A multi-source threat intelligence fusion analysis method and system for network security

Abstract

The present invention discloses a multi-source threat intelligence fusion analysis method and system for network security. The method includes: aligning target threat intelligence data in two target threat intelligence data sequences based on positional relationship, and calculating the second correlation between each group of aligned target threat intelligence data, and then determining the target correlation between two target threat intelligence data sequences based on the second correlation between each group of target threat intelligence data and the target weight corresponding to each group of target threat intelligence data, and judging whether the target correlation between the two target threat intelligence data sequences is greater than a preset threshold. If it is greater than the preset threshold, the two cluster centers corresponding to the two target threat intelligence data sequences are associated. The target threat intelligence data with potential correlation can be fused together, thereby improving the integration efficiency of threat intelligence in the fusion process.

Description

Technical Field

[0001] The present invention belongs to the field of threat intelligence fusion technology, and in particular relates to a multi-source threat intelligence fusion analysis method and system for network security. Background Art

[0002] Threat intelligence is evidence-based knowledge that includes scenarios, mechanisms, indicators, impacts, and actionable recommendations. It describes existing or emerging threats or dangers to assets and can be used to inform responses to these threats or dangers.

[0003] With the diversification of threat intelligence data sources, intelligence fusion is an important means of unlocking the value of security intelligence and a key approach to multi-source intelligence acquisition and integration in a big data environment. However, current intelligence fusion methods primarily focus on directly fusing intelligence data with high correlation or similarity. This approach results in a coarse granularity and can result in the omission of potentially highly correlated intelligence data, leading to false alarms and compromising network security protection capabilities. Summary of the Invention

[0004] The present invention provides a multi-source threat intelligence fusion analysis method and system for network security, which is used to solve the technical problem that existing fusion methods may cause the omission of some intelligence data with high potential correlation, thereby causing false alarms to a certain extent and affecting network security protection capabilities.

[0005] In a first aspect, the present invention provides a multi-source threat intelligence fusion analysis method for network security, comprising:

[0006] Acquire at least one threat intelligence data within the same preset time period, and perform deduplication processing on the at least one threat intelligence data according to a preset screening rule to obtain at least one target threat intelligence data;

[0007] Determining a first degree of association between each target threat intelligence data based on semantic similarity, and clustering the at least one target threat intelligence data according to the first degree of association to obtain at least one target threat intelligence data set, wherein any two target threat intelligence data sets do not contain the same target threat intelligence data;

[0008] sorting each target threat intelligence data in the at least one target threat intelligence data set according to the magnitude of the first correlation degree to obtain at least one target threat intelligence data sequence corresponding to a cluster center of the at least one target threat intelligence data set, wherein the cluster center is a target threat intelligence data in the target threat intelligence data set that has the first correlation degree with all target threat intelligence data other than itself;

[0009] aligning target threat intelligence data in two target threat intelligence data sequences based on a positional relationship, and calculating a second correlation degree between each set of aligned target threat intelligence data, wherein a set of target threat intelligence data includes first target threat intelligence data and second target threat intelligence data, the first target threat intelligence data being target threat intelligence data at a certain position in one target threat intelligence data sequence, and the second target threat intelligence data being target threat intelligence data at a certain position in another target threat intelligence data sequence;

[0010] Determining a target correlation degree between the two target threat intelligence data sequences according to the second correlation degrees between the groups of target threat intelligence data and the target weights corresponding to the groups of target threat intelligence data;

[0011] Determine whether the target correlation between two target threat intelligence data sequences is greater than a preset threshold;

[0012] If it is greater than a preset threshold, two cluster centers corresponding to the two target threat intelligence data sequences are associated;

[0013] Based on the preset field fusion rule table, each target threat intelligence data set in a target threat intelligence data set and other cluster centers associated with the cluster center of the target threat intelligence data set are fused, and the fused threat intelligence data is written into a preset database.

