Security protection method, device and storage medium based on network threat intelligence analysis

Abstract

The present invention provides a security protection method, device and storage medium based on network threat intelligence analysis. Based on obtaining network threat intelligence training text, characterization information is extracted to obtain the distribution position of training entities and the corresponding distribution characteristics of training entities. The distribution position of training entities is used as the center of Gaussian distribution. According to the distribution characteristics of training entities, the predicted entity probability distribution sequence corresponding to the distribution position of training entities is reversely generated. The network debugging error is determined by comparison. When debugging the threat entity identification network according to the network debugging error, the output of the threat entity identification network is further limited based on the predicted entity probability distribution sequence, so that the threat entity identification network can clearly extract the information of the entity, which is conducive to obtaining the essential characteristics in the network threat intelligence training text, increasing the ability of the threat entity identification network, and can improve the accuracy of the threat intelligence entity, which is conducive to quickly and accurately obtaining the content of network threat intelligence for security protection.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a security protection method, device and storage medium based on network threat intelligence analysis. Background Art

[0002] With the rapid development of information technology, the application of networks in various fields is becoming more and more extensive, and the forms of network attacks are constantly evolving, including malware propagation, phishing, distributed denial of service attacks (DDoS), etc. In order to cope with complex and changing network threats, the concept of Cyber ​​Threat Intelligence (CTI) came into being. Cyber ​​Threat Intelligence refers to information about network threats, including threat sources, threat targets, attack methods, attack trends and other aspects of knowledge. By collecting, analyzing and sharing cyber threat intelligence, network security defenders can understand potential threats in advance and formulate effective security protection strategies, thereby enhancing network security.

[0003] In cyber threat intelligence analysis, accurately identifying threat intelligence entities (such as the IP address of the attack source, the name of the malware, the target of the attack, etc.) is a key task. Traditional entity recognition methods often rely on simple rule matching or machine learning models based on a single feature. For example, rule-based methods require a large number of rules to be manually written to identify different types of threat intelligence entities. The limitation of this method is that it is difficult to cope with complex and changing cyber threat scenarios. Newly emerging cyber attacks may have different characteristics from the past, and the rules need to be constantly updated, which is a time-consuming and error-prone process. When processing cyber threat intelligence text, machine learning models based on a single feature (such as models that only use word frequency features) may have low entity recognition accuracy due to a lack of grasp of the comprehensive features of the text. For example, when identifying malware names, only considering word frequency may misjudge some common software names as malware, or miss some newly emerging, low-frequency malware names. Summary of the invention

[0004] In view of this, the present application provides a security protection method, device and storage medium based on network threat intelligence analysis. The technical solution of the present application is implemented as follows:

[0005] On the one hand, the present application provides a security protection method based on network threat intelligence analysis, including: obtaining a network threat intelligence training text used as a learning template data, extracting representation information from the network threat intelligence training text according to a threat entity recognition network, and obtaining the training entity distribution position of the threat intelligence entity contained in the network threat intelligence training text, as well as the training entity distribution features corresponding to the training entity distribution position; taking the training entity distribution position as the center of the Gaussian distribution, and generating a predicted entity probability distribution sequence corresponding to the training entity distribution position based on the training entity distribution features; obtaining a priori entity probability distribution sequence corresponding to the network threat intelligence training text, wherein the priori entity probability distribution sequence is the threat entity distribution center. The method comprises the steps of: obtaining a target network threat intelligence entity identification text to be subjected to threat intelligence entity identification, extracting representation information of the target network threat intelligence text according to the debugged and converged threat entity identification network, and executing to obtain a target entity distribution position of the threat intelligence entity contained in the target network threat intelligence text, so as to determine a security protection strategy based on the entity content corresponding to the target entity distribution position.

[0006] In the second aspect, the present application provides a security protection device based on network threat intelligence analysis, including: a training sample acquisition module, which is used to obtain network threat intelligence training text used as learning template data, extract representation information of the network threat intelligence training text according to the threat entity recognition network, and execute to obtain the training entity distribution position of the threat intelligence entity contained in the network threat intelligence training text, and the training entity distribution characteristics corresponding to the training entity distribution position; a probability distribution generation module, which is used to use the training entity distribution position as the center of the Gaussian distribution, and generate a predicted entity probability distribution sequence corresponding to the training entity distribution position based on the training entity distribution characteristics; a training label acquisition module, which is used to obtain a priori entity probability distribution sequence corresponding to the network threat intelligence training text, wherein the priori entity probability The distribution sequence is a debugging reference mark of the threat entity identification network; a network debugging module is used to determine the network debugging error of the threat entity identification network based on the predicted entity probability distribution sequence and the prior entity probability distribution sequence, and debug the threat entity identification network based on the network debugging error until the threat entity identification network reaches a preset debugging stop condition to obtain a converged threat entity identification network; a network calling module is used to obtain a target network threat intelligence text to be subjected to threat intelligence entity identification, extract representation information from the target network threat intelligence text according to the debugged converged threat entity identification network, and execute to obtain the target entity distribution position of the threat intelligence entity contained in the target network threat intelligence text, so as to determine a security protection strategy based on the entity content corresponding to the target entity distribution position.

[0007] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the method provided in the first aspect above.

