula of the normalization of the quantity is:

[0222]

[0223] wherein P1 represents the normalization result of the quantity, N i represents the total amount of threat intelligence of the i-th threat intelligence source, N min represents the minimum value of the total amount of threat intelligence data in the threat intelligence source, N max represents the maximum value of the total amount of threat intelligence data in the threat intelligence source;

[0224] determine the type of the threat intelligence data;

[0225] evaluate the attribute coverage of the threat intelligence data:

[0226]

[0227] wherein P2 represents the attribute coverage of the threat intelligence data, x i represents the number of attributes contained in each threat intelligence, y i represents the number of attributes that should be contained in each threat intelligence;

[0228] evaluate the timeliness of the threat intelligence data:

[0229]

[0230] wherein P3 represents the timeliness of threat intelligence data, m i represents the number of threat intelligence shared by the i-th threat intelligence source with other threat intelligence sources, mint i represents the number of threat intelligence published by the i-th threat intelligence source earliest in the shared threat intelligence, S represents the total number of threat intelligence sources;

[0231] evaluating the repetition rate of the threat intelligence data:

[0232]

[0233] wherein P4 represents the repetition rate of threat intelligence data, r t represents the number of threat intelligence published by a threat intelligence source in a period and the threat intelligence published in the effective period;

[0234] evaluating the contribution rate of the threat intelligence data:

[0235]

[0236] wherein P5 represents the contribution rate of threat intelligence data, N j represents the total amount of other threat intelligence sources, Num represents the total amount of the current threat intelligence source;

[0237] evaluating the similarity of the threat intelligence data:

[0238]

[0239] wherein P6 represents the similarity of threat intelligence data;

[0240] evaluating the unique contribution amount of the threat intelligence data, and normalizing the unique contribution amount:

[0241] The calculation formula of the unique contribution amount of the threat intelligence data is:

[0242]

[0243] wherein N d represents the unique contribution amount of threat intelligence data;

[0244] The calculation formula of the normalizing processing of the unique contribution amount is:

[0245]

[0246] wherein P7 represents the normalized result of the unique contribution amount, represents the unique contribution amount of the j-th threat intelligence source, represents the minimum value of the unique contribution amount in all threat intelligence sources, represents the maximum value of the unique contribution amount in all threat intelligence sources.

[0247] According to the number, type, attribute coverage, timeliness, repetition rate, contribution rate, similarity and unique contribution amount of the threat intelligence, the advantages and disadvantages of each threat intelligence source are evaluated.

[0248] The cloud service platform multi-dimensional threat intelligence source evaluation and sharing system 20 provided by the application can realize each step and technical effect of the cloud service platform multi-dimensional threat intelligence source evaluation and sharing method, and the application will not be described again to avoid repetition.

[0249] The application has the following beneficial effects:

[0250] The method and system of the application perform consistent processing on multi-source threat intelligence data of different structures, adjust the multi-source heterogeneous threat intelligence data into a unified format standard, perform comprehensive analysis and evaluation on each threat intelligence source taking data characteristics, platform characteristics and economic characteristics as analysis dimensions, reduce the decision difficulty of users, improve the actual effect of threat intelligence in network security application, provide strong support for planning and implementation of network security defense, and adapt to the increasingly complex network threat environment.

[0251] The application applicant has made a detailed description and explanation of the implementation examples of the application in combination with the drawings of the specification, but those skilled in the art should understand that the above implementation examples are only preferred embodiments of the application, and the detailed description is only to help readers better understand the spirit of the application, and is not a limitation on the protection scope of the application, on the contrary, any improvement or modification based on the spirit of the application should fall within the protection scope of the application.

[0252] Finally, it should be noted that the above examples are only used to illustrate the technical solutions of the embodiments of the application, and not to limit them. Although the application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the application, and any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed by the application should be covered within the protection scope of the application.