[0014] In a second aspect, the present invention provides a multi-source threat intelligence fusion analysis system for network security, comprising:

[0015] an acquisition module configured to acquire at least one threat intelligence data within a same preset time period, and perform deduplication processing on the at least one threat intelligence data according to a preset screening rule to obtain at least one target threat intelligence data;

[0016] a clustering module configured to determine a first degree of association between each target threat intelligence data based on semantic similarity, and cluster the at least one target threat intelligence data according to the first degree of association to obtain at least one target threat intelligence data set, wherein any two target threat intelligence data sets do not contain the same target threat intelligence data;

[0017] a sorting module configured to sort each target threat intelligence data in the at least one target threat intelligence data set according to the magnitude of the first correlation degree, to obtain at least one target threat intelligence data sequence corresponding to a cluster center of the at least one target threat intelligence data set, wherein the cluster center is a target threat intelligence data in the target threat intelligence data set that has the first correlation degree with all target threat intelligence data other than itself;

[0018] a calculation module configured to align target threat intelligence data in two target threat intelligence data sequences based on a positional relationship, and calculate a second correlation degree between each set of aligned target threat intelligence data, wherein a set of target threat intelligence data includes first target threat intelligence data and second target threat intelligence data, the first target threat intelligence data being target threat intelligence data at a certain position in one target threat intelligence data sequence, and the second target threat intelligence data being target threat intelligence data at a certain position in another target threat intelligence data sequence;

[0019] a determination module configured to determine a target correlation degree between the two target threat intelligence data sequences based on the second correlation degrees between the groups of target threat intelligence data and the target weights corresponding to the groups of target threat intelligence data;

[0020] A judgment module is configured to judge whether the target correlation between two target threat intelligence data sequences is greater than a preset threshold;

[0021] an association module configured to associate two cluster centers corresponding to the two target threat intelligence data sequences if the probability of ...

[0022] The fusion module is configured to perform a fusion operation on each target threat intelligence data set in a target threat intelligence data set and other cluster centers associated with the cluster center of the target threat intelligence data set based on a preset field fusion rule table, and write the fused threat intelligence data into a preset database.

[0023] According to a third aspect, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the multi-source threat intelligence fusion analysis method for network security of any embodiment of the present invention.

[0024] In a fourth aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the program instructions are executed by a processor, the processor executes the steps of the multi-source threat intelligence fusion analysis method for network security of any embodiment of the present invention.

[0025] The multi-source threat intelligence fusion analysis method and system for network security of this application, BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0027] Figure 1 A flowchart of a multi-source threat intelligence fusion analysis method for network security provided by one embodiment of the present invention;

[0028] Figure 2 A structural block diagram of a multi-source threat intelligence fusion analysis system for network security provided by one embodiment of the present invention;

[0029] Figure 3 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0031] See also Figure 1 , which shows a flowchart of a multi-source threat intelligence fusion analysis method for network security in the present application.

[0032] like Figure 1 As shown in FIG, the multi-source threat intelligence fusion analysis method for network security specifically includes the following steps:

[0033] Step S101: Acquire at least one target threat intelligence data within the same preset time period.

[0034] In this step, the at least one target threat intelligence data may be at least one target threat intelligence data from the same source and / or at least one target threat intelligence data from different sources. The acquisition method may be, for example, data analysis, paid purchase, etc.

[0035] Further preferably, the target threat intelligence data obtained from each intelligence source is converted into standard format data to facilitate subsequent data processing.

[0036] Step S102: determine a first degree of correlation between each target threat intelligence data based on semantic similarity, and cluster the at least one target threat intelligence data according to the first degree of correlation to obtain at least one target threat intelligence data set, wherein any two target threat intelligence data sets do not contain the same target threat intelligence data.

[0037] In this step, a first correlation between two target threat intelligence data is determined based on semantic similarity, and it is determined whether the first correlation is greater than a preset first correlation threshold; if the first correlation is greater than the preset correlation threshold, a third correlation greater than a preset second correlation threshold is obtained between a certain target threat intelligence data and other target threat intelligence data, and between another target threat intelligence data and other target threat intelligence data, and it is determined whether the number of third correlations greater than the preset second correlation threshold corresponding to a certain target threat intelligence data is greater than the number of third correlations greater than the preset second correlation threshold corresponding to another target threat intelligence data; if the number of third correlations greater than the preset second correlation threshold corresponding to a certain target threat intelligence data is greater than the number of third correlations greater than the preset second correlation threshold corresponding to another target threat intelligence data, then the certain target threat intelligence data is clustered as a cluster center to obtain a target threat intelligence data set; if the number of third correlations greater than the preset second correlation threshold corresponding to a certain target threat intelligence data is not greater than the number of third correlations greater than the preset second correlation threshold corresponding to another target threat intelligence data, then another target threat intelligence data is clustered as a cluster center to obtain a target threat intelligence data set.

[0038] Furthermore, if the first correlation between two target threat intelligence data is not greater than a preset first correlation threshold, neither of the two target threat intelligence data is used as a cluster center, and other cluster centers are sought.