[0008] The beneficial effects of the present application are as follows: based on obtaining a network threat intelligence training text used as a learning template data, characterization information extraction is performed on the network threat intelligence training text according to a threat entity identification network, not only the training entity distribution position of the threat intelligence entity contained in the network threat intelligence training text is obtained, but also the training entity distribution characteristics corresponding to the training entity distribution position are obtained, the training entity distribution position is used as the center of the Gaussian distribution, and a predicted entity probability distribution sequence corresponding to the training entity distribution position is reversely generated according to the training entity distribution characteristics, so that the network debugging error of the threat entity identification network is determined by comparing the predicted entity probability distribution sequence with the prior entity probability distribution sequence corresponding to the network threat intelligence training text. When debugging the threat entity identification network according to the network debugging error, the output of the threat entity identification network is further restricted based on the predicted entity probability distribution sequence, so that the threat entity identification network clearly extracts the information of the entity, which is conducive to obtaining the essential characteristics in the network threat intelligence training text and increasing the capacity of the threat entity identification network. When characterization information extraction is performed on the target network threat intelligence text according to the debugged converged threat entity identification network, and the target entity distribution position of the threat intelligence entity contained in the target network threat intelligence text is obtained, the accuracy of the threat intelligence entity can be improved, which is conducive to quickly and accurately obtaining the network threat intelligence content for security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A schematic diagram of the implementation process of a security protection method based on network threat intelligence analysis provided in an embodiment of the present application.

[0010] Figure 2 A schematic diagram of the composition structure of a security protection device based on network threat intelligence analysis provided in an embodiment of the present application.

[0011] Figure 3 A hardware entity diagram of a computer system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] The embodiment of the present application provides a security protection method based on network threat intelligence analysis, which can be executed by a processor of a computer system. The computer system can refer to a device with data processing capabilities such as a server, a laptop, a tablet computer, and a desktop computer.

[0013] Figure 1 A schematic diagram of the implementation process of a security protection method based on network threat intelligence analysis provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes the following operations 110 to 150:

[0014] Step S100: Obtain network threat intelligence training text used as learning template data, extract representation information from the network threat intelligence training text according to the threat entity identification network, and obtain the training entity distribution positions of the threat intelligence entities contained in the network threat intelligence training text, as well as the training entity distribution features corresponding to the training entity distribution positions.

[0015] In the embodiment of the present application, the network threat intelligence training text is text data containing information related to network threats, such as network security reports containing information such as network attack types, attack sources, and attack targets, network traffic log analysis results, and other text content. After the computer system obtains these texts, it inputs them into the threat entity identification network. The threat entity identification network is a network structure specially designed to identify entity information in network threat intelligence. It may include multiple neural network layers, such as convolutional layers, pooling layers, etc. These layers process the input text through specific algorithms and parameter settings.

[0016] The computer system analyzes and processes the network threat intelligence training text through the threat entity recognition network. This process is similar to deep mining of the text to obtain the hidden information related to the threat intelligence entity. Specifically, for each word in the training text (which can be understood as the smallest semantic unit in the text, such as a word or a specific character combination), the threat entity recognition network will assign it a specific feature vector based on predefined rules and algorithms. This feature vector contains the representation information related to the threat intelligence entity.

[0017] The training entity distribution position refers to the location information of the threat intelligence entity in the text structure in the network threat intelligence training text. For example, if the network threat intelligence training text is a description of a network attack event, which mentions "malware from IP address 192.168.1.1 attacked the company's server", then the position of the threat intelligence entity "192.168.1.1" (the IP address of the attack source) in the text is its training entity distribution position.

[0018] The training entity distribution features describe some characteristic attributes of the threat intelligence entity at the distribution position. These characteristic attributes can be obtained through a variety of technical means. One possible technical means is based on statistical methods, such as calculating the correlation coefficient between the entity and the surrounding words. Assume that there is a simple linear relationship to represent this correlation. Let the entity be E and the surrounding words be , the correlation coefficient r can be obtained by the formula To calculate, and They are entity E and word unit Another possibility is a method based on semantic analysis, such as obtaining the semantic feature vector of the entity through a pre-trained word vector model (such as Word2Vec, etc.). Each dimension value in this vector can be used as part of the distribution feature of the training entity.

[0019] Step S200: taking the training entity distribution position as the center of the Gaussian distribution, and generating a predicted entity probability distribution sequence corresponding to the training entity distribution position according to the training entity distribution characteristics.

[0020] In step S200 of the embodiment of the present application, the training entity distribution position is determined in step S100, which represents the location information of the threat intelligence entity in the network threat intelligence training text. For example, in a network security incident report, if "malicious IP address 10.0.0.1" is a threat intelligence entity, its sentence position or relative position in the paragraph is the training entity distribution position. The training entity distribution features describe the various characteristics of the entity at this position, which may include the relationship between the entity and surrounding information, semantic features and other attributes.

[0021] The computer system sets the training entity distribution position to the center of the Gaussian distribution. Gaussian distribution, also known as normal distribution, is a probability distribution model widely used in statistics. Its probability density function is ,in is the mean (here it is a reference value corresponding to the distribution position of the training entity), is the standard deviation.

[0022] Generating a predicted entity probability distribution sequence based on the training entity distribution features requires the use of a variety of technical means. For example, a computer system can adjust the parameters of the Gaussian distribution based on the relationship between the entity and the surrounding information (one of the training entity distribution features). Assuming that a threat intelligence entity is associated with three specific types of entities around it, these three associations can be quantified into three weight values The computer system can link these weights to certain parameters of the Gaussian distribution, such as adjusting the standard deviation through linear combinations. , assuming the adjustment formula is ,in is the initial standard deviation, and a, b, and c are predetermined coefficients.