Claims

1. A method for multi-dimensional threat intelligence source assessment and sharing in a cloud service platform, characterized in that, include: S1 collects multi-source threat intelligence data; S2, perform consistency processing on the multi-source threat intelligence data with different structures; S3 analyzes and evaluates each threat intelligence source based on data characteristics, platform characteristics, and economic characteristics, using the multi-source threat intelligence data after consistency processing as analysis dimensions. S4 shares the analysis and assessment results with various relevant threat intelligence sources; Specifically, S3 includes: S301, In terms of data characteristics, the advantages and disadvantages of each threat intelligence source are evaluated by analyzing the threat intelligence data provided by each threat intelligence source. S302, In terms of platform characteristics, the applicability of each threat intelligence source is analyzed to evaluate the advantages and disadvantages of each threat intelligence source. S303, in terms of economic characteristics, evaluate the merits of each threat intelligence source by considering the subscription fees, additional service costs, and data acquisition costs and investments for each threat intelligence source. Specifically, S301 includes: S3011, Calculate the quantity of each of the threat intelligence data, and normalize the quantity: The formula for calculating the quantity is: Where N represents the number of threat intelligence reports, T represents the total number of validity periods, and n t This indicates the number of threat intelligence reports released by threat intelligence sources within a given period. The formula for normalizing the quantity is as follows: Where P1 represents the normalized result of the quantity, and N i N represents the total amount of threat intelligence from the i-th threat intelligence source. min N represents the minimum total amount of threat intelligence data in a threat intelligence source. max This represents the maximum value of the total amount of threat intelligence data in the threat intelligence source; S3012, Determine the type of the threat intelligence data; S3013, Evaluate the attribute coverage of the threat intelligence data: Where P2 represents the attribute coverage of threat intelligence data, x i This indicates the number of attributes contained in each piece of threat intelligence, y. i This indicates the number of attributes that each piece of threat intelligence should contain; S3014, Assess the timeliness of the threat intelligence data: Where P3 represents the timeliness of threat intelligence data, m i mint represents the amount of threat intelligence shared by the i-th threat intelligence source with other threat intelligence sources. i This represents the number of threat intelligence sources with the earliest release time among the shared threat intelligence sources, and S represents the total number of threat intelligence sources. S3015, Assess the duplication rate of the threat intelligence data: Where P4 represents the duplication rate of threat intelligence data, r t This indicates the number of duplicate threat intelligence reports released by a single threat intelligence source within a given period that overlap with threat intelligence reports released within the validity period. S3016, Assess the contribution rate of the threat intelligence data: Where P5 represents the contribution rate of threat intelligence data, and N j Num represents the total number of other threat intelligence sources, while Num represents the total number of current threat intelligence sources. S3017, Assess the similarity of the threat intelligence data: P6 indicates the similarity of threat intelligence data; S3018, Evaluate the unique contribution of the threat intelligence data and normalize the unique contribution: The formula for calculating the unique contribution of the threat intelligence data is as follows: Where, N d Indicates the unique contribution of threat intelligence data; The formula for normalizing the unique contribution is as follows: Wherein, P7 represents the normalized result of the unique contribution. This represents the unique contribution of the j-th threat intelligence source. This represents the minimum unique contribution among all threat intelligence sources. This represents the maximum unique contribution among all threat intelligence sources; S3019, evaluate the quality of each threat intelligence source based on the quantity, type, attribute coverage, timeliness, duplication rate, contribution rate, similarity, and unique contribution of threat intelligence.

2. The method for multi-dimensional threat intelligence source assessment and sharing in a cloud service platform according to claim 1, characterized in that, S1 specifically includes: S101, establish connections between the cloud service platform and various threat intelligence sources; S102, threat intelligence data is collected automatically and periodically through the API interface provided by the threat intelligence source.

3. The method for multi-dimensional threat intelligence source assessment and sharing in a cloud service platform according to claim 1, characterized in that, S2 specifically includes: S201, perform data filtering on the multi-source threat intelligence data and retain data related to specific threat intelligence domains; S202, Convert the format of the multi-source threat intelligence data into a common standard format; S203, perform data cleaning on the multi-source threat intelligence data; the data cleaning includes removing duplicate data, correcting data errors, and handling missing values. S204, The multi-source threat intelligence data is mapped, and the data is classified and mapped to a unified reference frame according to the threat level or attack type. S205, perform timestamp synchronization processing on the multi-source threat intelligence data to keep the timestamps of each threat intelligence data consistent.