[0039] It should be noted that determining the first correlation between two target threat intelligence data based on semantic similarity is specifically as follows: vectorizing the two target threat intelligence data based on the semantic pre-training model to obtain two threat intelligence semantic vectors, and using the similarity algorithm to calculate the similarity of the two threat intelligence semantic vectors, that is, obtaining the first correlation between the two target threat intelligence data. Among them, the semantic pre-training model includes at least two of a first semantic pre-training model based on word vectors, a second semantic pre-training model based on characters, and a third semantic pre-training model based on word embeddings. Similarity algorithms include but are not limited to cosine distance, Hamming distance, Manhattan distance, Euclidean distance, or Jaccard similarity coefficient.

[0040] Specifically, the first semantic training model based on word vectors can be, for example, a TF-IDF (termfrequency-inverse document frequency) algorithm that converts each word in the target threat intelligence data into a threat intelligence semantic vector. The second semantic pre-training model based on characters can be, for example, a SimHash algorithm that obtains a threat intelligence semantic vector. The third semantic training model based on word embedding can be, for example, a word2vec algorithm that converts each word in the target threat intelligence data into a word vector to obtain a threat intelligence semantic vector.

[0041] Step S103: sort the target threat intelligence data in the at least one target threat intelligence data set according to the size of the first correlation degree to obtain at least one target threat intelligence data sequence corresponding to the cluster center of the at least one target threat intelligence data set, wherein the cluster center is a target threat intelligence data in the target threat intelligence data set that has a first correlation degree with all target threat intelligence data other than itself.

[0042] For example, if the cluster center of a target threat intelligence data set is target threat intelligence data A, then other target threat intelligence data in the target threat intelligence data set have first correlations of different sizes with the target threat intelligence data A, and the minimum value of these first correlations of different sizes is greater than the preset first correlation threshold.

[0043] Step S104: align the target threat intelligence data in two target threat intelligence data sequences based on the position relationship, and calculate the second correlation between each group of aligned target threat intelligence data, wherein a group of target threat intelligence data includes first target threat intelligence data and second target threat intelligence data, the first target threat intelligence data is the target threat intelligence data at a certain position in one target threat intelligence data sequence, and the second target threat intelligence data is the target threat intelligence data at a certain position in another target threat intelligence data sequence.

[0044] In this step, the first target threat intelligence data in a target threat intelligence data sequence at the same position point is aligned with the second target threat intelligence data in another target threat intelligence data sequence; and the second correlation between the first target threat intelligence data and the second target threat intelligence data is calculated based on semantic similarity.

[0045] For example, in the target threat intelligence data sequence a, there are target threat intelligence data A1 located in the first position, target threat intelligence data A2 located in the second position, and target threat intelligence data A3 located in the third position; in the target threat intelligence data sequence b, there are target threat intelligence data B1 located in the first position, target threat intelligence data B2 located in the second position, target threat intelligence data B3 located in the third position, and target threat intelligence data B4 located in the fourth position, where the first position, second position, third position, and fourth position all refer to the sorting position of the target threat intelligence data in the target threat intelligence data sequence.

[0046] After alignment according to the method of this embodiment, the target threat intelligence data A1 corresponds to the target threat intelligence data B1, the target threat intelligence data A2 corresponds to the target threat intelligence data B2, and the target threat intelligence data A3 corresponds to the target threat intelligence data B3. Then, based on the semantic similarity, the second correlation between the target threat intelligence data A1 and the target threat intelligence data B1, the second correlation between the target threat intelligence data A2 and the target threat intelligence data B2, and the second correlation between the target threat intelligence data A3 and the target threat intelligence data B3 are calculated respectively.

[0047] Step S105 : determining a target correlation between the two target threat intelligence data sequences according to the second correlation between the groups of target threat intelligence data and the target weights corresponding to the groups of target threat intelligence data.