[0023] The predicted entity probability distribution sequence represents the probability distribution of entities that may exist at and around the training entity distribution location. Taking the network attack scenario as an example, if the threat intelligence entity is the attack source IP address, then the predicted entity probability distribution sequence may represent the probability of different types of attack tools (such as malware types) appearing around this IP address. This sequence is generated by the computer system based on the previously determined Gaussian distribution center (training entity distribution location) and various technical means to consider the distribution characteristics of the training entity. This predicted entity probability distribution sequence lays the foundation for subsequent comparison with the prior entity probability distribution sequence and then determining the network debugging error of the threat entity identification network, which helps the computer system to continuously optimize the accuracy and reliability of the threat entity identification network in the security protection method of network threat intelligence analysis.

[0024] Step S300: Obtain a priori entity probability distribution sequence corresponding to the network threat intelligence training text, wherein the priori entity probability distribution sequence is a debugging reference mark for the threat entity identification network.

[0025] In step S300 of the embodiment of the present application, the prior entity probability distribution sequence is a debugging reference mark for the threat entity identification network. The prior entity probability distribution sequence reflects the probability distribution of different entities in the network threat intelligence training text under some known conditions or prior knowledge.

[0026] For network threat intelligence training text, it contains a variety of threat intelligence entities, such as attack sources (such as specific IP addresses, malware names, etc.), attack targets (such as specific servers, network services, etc.) and attack methods (such as DDoS attacks, SQL injections, etc.). The prior entity probability distribution sequence is an a priori description of the probability of these entities appearing in the text.

[0027] The computer system can use different technical means to obtain the prior entity probability distribution sequence. One way is to obtain the annotated entity distribution position of the threat intelligence entity contained in the network threat intelligence training text, as well as the preset prior entity distribution characteristics, and use the annotated entity distribution position as the Gaussian distribution center, and establish a Gaussian model based on the prior entity distribution characteristics to obtain the prior entity probability distribution sequence.

[0028] For example, suppose that the cyber threat intelligence training text is a detailed record of cyber attack events. The annotation indicates that a malware name appears at a specific location in the text (annotated entity distribution location), and it is known that this malware has some prior characteristics when it appears in similar texts, such as the frequency with which it is usually associated with a specific type of attack target, the probability of co-occurring with certain attack methods, etc. (prior entity distribution characteristics). The Gaussian distribution model can be used to construct a priori entity probability distribution sequence. Let the value corresponding to the annotated entity distribution location be (mean, i.e., the center of the Gaussian distribution), the prior entity distribution characteristics determine the standard deviation of the Gaussian distribution Equal parameters, according to the probability density function of Gaussian distribution , the computer system can calculate the probabilities under different values ​​(corresponding to the relevant values ​​of different entities), thereby obtaining the prior entity probability distribution sequence.

[0029] Another possible way is to construct a network based on a pre-debugged entity probability distribution sequence, and use this constructed network to generate a priori entity probability distribution sequence corresponding to the network threat intelligence training text. This pre-debugged entity probability distribution sequence constructed network may be trained based on a large amount of prior network threat intelligence data. For example, based on a database containing a large number of network attack event samples, after preliminary analysis, modeling and network training, this network has learned the general probability relationship between different threat intelligence entities. When faced with a new network threat intelligence training text, the computer system uses this pre-trained network to generate the corresponding priori entity probability distribution sequence, which provides the necessary reference for the subsequent comparison with the predicted entity probability distribution sequence and the debugging of the threat entity identification network.

[0030] Step S400: Determine a network debugging error of the threat entity identification network based on the predicted entity probability distribution sequence and the prior entity probability distribution sequence, debug the threat entity identification network based on the network debugging error, until the threat entity identification network reaches a preset debugging stop condition, and obtain a converged threat entity identification network.

[0031] In step S400 of the embodiment of the present application, the predicted entity probability distribution sequence is generated by the computer system in step S200 based on the training entity distribution position and training entity distribution characteristics, which reflects the prediction result of the entity distribution in the network threat intelligence training text based on the current threat entity identification network. The prior entity probability distribution sequence is obtained in step S300, which is a debugging reference mark of the threat entity identification network, reflecting the probability distribution of entities under known conditions or prior knowledge.

[0032] When the computer system determines the network debugging error, it needs to compare and analyze the two probability distribution sequences. For example, suppose the predicted entity probability distribution sequence indicates that the probability of a certain network attack source (such as a specific IP address) appearing at a certain location is 0.3, while the probability of this attack source appearing at that location in the prior entity probability distribution sequence is 0.5. This difference reflects the degree of deviation between the prediction result and the prior knowledge, which is a manifestation of network debugging error.

[0033] The computer system can use different error functions to quantify this difference. For example, the first error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence is determined according to the negative log-likelihood error function. Assume that the predicted entity probability distribution sequence is P=(p_1, p_2, …, p_n), the prior entity probability distribution sequence is Q=(q_1, q_2, …,q_n), and the negative log-likelihood error function is , the calculated L value is the first error value. At the same time, the second error value between the two is determined according to the cross entropy error function. The cross entropy error function formula is: , the calculated H value is the second error value.

[0034] Then, the computer system determines the network debugging error based on the first error value and the second error value. For example, the network debugging error can be obtained by directly adding the two, and this error value reflects the overall deviation between the predicted entity probability distribution and the prior entity probability distribution.

[0035] After obtaining the network debugging error, the computer system debugs the threat entity identification network based on the error. The threat entity identification network is a complex neural network structure, which contains numerous neurons and connection weights. The computer system adjusts the weight parameters in the network according to the network debugging error to reduce the error. For example, if the network debugging error indicates that the prediction result overestimates the probability distribution of a certain entity, the computer system may reduce the neuron connection weights related to the entity, so that the network's prediction results are closer to the prior knowledge. This debugging process will be repeated until the threat entity identification network reaches a preset debugging stop condition. The debugging stop condition can be that the network debugging error is less than a preset threshold, or a certain number of iterations have passed. When these conditions are met, the computer system obtains a converged threat entity identification network, and this converged network can more accurately identify threat intelligence entities when the target network threat intelligence text is subsequently analyzed.