4. A multi-dimensional threat intelligence source assessment and sharing system for a cloud service platform, characterized in that, include: The data acquisition module is used to collect threat intelligence data from multiple sources. The processing module is used to perform consistency processing on the multi-source threat intelligence data with different structures; The evaluation module is used to analyze and evaluate each threat intelligence source based on data characteristics, platform characteristics, and economic characteristics, using the multi-source threat intelligence data after consistency processing. The sharing module is used to share the analysis and assessment results with various relevant threat intelligence sources; Specifically, the evaluation module is used for: In terms of data characteristics, the advantages and disadvantages of each threat intelligence source are evaluated by analyzing the threat intelligence data provided by each threat intelligence source. In terms of platform characteristics, the applicability of each threat intelligence source is analyzed to evaluate the advantages and disadvantages of each threat intelligence source. In terms of economic characteristics, the advantages and disadvantages of each threat intelligence source are evaluated by considering the subscription fees, additional service costs, and data acquisition costs and investments of each threat intelligence source. Specifically, the evaluation module is used for: Calculate the quantity of each of the aforementioned threat intelligence data, and then normalize the quantity: The formula for calculating the quantity is: Where N represents the number of threat intelligence reports, T represents the total number of validity periods, and n t This indicates the number of threat intelligence reports released by threat intelligence sources within a given period. The formula for normalizing the quantity is as follows: Where P1 represents the normalized result of the quantity, and N i N represents the total amount of threat intelligence from the i-th threat intelligence source. min N represents the minimum total amount of threat intelligence data in a threat intelligence source. max This represents the maximum value of the total amount of threat intelligence data in the threat intelligence source; Determine the type of threat intelligence data; Assess the attribute coverage of the threat intelligence data: Where P2 represents the attribute coverage of threat intelligence data, x i This indicates the number of attributes contained in each piece of threat intelligence, y. i This indicates the number of attributes that each piece of threat intelligence should contain; Assess the timeliness of the threat intelligence data: Where P3 represents the timeliness of threat intelligence data, m i mint represents the amount of threat intelligence shared by the i-th threat intelligence source with other threat intelligence sources. i This represents the number of threat intelligence sources with the earliest release time among the shared threat intelligence sources, and S represents the total number of threat intelligence sources. Assess the duplication rate of the threat intelligence data: Where P4 represents the duplication rate of threat intelligence data, r t This indicates the number of duplicate threat intelligence reports released by a single threat intelligence source within a given period that overlap with threat intelligence reports released within the validity period. Assess the contribution rate of the threat intelligence data: Where P5 represents the contribution rate of threat intelligence data, and N j Num represents the total number of other threat intelligence sources, while Num represents the total number of current threat intelligence sources. Assess the similarity of the threat intelligence data: P6 indicates the similarity of threat intelligence data; Assess the unique contribution of the threat intelligence data and normalize the unique contribution: The formula for calculating the unique contribution of the threat intelligence data is as follows: Where, N d Indicates the unique contribution of threat intelligence data; The formula for normalizing the unique contribution is as follows: Wherein, P7 represents the normalized result of the unique contribution. This represents the unique contribution of the j-th threat intelligence source. This represents the minimum unique contribution among all threat intelligence sources. This represents the maximum unique contribution among all threat intelligence sources; The quality of each threat intelligence source is evaluated based on the quantity, type, attribute coverage, timeliness, repetition rate, contribution rate, similarity, and unique contribution of threat intelligence.

5. The cloud service platform multi-dimensional threat intelligence source assessment and sharing system according to claim 4, characterized in that, The acquisition module is specifically used for: Establish connections between the cloud service platform and various threat intelligence sources; Threat intelligence data is collected automatically and periodically through the API interface provided by the threat intelligence source.

6. The cloud service platform multi-dimensional threat intelligence source assessment and sharing system according to claim 4, characterized in that, The processing module is specifically used for: The multi-source threat intelligence data is filtered to retain data relevant to specific threat intelligence domains; The multi-source threat intelligence data is converted into a common standard format. The multi-source threat intelligence data is cleaned; the data cleaning includes removing duplicate data, correcting data errors, and handling missing values. The multi-source threat intelligence data is mapped to a unified reference frame, which maps data with threat level and / or attack type. The timestamps of the multi-source threat intelligence data are synchronized to ensure consistency.

Images