[0048] In this step, the number of groups of target threat intelligence data in two target threat intelligence data sequences that are aligned based on the positional relationship is obtained;

[0049] If the number of groups is an even number, each group of target threat intelligence data is divided into a first part and a second part of the same number of groups, and the target weight corresponding to each group of target threat intelligence data in the first part is determined according to a preset first calculation rule, and the target weight corresponding to each group of target threat intelligence data in the second part is determined according to a preset second calculation rule, wherein the expression of the first calculation rule is:

[0050]

[0051] Where W i is the target weight corresponding to the i-th group of target threat intelligence data in the first part, and N is the number of groups of target threat intelligence data in two target threat intelligence data sequences after alignment based on the position relationship;

[0052] The expression of the second calculation rule is:

[0053]

[0054] Where N′ is the number of groups of target threat intelligence data after alignment in the first part, W j is the target weight corresponding to the jth group of target threat intelligence data in the second part;

[0055] If the number of groups is an odd number, each group of target threat intelligence data is divided into a first part, a second part, and a third part located in the middle, each of which has the same number of groups. The target weight corresponding to each group of target threat intelligence data in the first part is determined according to a preset first calculation rule, the target weight corresponding to each group of target threat intelligence data in the second part is determined according to a preset second calculation rule, and the target weight corresponding to a group of target threat intelligence data in the third part is determined according to a preset third calculation rule, wherein the expression of the third calculation rule is:

[0056]

[0057] Where W k is the target weight corresponding to the kth group of target threat intelligence data in the third part.

[0058] For example, after the target threat intelligence data sequence a corresponding to the cluster center of target threat intelligence data A and the target threat intelligence data sequence b corresponding to the cluster center of target threat intelligence data B are aligned, four groups of target threat intelligence data are generated: the first group (target threat intelligence data A1 and target threat intelligence data B1), the second group (target threat intelligence data Δ2 and target threat intelligence data B2), the third group (target threat intelligence data A3 and target threat intelligence data B3) and the fourth group (target threat intelligence data A4 and target threat intelligence data B4).

[0059] Among them, the target weight of the first group is: 1 / 4+1 / 10, the target weight of the second group is: 1 / 4+1 / 20, the target weight of the third group is: 1 / 4-1 / 20, and the target weight of the fourth group is: 1 / 4-1 / 10.

[0060] For another example, after the target threat intelligence data sequence a and the target threat intelligence data sequence b are aligned, five groups of target threat intelligence data are generated: the first group (target threat intelligence data A1 and target threat intelligence data B1), the second group (target threat intelligence data A2 and target threat intelligence data B2), the third group (target threat intelligence data A3 and target threat intelligence data B3), the fourth group (target threat intelligence data A4 and target threat intelligence data B4) and the fifth group (target threat intelligence data A5 and target threat intelligence data B5).

[0061] Among them, the target weight of the first group is: 1 / 4+1 / 10, the target weight of the second group is: 1 / 4+1 / 20, the target weight of the third group is: 1 / 4, the target weight of the fourth group is: 1 / 4-1 / 20, and the target weight of the fourth group is: 1 / 4-1 / 10.

[0062] Afterwards, the target weight index of each group is multiplied by the second correlation degree of the corresponding group to obtain the target correlation degree between the target threat intelligence data sequence a and the target threat intelligence data sequence b. Therefore, the potential target correlation degree between the cluster center being the target threat intelligence data A and the cluster center being the target threat intelligence data B is obtained.

[0063] Step S106: Determine whether the target correlation between two target threat intelligence data sequences is greater than a preset threshold.

[0064] In this step, if the correlation is not greater than the preset threshold, the two cluster centers corresponding to the two target threat intelligence data sequences are not associated, and the target correlation between the other two target threat intelligence data sequences is determined to be greater than the preset threshold. For example, if the potential target correlation between cluster center target threat intelligence data A and cluster center target threat intelligence data B is less than the preset threshold, it indicates that the potential relationship between target threat intelligence data A and cluster center target threat intelligence data B is not strong. Therefore, in the process of fusing the set containing target threat intelligence data A, target threat intelligence data B can be discarded, which will prevent the occurrence of low fusion accuracy.

[0065] Step S107: If the value is greater than a preset threshold, two cluster centers corresponding to the two target threat intelligence data sequences are associated.

[0066] Step S108: Based on the preset field fusion rule table, each target threat intelligence data in a target threat intelligence data set and other cluster centers associated with the cluster center of the target threat intelligence data set are fused, and the fused threat intelligence data is written into a preset database.

[0067] In this step, deduplication fields and fusion fields are determined based on the type of each target threat intelligence data, and the field fusion rule table is generated; deduplication operations are performed on the deduplication fields in each target threat intelligence data in the certain target threat intelligence data set and the deduplication fields in other cluster centers associated with the cluster center of the certain target threat intelligence data set according to the field fusion rule table; fusion operations are performed on the fusion fields in each target threat intelligence data in the certain target threat intelligence data set and the fusion fields in other cluster centers associated with the cluster center of the certain target threat intelligence data set according to the field fusion rule table.