[0036] Step S500: Obtain the target network threat intelligence text for threat intelligence entity identification, extract characterization information of the target network threat intelligence text according to the debugged and converged threat entity identification network, and obtain the target entity distribution position of the threat intelligence entity contained in the target network threat intelligence text, so as to determine the security protection strategy based on the entity content corresponding to the target entity distribution position.

[0037] In step S500 of the embodiment of the present application, the target network threat intelligence text is the object that the computer system needs to analyze, and it contains various information related to network threats. For example, this text may be a text description of network traffic data collected in real time by a network monitoring device after preprocessing and conversion, which may contain suspicious IP address access records, abnormal port communications and other information, which may indicate potential network threats, such as network attacks, malware propagation, etc.

[0038] The computer system uses the debugged and converged threat entity identification network to process the target network threat intelligence text. The debugged and converged threat entity identification network is obtained after continuous debugging in the previous steps (such as step S400), and it has a relatively accurate ability in entity identification of network threat intelligence.

[0039] Extracting representation information from target network threat intelligence text is a complex process. Computer systems use various algorithms and models in threat entity recognition networks to mine hidden information in text. For example, a threat entity recognition network may include a convolutional neural network (CNN) layer, which can automatically extract local features in the text. For each part of the target network threat intelligence text, the CNN layer slides the convolution kernel on the text to perform a convolution operation, converting the characters or words in the text into a feature map, which contains partial representation information about the text.

[0040] The determination of the target entity distribution location of the threat intelligence entity is the key result of this step. The target entity distribution location indicates the location information of the threat intelligence entity in the target network threat intelligence text. Taking a simple network attack scenario as an example, if the target network threat intelligence text is described as "On May 10, 2023, IP address 192.168.1.100 launched multiple connection attempts to the server of the company's internal network, suspected of brute force attacks", then the specific location of the threat intelligence entity "192.168.1.100" (which may be the IP address of the attack source) in the text is the target entity distribution location.

[0041] Determining the target entity distribution location is crucial for the subsequent security protection strategy formulation. Based on the entity content corresponding to the target entity distribution location, the computer system can determine the security protection strategy. For example, if a specific malware name (threat intelligence entity) is found to appear in a specific location in the target network threat intelligence text, and this malware is known to be spread through a specific port, then the computer system can formulate a security protection strategy, such as blocking the malware’s common propagation ports in the firewall, or performing specific virus detection and killing operations on potentially infected hosts.

[0042] When extracting representation information, the computer system may use a variety of technical means. In addition to the CNN layer mentioned above, it may also include a recurrent neural network (RNN) or its variants, such as a long short-term memory network (LSTM) or a gated recurrent unit (GRU). The RNN series of networks are suitable for processing sequence data and can capture long-distance dependencies in text. Taking LSTM as an example, it controls the flow of information through a special gate structure (input gate, forget gate, and output gate). For each time step in the target network threat intelligence text (which can be understood as the processing step for each word or character), LSTM updates the state of these gates based on the current input, the hidden state of the previous moment, and the cell state, thereby achieving effective extraction of text representation information.

[0043] In addition, computer systems may also use attention mechanisms to enhance the extraction of representation information. The attention mechanism enables the model to automatically focus on important parts of the text. For example, in the target network threat intelligence text, if there are some key threat-related words, such as "attack" and "malicious", the attention mechanism will assign higher weights to these words, so that the threat entity identification network will focus more on these parts that are closely related to the threat when processing the text, thereby more accurately determining the target entity distribution location of the threat intelligence entity.

[0044] When the computer system executes step S500, it comprehensively uses various technical means and model structures to conduct in-depth analysis of the target network threat intelligence text, accurately obtain the target entity distribution location of the threat intelligence entity, and provide a solid foundation for formulating effective security protection strategies, so that it can be more proactive and accurate when responding to network threats. This step plays a key role in the entire security protection method based on network threat intelligence analysis, which not only utilizes the previously debugged threat entity identification network, but also provides a necessary information source for the determination of subsequent security protection strategies.

[0045] As an implementation method, the training entity distribution features include the first association parameter between the feature dimensions of any word-meta token in the basic entity probability distribution sequence to be generated and the second association parameter of the adjacent position features, the position dispersion of the character indexes of all word-meta tokens in the basic entity probability distribution sequence, and the feature dispersion of the feature dimensions of all word-meta tokens in the basic entity probability distribution sequence. Then, step S200, taking the training entity distribution position as the center of the Gaussian distribution, and generating the predicted entity probability distribution sequence corresponding to the training entity distribution position according to the training entity distribution features, may include:

[0046] Step S210: taking the character index and feature dimension of any word-meta token in the basic entity probability distribution sequence as a multidimensional feature vector, taking the training entity distribution position as the Gaussian distribution center, establishing a multi-component probability model according to the first association parameter, the second association parameter, the position dispersion and the feature dispersion, and obtaining the basic entity probability distribution sequence corresponding to the training entity distribution position;

[0047] Step S220: obtaining a predicted entity probability distribution sequence corresponding to the training entity distribution position according to the basic entity probability distribution sequence.

[0048] In step S210, the computer system uses the character index and feature dimension of any word meta-token in the basic entity probability distribution sequence as a multidimensional feature vector. The word meta-token is the basic semantic unit after the network threat intelligence training text is processed. For example, after a section of network threat intelligence text is segmented and tokenized, each word or character combination with specific semantics can be regarded as a word meta-token. The character index can be understood as the position number of the word meta-token in the entire text, and the feature dimension describes a certain aspect of the feature of the word meta-token. For example, when using the word vector model, a word meta-token may be represented as a multidimensional vector, and each dimension of this vector represents a feature, such as the quantitative value of features such as semantic similarity and grammatical role.

[0049] The computer system uses the training entity distribution position as the center of the Gaussian distribution. Gaussian distribution is a feasible probability distribution, which is characterized by symmetry, high in the middle and low on both sides. It is widely used in modeling many natural and artificial phenomena. In this scenario, the training entity distribution position becomes the center of this distribution, as if the probability distribution of other related entities revolves around this position.

[0050] The computer system establishes a multi-component probability model based on the first association parameter, the second association parameter, the position dispersion and the feature dispersion. The first association parameter and the second association parameter here are parameters that describe the relationship between the internal features of the word meta-token. For example, the first association parameter may represent the correlation between the feature dimensions of any word meta-token. Assume that in the word meta-token describing the source of a network attack, a dimension represents the geographical location of the attack source, and another dimension represents the network protocol type of the attack source. The first association parameter can quantify the degree of correlation between the two dimensions, such as by calculating their covariance in a large number of samples to determine this correlation. The second association parameter may represent the correlation of adjacent position features. For example, in a text describing a network attack incident, two adjacent word meta-tokens represent the attack tool and the attack target respectively. The second association parameter can measure the degree of correlation between the features of the two word meta-tokens.

[0051] Position dispersion reflects the dispersion of the character indexes of all word tokens in the probability distribution sequence of the underlying entity. For example, in a network threat intelligence training text, if the character indexes of the word tokens describing the attack source are widely distributed and appear from the beginning to the end of the text, then the position dispersion is large; conversely, if these word tokens are concentrated in a small part of the text, the position dispersion is small. Feature dispersion refers to the dispersion of the feature dimensions of all word tokens in the probability distribution sequence of the underlying entity. For example, for the word token representing the target of a network attack, its feature dimensions may include the target's operating system type, service type, etc. If these features vary greatly in different word tokens, the feature dispersion is high.

[0052] In the process of establishing a multi-component probability model, the computer system determines the two-dimensional array of distribution correlation (for example, a covariance matrix) based on the association parameters, position dispersion and feature dispersion. The covariance matrix is ​​an important tool for describing the covariance relationship between multiple variables. In this scenario, assuming that there are n word tokens, each word token has m feature dimensions, an m×m covariance matrix can be constructed. For the element C_{ij} in the matrix, it represents the covariance between the i-th feature dimension and the j-th feature dimension. The formula for calculating the covariance is , where X and Y are two variables (which can be different feature dimensions here), and are the values ​​of these two variables in the kth sample (word token), and is the mean of these two variables. By calculating this covariance matrix, the computer system can accurately grasp the correlation between each feature dimension, which is the basis for establishing a multi-component probability model.

[0053] Next, the computer system normalizes the multidimensional feature vector based on the correlation 2D array and the distribution of the training entities. Normalization is an operation that maps data to a specific interval (usually [0,1] or [-1,1]). In this process, the computer system adjusts the multidimensional feature vector of each word token based on the information in the previously determined covariance matrix (correlation 2D array). For example, suppose the multidimensional feature vector of a word token is , the computer system calculates a set of normalization factors based on the elements in the covariance matrix and the distribution positions of the training entities, and performs the following operations on each element in the vector: ,in is the mean of the ith element determined by the covariance matrix and the distribution position of the training entities, is the standard deviation. Through the normalization operation, the feature vectors of different word-unit tokens are represented on the same scale, which is conducive to the subsequent establishment of a unified multi-component probability model.

[0054] Finally, the computer system establishes a multi-component probability model based on the normalized result of the multi-dimensional feature vector to obtain the basic entity probability distribution sequence corresponding to the distribution position of the training entity. The multi-component probability model is a probability model that can comprehensively consider multiple factors (such as the character index of the word token, feature dimension, correlation, etc.). When establishing this model, the computer system uses the normalized multi-dimensional feature vector as input and obtains the basic entity probability distribution sequence through a series of mathematical operations (which may involve matrix multiplication, exponential functions, etc.). For example, suppose the normalized multi-dimensional feature vector is , the computer system follows a predefined model structure (which may be based on a neural network architecture or a statistical model), such as ,in is the ith probability value in the probability distribution sequence of the underlying entity, and f is a function defined by the model, which may contain Linear transformation, nonlinear activation (such as using sigmoid function or ReLU function) and other operations are performed to obtain the entire basic entity probability distribution sequence.

[0055] In step S220, the computer system obtains the predicted entity probability distribution sequence corresponding to the training entity distribution position based on the basic entity probability distribution sequence. The basic entity probability distribution sequence is obtained by establishing a multi-component probability model in step S210, which is a sequence of probability distributions of each word element token at the training entity distribution position. The predicted entity probability distribution sequence is a more comprehensive and integrated probability description of the threat intelligence entities that may appear around the training entity distribution position.

[0056] If in some cases, the training entity distribution features include multiple groups, and the threat entity identification network also executes to obtain the training component influence coefficient (i.e., weight) of the basic entity probability distribution sequence corresponding to each group of training entity distribution features, the computer system will weight the multiple basic entity probability distribution sequences according to the training component influence coefficient. For example, assuming there are three groups of training entity distribution features, the corresponding basic entity probability distribution sequences are , and their training component influence coefficients are The computer system performs a weighted summation of the probability values ​​of each position i to obtain the element in the probability distribution sequence of the predicted entity , by calculating all positions, we can get the complete predicted entity probability distribution sequence This predicted entity probability distribution sequence will be used for subsequent comparison with the prior entity probability distribution sequence, thereby providing a basis for debugging the threat entity identification network and further improving the accuracy of threat intelligence entity identification.