[0068] Specifically, target threat intelligence data types may include Threat-actor (attack subject), Campaign (attack activity), Course of action (countermeasures), Report (report), Indicator (indicator), Exploit Target (exploit target), and TTP (attack method). Depending on the type of target threat intelligence data, the deduplication fields and fusion fields are determined manually or through other means.

[0069] In summary, the method of the present application sorts each target threat intelligence data in at least one target threat intelligence data set according to the size of the first correlation degree, obtains at least one target threat intelligence data sequence corresponding to the cluster center of at least one target threat intelligence data set, and then aligns the target threat intelligence data in two target threat intelligence data sequences based on the position relationship, and calculates the second correlation degree between each group of aligned target threat intelligence data, and then determines the target correlation degree between the two target threat intelligence data sequences according to the second correlation degree between each group of target threat intelligence data and the target weight corresponding to each group of target threat intelligence data, and judges whether the target correlation degree between the two target threat intelligence data sequences is Greater than a preset threshold. If greater than the preset threshold, two cluster centers corresponding to two target threat intelligence data sequences will be associated. Finally, based on the preset field fusion rule table, each target threat intelligence data in a target threat intelligence data set and other cluster centers associated with the cluster center of a target threat intelligence data set will be fused, and the fused threat intelligence data will be written into the preset database. This can fuse target threat intelligence data with potential correlation together, improve the integration efficiency of threat intelligence in the fusion process, and solve the problem that the existing fusion method will cause some intelligence data with high potential correlation to be missed, which will cause false alarms to a certain extent and affect network security protection capabilities.

[0070] See also Figure 2 , which shows a structural block diagram of a multi-source threat intelligence fusion analysis system for network security in the present application.

[0071] like Figure 2 As shown, the multi-source threat intelligence fusion analysis system 200 includes an acquisition module 210, a clustering module 220, a sorting module 230, a calculation module 240, a determination module 250, a judgment module 260, an association module 270 and a fusion module 280.

[0072] The acquisition module 210 is configured to acquire at least one threat intelligence data within the same preset time period, and perform deduplication processing on the at least one threat intelligence data according to a preset screening rule to obtain at least one target threat intelligence data;

[0073] The clustering module 220 is configured to determine a first correlation between each target threat intelligence data based on semantic similarity, and cluster the at least one target threat intelligence data according to the first correlation to obtain at least one target threat intelligence data set, wherein any two target threat intelligence data sets do not contain the same target threat intelligence data;

[0074] The sorting module 230 is configured to sort each target threat intelligence data in the at least one target threat intelligence data set according to the magnitude of the first correlation, to obtain at least one target threat intelligence data sequence corresponding to a cluster center of the at least one target threat intelligence data set, wherein the cluster center is a target threat intelligence data in the target threat intelligence data set that has the first correlation degree with all target threat intelligence data other than itself;

[0075] A calculation module 240 is configured to align target threat intelligence data in two target threat intelligence data sequences based on a positional relationship, and calculate a second correlation between each set of aligned target threat intelligence data, wherein a set of target threat intelligence data includes first target threat intelligence data and second target threat intelligence data, the first target threat intelligence data being target threat intelligence data at a certain position in one target threat intelligence data sequence, and the second target threat intelligence data being target threat intelligence data at a certain position in another target threat intelligence data sequence;

[0076] a determination module 250 configured to determine a target correlation between the two target threat intelligence data sequences based on the second correlation between the groups of target threat intelligence data and the target weights corresponding to the groups of target threat intelligence data;

[0077] A determination module 260 is configured to determine whether a target correlation between two target threat intelligence data sequences is greater than a preset threshold;

[0078] The association module 270 is configured to associate two cluster centers corresponding to the two target threat intelligence data sequences if the value is greater than a preset threshold;

[0079] The fusion module 280 is configured to perform a fusion operation on each target threat intelligence data set in a target threat intelligence data set and other cluster centers associated with the cluster center of the target threat intelligence data set based on a preset field fusion rule table, and write the fused threat intelligence data into a preset database.

[0080] It should be understood that Figure 2 Modules and references documented in Figure 1 Therefore, the operations and features described above for the method and the corresponding technical effects also apply to Figure 2 The modules in it will not be described in detail here.

[0081] In other embodiments, embodiments of the present invention further provide a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor is caused to execute the multi-source threat intelligence fusion analysis method for network security in any of the above method embodiments;

[0082] As an embodiment, the computer-readable storage medium of the present invention stores computer-executable instructions, and the computer-executable instructions are configured as follows:

[0083] Obtain at least one target threat intelligence data within the same preset time period;

[0084] Determining a first degree of association between each target threat intelligence data based on semantic similarity, and clustering the at least one target threat intelligence data according to the first degree of association to obtain at least one target threat intelligence data set, wherein any two target threat intelligence data sets do not contain the same target threat intelligence data;

[0085] sorting each target threat intelligence data in the at least one target threat intelligence data set according to the magnitude of the first correlation degree to obtain at least one target threat intelligence data sequence corresponding to a cluster center of the at least one target threat intelligence data set, wherein the cluster center is a target threat intelligence data in the target threat intelligence data set that has the first correlation degree with all target threat intelligence data other than itself;

[0086] aligning target threat intelligence data in two target threat intelligence data sequences based on a positional relationship, and calculating a second correlation degree between each set of aligned target threat intelligence data, wherein a set of target threat intelligence data includes first target threat intelligence data and second target threat intelligence data, the first target threat intelligence data being target threat intelligence data at a certain position in one target threat intelligence data sequence, and the second target threat intelligence data being target threat intelligence data at a certain position in another target threat intelligence data sequence;

[0087] Determining a target correlation degree between the two target threat intelligence data sequences according to the second correlation degrees between the groups of target threat intelligence data and the target weights corresponding to the groups of target threat intelligence data;

[0088] Determine whether the target correlation between two target threat intelligence data sequences is greater than a preset threshold;

[0089] If it is greater than a preset threshold, two cluster centers corresponding to the two target threat intelligence data sequences are associated;

[0090] Based on the preset field fusion rule table, each target threat intelligence data in a target threat intelligence data set and other cluster centers associated with the cluster center of the target threat intelligence data set are fused, and the fused threat intelligence data is written into the preset database.

[0091] The computer-readable storage medium may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the multi-source threat intelligence fusion analysis system for network security, etc. In addition, the computer-readable storage medium may include a high-speed random access memory, and may also include a memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state memory device. In some embodiments, the computer-readable storage medium may optionally include a memory remotely located relative to the processor, and these remote memories may be connected to the multi-source threat intelligence fusion analysis system for network security via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0092] Figure 3 Schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 3 As shown, the device includes: a processor 310 and a memory 320. The electronic device may also include: an input device 330 and an output device 340. The processor 310, the memory 320, the input device 330 and the output device 340 may be connected via a bus or other means. Figure 3 The example of the bus connection is taken. The memory 320 is the computer-readable storage medium mentioned above. The processor 310 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 320, that is, implements the multi-source threat intelligence fusion analysis method for network security of the above method embodiment. The input device 330 can receive input digital or character information, and generate key signal input related to user settings and function control of the multi-source threat intelligence fusion analysis system for network security. The output device 340 may include a display device such as a display screen.

[0093] The electronic device can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided by the embodiment of the present invention.

[0094] As an embodiment, the electronic device is applied to a multi-source threat intelligence fusion analysis system for network security, and is used for a client, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0095] Obtain at least one target threat intelligence data within the same preset time period;

[0096] Determining a first degree of association between each target threat intelligence data based on semantic similarity, and clustering the at least one target threat intelligence data according to the first degree of association to obtain at least one target threat intelligence data set, wherein any two target threat intelligence data sets do not contain the same target threat intelligence data;

[0097] sorting each target threat intelligence data in the at least one target threat intelligence data set according to the magnitude of the first correlation degree to obtain at least one target threat intelligence data sequence corresponding to a cluster center of the at least one target threat intelligence data set, wherein the cluster center is a target threat intelligence data in the target threat intelligence data set that has the first correlation degree with all target threat intelligence data other than itself;

[0098] aligning target threat intelligence data in two target threat intelligence data sequences based on a positional relationship, and calculating a second correlation degree between each set of aligned target threat intelligence data, wherein a set of target threat intelligence data includes first target threat intelligence data and second target threat intelligence data, the first target threat intelligence data being target threat intelligence data at a certain position in one target threat intelligence data sequence, and the second target threat intelligence data being target threat intelligence data at a certain position in another target threat intelligence data sequence;

[0099] Determining a target correlation degree between the two target threat intelligence data sequences according to the second correlation degrees between the groups of target threat intelligence data and the target weights corresponding to the groups of target threat intelligence data;

[0100] Determine whether the target correlation between two target threat intelligence data sequences is greater than a preset threshold;

[0101] If it is greater than a preset threshold, two cluster centers corresponding to the two target threat intelligence data sequences are associated;

[0102] Based on the preset field fusion rule table, each target threat intelligence data in a target threat intelligence data set and other cluster centers associated with the cluster center of the target threat intelligence data set are fused, and the fused threat intelligence data is written into the preset database.