[0057] As an implementation method, the training entity distribution features include multiple groups, and the threat entity identification network also executes to obtain the training component influence coefficient of the basic entity probability distribution sequence corresponding to each group of training entity distribution features. Based on this, step S220, obtaining the predicted entity probability distribution sequence corresponding to the training entity distribution position according to the basic entity probability distribution sequence, may include:

[0058] Step S221: weighting multiple basic entity probability distribution sequences according to the training component influence coefficients to obtain a predicted entity probability distribution sequence corresponding to the training entity distribution position.

[0059] In step S221 of the embodiment of the present application, the training component influence coefficient can also be understood as a component weight, which reflects the relative importance of the basic entity probability distribution sequence corresponding to each set of training entity distribution features in the final determination of the predicted entity probability distribution sequence. The basic entity probability distribution sequence is a sequence of entity probability distribution generated based on different training entity distribution features in the previous steps (such as step S210, etc.). For example, in network threat intelligence analysis, it is assumed that an intelligence text about network attacks is being processed, which involves entity information such as attack sources (such as specific IP addresses, malware names, etc.), attack targets (such as specific servers, network services, etc.), and attack methods (such as DDoS attacks, SQL injections, etc.).

[0060] When a computer system generates a basic entity probability distribution sequence, it may be constructed based on different feature groups. For example, a set of features may focus on the semantic information in the text, convert the words in the text into vector form through technical means such as word vector models, and then construct the basic entity probability distribution sequence based on the relationship between these vectors, which is recorded as . Here n represents the number of elements in the sequence, Represents the i-th probability value in this basic entity probability distribution sequence built based on semantic information.

[0061] Another set of features may focus on the structural information in the text, such as the position relationship of words in sentences, the structural relationship of sentences in paragraphs, etc. The basic entity probability distribution sequence constructed based on these structural features is recorded as .

[0062] Assume that there is also a set of basic entity probability distribution sequences constructed based on features associated with the external knowledge base These basic entity probability distribution sequences each reflect the probability distribution of the entity in the training entity distribution position from different perspectives.

[0063] The corresponding training component influence coefficient Then they respectively represent the importance of these three groups of basic entity probability distribution sequences in the final result. The determination of these coefficients can be based on a variety of technical means. One possible way is to analyze a large amount of labeled data. For example, there is a set of accurately labeled network threat intelligence training texts, which clearly identify the true distribution of various entities. The computer system can compare the basic entity probability distribution sequences constructed based on different feature groups with the true distribution, and determine the weight of each basic entity probability distribution sequence through optimization algorithms (such as least squares method, etc.). Assume that the least squares method is used to determine , assuming that the real entity probability distribution sequence is , then the goal is to minimize the error function , by solving this optimization problem to obtain the value of w_1. and It can also be determined in a similar way.

[0064] The computer system performs weighted operations on multiple basic entity probability distribution sequences based on the training component influence coefficients. The specific formula is: ,in is the i-th element in the probability distribution sequence of the predicted entity. For example, for i=1, By performing such calculations for all positions i=1,2,…,n, the computer system obtains a complete sequence of predicted entity probability distributions .

[0065] This predicted entity probability distribution sequence integrates the information of the basic entity probability distribution sequence corresponding to the distribution characteristics of different training entities, and is weighted and integrated according to their respective importance (training component influence coefficient). In the scenario of network threat intelligence analysis, this predicted entity probability distribution sequence can more comprehensively and accurately reflect the probability distribution of threat intelligence entities that may appear around the distribution location of the training entities. For example, in an actual network security monitoring scenario, if you want to predict the probability of a certain malware (as a threat intelligence entity) appearing in a specific network area, the predicted entity probability distribution sequence obtained by this weighted method can take into account multiple factors such as semantic information (such as vocabulary descriptions related to malware), structural information (such as the structural position of the description of malware in the entire intelligence text), and information associated with external knowledge bases (such as the associated information of the malware in the known network threat knowledge base), thereby providing a more reliable basis for the subsequent comparison with the prior entity probability distribution sequence and the debugging of the threat entity identification network, which helps to improve the accuracy and effectiveness of the entire security protection method based on network threat intelligence analysis.

[0066] As an implementation mode, in step S210, establishing a multi-component probability model according to the first association parameter, the second association parameter, the position dispersion and the feature dispersion to obtain a basic entity probability distribution sequence corresponding to the training entity distribution position may include:

[0067] Step S211: determining a two-dimensional array of distribution correlation according to the association parameter, the position dispersion and the feature dispersion;

[0068] Step S212: normalizing the multidimensional feature vector according to the correlation two-dimensional array and the distribution position of the training entities;

[0069] Step S213: establishing a multi-component probability model based on the normalized result of the multi-dimensional feature vector, and obtaining a basic entity probability distribution sequence corresponding to the distribution position of the training entity.

[0070] In step S211, the computer system needs to determine the correlation two-dimensional array (e.g., a covariance matrix) of the distribution based on the correlation parameters, position dispersion, and feature dispersion. The correlation parameters here contain key information in the training entity distribution features, such as the first correlation parameter and the second correlation parameter mentioned above. The first correlation parameter involves the correlation between the feature dimensions of any word token in the basic entity probability distribution sequence, and the second correlation parameter involves the correlation between adjacent position features.

[0071] A word token is a basic semantic unit after the network threat intelligence training text is processed. Take the network threat intelligence text "attackers use malware to attack the target server through port 8080" as an example, where "attackers", "malware", "port 8080", "target server", etc. can all be regarded as word tokens. Each word token has its own feature dimension. For example, for the word token "malware", its feature dimension may include software type (such as virus, Trojan, etc.), propagation method (such as email propagation, network download, etc.), etc.

[0072] Position dispersion reflects the dispersion of the character indexes of all word meta-tokens in the probability distribution sequence of the underlying entity. In the above example, if the position (character index) of the word meta-token "malware" in different cyber threat intelligence training texts varies greatly, some at the beginning of the text, some in the middle, and some at the end, then its position dispersion is large; on the contrary, if it appears near a fixed position in the text in most cases, the position dispersion is small.

[0073] Feature dispersion is the degree of dispersion of the feature dimensions of all word-meta tokens in the probability distribution sequence of the underlying entity. Taking "malware" as an example, if different malware have great differences in their feature dimensions (such as software type, propagation method, etc.), then the feature dispersion is high; if most malware have similar software types and propagation methods, the feature dispersion is low.

[0074] The process of determining the two-dimensional array of correlation (using the covariance matrix as an example) is a complex but orderly process. For a situation with n word tokens, each word token has m feature dimensions, the computer system needs to construct an m×m covariance matrix. The element C_{ij} in the covariance matrix represents the covariance between the i-th feature dimension and the j-th feature dimension. The formula for calculating covariance is , where X and Y are two variables (which can be different feature dimensions here), and are the values ​​of these two variables in the kth sample (word meta-token), and is the mean of these two variables.

[0075] Take the characteristic dimensions of malware and attack targets in cyber threat intelligence as an example. Assume that one characteristic dimension X of malware is its propagation speed (quantized into different values), and one characteristic dimension Y of attack targets is the security level of the target server (also quantified into different values). For a set of n samples (combinations of word meta-tokens) in a set of cyber threat intelligence training texts, the computer system calculates the malware propagation speed in each sample. and target server security level The value of , and then calculate Cov(X,Y) according to the above formula, this value will be used as an element in the covariance matrix. By performing such calculations on all feature dimension combinations, the computer system constructs a complete covariance matrix. This covariance matrix, as a two-dimensional correlation array, can accurately describe the correlation relationship between each feature dimension. This correlation relationship is an important basis for the subsequent establishment of a multi-component probability model. It reflects the inherent connection between different feature dimensions and helps the computer system to understand the entity relationship in the network threat intelligence training text more comprehensively and accurately.

[0076] In step S212, the computer system normalizes the multidimensional feature vector according to the correlation two-dimensional array and the distribution position of the training entity. The multidimensional feature vector is composed of the character index and feature dimension of any word meta-token in the probability distribution sequence of the basic entity. For example, for the word meta-token "malware" mentioned above, assuming that its character index is i, its feature dimension includes software type, propagation method, etc., and combining this information constitutes a multidimensional feature vector.

[0077] The correlation two-dimensional array (such as the covariance matrix) has been determined in step S211, which describes the correlation relationship between each feature dimension. The training entity distribution position is the location information of the threat intelligence entity in the network threat intelligence training text. In the previous example, if "malware" is at a specific position in a specific network threat intelligence training text, this position is the training entity distribution position.

[0078] Normalization is an operation that maps data to a specific interval (usually [0,1] or [-1,1]). The computer system adjusts the multidimensional feature vector of each word token based on the information in the previously determined covariance matrix (a two-dimensional array of correlations). Specifically, suppose the multidimensional feature vector of a word token is ), the computer system calculates a set of normalization factors based on the elements in the covariance matrix and the distribution positions of the training entities, and performs the following operations on each element in the vector: ,in is the mean of the i-th element determined by the covariance matrix and the distribution position of the training entities, is the standard deviation.

[0079] Let’s take a simple example to illustrate. Suppose there is a word token about the attack source in network threat intelligence, and its multi-dimensional feature vector is represented as V=( ),in Indicates a feature of the IP address of the attack source (such as the address segment type). A quantitative value representing the frequency of network activity of the attack source, A quantitative value that represents other factors related to the attack source. The computer system calculates the The mean and standard deviation , The mean and standard deviation \sigma_2, The mean and standard deviation Then normalize the vector V to get Through the normalization operation, the feature vectors of different word-element tokens are represented at the same scale, which helps to eliminate the differences between different feature dimensions caused by factors such as dimensions, so that each feature dimension can be treated more fairly when a multi-component probability model is subsequently established, thereby improving the accuracy and stability of the model.

[0080] In step S213, the computer system establishes a multi-component probability model based on the normalized result of the multi-dimensional feature vector to obtain a basic entity probability distribution sequence corresponding to the training entity distribution position. The normalized multi-dimensional feature vector contains the character index and feature dimension information of the adjusted word element token, which has been processed into a comparable form at the same scale in the previous step.

[0081] The multi-component probability model is a probability model that can comprehensively consider multiple factors (such as the character index of the word-element token, feature dimension, relevance, etc.). When building this model, the computer system takes the normalized multi-dimensional feature vector as input and obtains the basic entity probability distribution sequence through a series of mathematical operations (which may involve matrix multiplication, exponential function, etc.).

[0082] For example, suppose the normalized multidimensional feature vector is , the computer system follows a predefined model structure (which may be based on a neural network architecture or a statistical model), such as ,in is the i-th probability value in the probability distribution sequence of the underlying entity, and f is a function defined by the model, which may contain Linear transformation, nonlinear activation (such as using sigmoid function or ReLU function) and other operations.