[0103] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus the necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or certain parts of the embodiment.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A multi-source threat intelligence fusion analysis method for network security, characterized in that: The analysis method specifically comprises the following steps: Obtain at least one target threat intelligence data within the same preset time period; Determining a first correlation between each target threat intelligence data based on semantic similarity, and clustering the at least one target threat intelligence data according to the first correlation to obtain at least one target threat intelligence data set; sorting each target threat intelligence data in the at least one target threat intelligence data set according to the magnitude of the first correlation degree to obtain at least one target threat intelligence data sequence corresponding to a cluster center of the at least one target threat intelligence data set, wherein the cluster center is a target threat intelligence data in the target threat intelligence data set that has the first correlation degree with all target threat intelligence data other than itself; aligning target threat intelligence data in two target threat intelligence data sequences based on a positional relationship, and calculating a second correlation degree between each set of aligned target threat intelligence data, wherein a set of target threat intelligence data includes first target threat intelligence data and second target threat intelligence data, the first target threat intelligence data being target threat intelligence data at a certain position in one target threat intelligence data sequence, and the second target threat intelligence data being target threat intelligence data at a certain position in another target threat intelligence data sequence; Determining a target correlation degree between the two target threat intelligence data sequences according to the second correlation degrees between the groups of target threat intelligence data and the target weights corresponding to the groups of target threat intelligence data; Determine whether the target correlation between two target threat intelligence data sequences is greater than a preset threshold; If it is greater than a preset threshold, two cluster centers corresponding to the two target threat intelligence data sequences are associated; Based on the preset field fusion rule table, each target threat intelligence data in a target threat intelligence data set and other cluster centers associated with the cluster center of the target threat intelligence data set are fused, and the fused threat intelligence data is written into the preset database.

2. The analysis method according to claim 1, characterized in that The target threat intelligence data is at least one target threat intelligence data from the same source and / or at least one target threat intelligence data from different sources.

3. The analysis method according to claim 1, characterized in that The determining of a first correlation between each target threat intelligence data based on semantic similarity, and clustering the at least one target threat intelligence data according to the first correlation to obtain at least one target threat intelligence data set includes: Determine a first correlation between two target threat intelligence data based on semantic similarity, and determine whether the first correlation is greater than a preset first correlation threshold; If the first correlation is greater than the preset correlation threshold, respectively obtaining third correlations greater than the preset second correlation threshold between a certain target threat intelligence data and other target threat intelligence data, and between another target threat intelligence data and other target threat intelligence data, and determining whether the number of third correlations greater than the preset second correlation threshold corresponding to the certain target threat intelligence data is greater than the number of third correlations greater than the preset second correlation threshold corresponding to the other target threat intelligence data; If the number of third correlation degrees greater than the preset second correlation threshold corresponding to a certain target threat intelligence data is greater than the number of third correlation degrees greater than the preset second correlation threshold corresponding to another target threat intelligence data, clustering is performed using the certain target threat intelligence data as a cluster center to obtain a target threat intelligence data set; If the number of third correlation degrees greater than the preset second correlation threshold corresponding to a certain target threat intelligence data is not greater than the number of third correlation degrees greater than the preset second correlation threshold corresponding to another target threat intelligence data, then another target threat intelligence data is clustered as the cluster center to obtain a target threat intelligence data set.

4. The analysis method according to claim 1, characterized in that The step of aligning the target threat intelligence data in two target threat intelligence data sequences based on a positional relationship and calculating a second correlation degree between each set of aligned target threat intelligence data includes: Aligning first target threat intelligence data in a target threat intelligence data sequence with second target threat intelligence data in another target threat intelligence data sequence at the same position point; A second degree of association between the first target threat intelligence data and the second target threat intelligence data is calculated based on the semantic similarity.

5. The analysis method according to claim 1, characterized in that Before determining the target correlation between the two target threat intelligence data sequences based on the second correlation between the groups of target threat intelligence data and the target weights corresponding to the groups of target threat intelligence data, the method further includes: Obtain the number of groups of target threat intelligence data in two target threat intelligence data sequences that are aligned based on their positional relationship; If the number of groups is an even number, each group of target threat intelligence data is divided into a first part and a second part of the same number of groups, and the target weight corresponding to each group of target threat intelligence data in the first part is determined according to a preset first calculation rule, and the target weight corresponding to each group of target threat intelligence data in the second part is determined according to a preset second calculation rule, wherein the expression of the first calculation rule is: Where W i is the target weight corresponding to the i-th group of target threat intelligence data in the first part, and N is the number of groups of target threat intelligence data in two target threat intelligence data sequences after alignment based on the position relationship; The expression of the second calculation rule is: Where N′ is the number of target threat intelligence data groups after alignment in the first part, W j is the target weight corresponding to the j-th group of target threat intelligence data in the second part; If the number of groups is an odd number, each group of target threat intelligence data is divided into a first part, a second part, and a third part located in the middle, each of which has the same number of groups. The target weight corresponding to each group of target threat intelligence data in the first part is determined according to a preset first calculation rule, the target weight corresponding to each group of target threat intelligence data in the second part is determined according to a preset second calculation rule, and the target weight corresponding to a group of target threat intelligence data in the third part is determined according to a preset third calculation rule, wherein the expression of the third calculation rule is: Where W k is the target weight corresponding to the kth group of target threat intelligence data in the third part.

6. The analysis method according to claim 1, characterized in that After determining whether the target correlation between two target threat intelligence data sequences is greater than a preset threshold, the method further includes: If it is not greater than the preset threshold, the two cluster centers corresponding to the two target threat intelligence data sequences are not associated, and it is continued to be determined whether the target correlation between the other two target threat intelligence data sequences is greater than the preset threshold.

7. The analysis method according to claim 1, characterized in that The fusing operation of each target threat intelligence data in a target threat intelligence data set and other cluster centers associated with the cluster center of the target threat intelligence data set based on the preset field fusion rule table includes: Determine deduplication fields and fusion fields based on the type of each target threat intelligence data, and generate the field fusion rule table; performing a deduplication operation on the deduplication fields in each target threat intelligence data in the target threat intelligence data set and the deduplication fields in other cluster centers associated with the cluster center of the target threat intelligence data set according to the field fusion rule table; According to the field fusion rule table, a fusion operation is performed on the fusion fields in each target threat intelligence data in the target threat intelligence data set and the fusion fields in other cluster centers associated with the cluster center of the target threat intelligence data set.

8. A multi-source threat intelligence fusion analysis system for network security, characterized in that: include: an acquisition module configured to acquire at least one threat intelligence data within a same preset time period, and perform deduplication processing on the at least one threat intelligence data according to a preset screening rule to obtain at least one target threat intelligence data; a clustering module configured to determine a first degree of association between each target threat intelligence data based on semantic similarity, and cluster the at least one target threat intelligence data according to the first degree of association to obtain at least one target threat intelligence data set, wherein any two target threat intelligence data sets do not contain the same target threat intelligence data; a sorting module configured to sort each target threat intelligence data in the at least one target threat intelligence data set according to the magnitude of the first correlation degree, to obtain at least one target threat intelligence data sequence corresponding to a cluster center of the at least one target threat intelligence data set, wherein the cluster center is a target threat intelligence data in the target threat intelligence data set that has the first correlation degree with all target threat intelligence data other than itself; a calculation module configured to align target threat intelligence data in two target threat intelligence data sequences based on a positional relationship, and calculate a second correlation degree between each set of aligned target threat intelligence data, wherein a set of target threat intelligence data includes first target threat intelligence data and second target threat intelligence data, the first target threat intelligence data being target threat intelligence data at a certain position in one target threat intelligence data sequence, and the second target threat intelligence data being target threat intelligence data at a certain position in another target threat intelligence data sequence; a determination module configured to determine a target correlation degree between the two target threat intelligence data sequences based on the second correlation degrees between the groups of target threat intelligence data and the target weights corresponding to the groups of target threat intelligence data; A judgment module is configured to judge whether the target correlation between two target threat intelligence data sequences is greater than a preset threshold; an association module configured to associate two cluster centers corresponding to the two target threat intelligence data sequences if the probability of ... The fusion module is configured to perform a fusion operation on each target threat intelligence data set in a target threat intelligence data set and other cluster centers associated with the cluster center of the target threat intelligence data set based on a preset field fusion rule table, and write the fused threat intelligence data into a preset database.

9. An electronic device, characterized in that: include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images