[0083] Take a simple hypothetical model as an example, assuming f(x)= (sigmoid function), if =2, then P_i= By performing such calculations for all i, the computer system obtains the probability distribution sequence of the entire basic entity This basic entity probability distribution sequence reflects the probability distribution of each word-element token at the training entity distribution position, and is an important basis for further constructing the predicted entity probability distribution sequence in subsequent steps (such as step S220, etc.). It plays a connecting role in the entire security protection method based on network threat intelligence analysis, and helps the computer system to more accurately identify entities in network threat intelligence, thereby providing a more effective decision-making basis for network security protection.

[0084] As an implementation manner, step S400, determining a network debugging error of a threat entity identification network according to a predicted entity probability distribution sequence and a priori entity probability distribution sequence, may include:

[0085] Step S410: determining a first error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence according to a negative log-likelihood error function, and determining a second error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence according to a cross entropy error function;

[0086] Step S420: Determine a network debugging error of the threat entity identification network according to the sum of the first error value and the second error value.

[0087] In step S410, the computer system determines the first error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence according to the negative log-likelihood error function. The predicted entity probability distribution sequence is generated by the computer system in the previous step (such as step S200) based on the training entity distribution position and training entity distribution characteristics, which reflects the prediction result of the entity distribution in the network threat intelligence training text based on the current threat entity identification network. The prior entity probability distribution sequence is obtained in step S300, which is a debugging reference mark of the threat entity identification network, reflecting the probability distribution of entities under known conditions or prior knowledge.

[0088] Assume that the predicted entity probability distribution sequence is , the prior entity probability distribution sequence is The negative log-likelihood error function is For example, in network threat intelligence analysis, if the type of network attack source is considered as an entity, the probability distribution sequence of the predicted entity represents the probability of predicting the first attack source type, represents the probability of predicting the second attack source type, and so on. represents the probability of the first attack source type based on prior knowledge, represents the probability of the second attack source type, etc. By substituting these values ​​into the negative log-likelihood error function formula, the computer system calculates the first error value L. This first error value measures the degree of difference between the predicted entity probability distribution and the prior entity probability distribution in the sense of log-likelihood. If the predicted entity probability distribution is closer to the prior entity probability distribution, the value of L will be smaller; conversely, if the difference between the two is large, the value of L will be larger.

[0089] Next, the computer system determines a second error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence according to the cross entropy error function. The cross entropy error function formula is: . Continuing with the above-mentioned network attack source type as an example, the computer system substitutes the corresponding probability values ​​in the predicted entity probability distribution sequence P and the prior entity probability distribution sequence Q into the formula to calculate the second error value H. The cross entropy error function is of great significance in information theory, and it can be used to measure the difference between two probability distributions. Similar to the negative log-likelihood error function, when the predicted entity probability distribution is close to the prior entity probability distribution, the value of H is small; when the difference between the two is large, the value of H is large.

[0090] In step S420, the computer system determines the network debugging error of the threat entity identification network according to the sum of the first error value and the second error value. That is, the network debugging error E=L + H. This network debugging error combines the difference between the predicted entity probability distribution sequence and the prior entity probability distribution sequence measured by the negative log-likelihood error function and the cross entropy error function.

[0091] For example, suppose that in a network threat intelligence scenario, for a specific network threat entity (such as the propagation method of a certain malware), the predicted entity probability distribution sequence P=(0.3, 0.4, 0.3) and the prior entity probability distribution sequence Q=(0.5, 0.3, 0.2) are used. First, the first error value L is calculated based on the negative log-likelihood error function: . After calculation, the specific value of L can be obtained. Then, the second error value H is calculated according to the cross entropy error function: Calculate the value of H.

[0092] Finally, L and H are added to obtain the network debugging error E. This network debugging error reflects the overall deviation between the predicted entity probability distribution and the prior entity probability distribution. The computer system can evaluate the performance of the threat entity identification network based on this network debugging error and debug the network to reduce this error, so that the threat entity identification network can more accurately predict the entity distribution in the network threat intelligence, thereby improving the effectiveness of the entire security protection method based on network threat intelligence analysis.

[0093] As an implementation manner, step S420, determining a network debugging error of the threat entity identification network according to the sum of the first error value and the second error value, may include:

[0094] Step S421: obtaining an adjustment factor for adjusting the steepness of the parameter change rate, and performing a softening process on the first error value according to the adjustment factor to obtain a third error value;

[0095] Step S422: Determine a network debugging error of the threat entity identification network according to the sum of the third error value and the second error value.

[0096] In step S421, the computer system needs to obtain an adjustment factor for adjusting the steepness of the parameter change rate, and soften the first error value according to the adjustment factor to obtain a third error value. The adjustment factor here is a value that is preset or dynamically determined according to a specific algorithm, and its function is to adjust the influence of the first error value in the final network debugging error calculation. The steepness of the parameter change rate reflects the sensitivity of the network debugging error to the parameter adjustment in the threat entity identification network. For example, if the steepness of the parameter change rate is large, it means that a small change in the parameters in the network may cause a large change in the network debugging error; conversely, if the steepness is small, the change in the parameters has a relatively small impact on the network debugging error.

[0097] The first error value is the error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence determined by the computer system in step S410 according to the negative log-likelihood error function. This error value reflects the degree of difference between the prediction result and the prior knowledge in the sense of negative log-likelihood.

[0098] Assuming that the first error value is L and the adjustment factor is α (0<α≤1), one possible way for the computer system to soften the first error value is to multiply the first error value by the adjustment factor to obtain the third error value L', that is, L'=α×L. For example, in network threat intelligence analysis, if the first error value L=0.5 (this value indicates that the predicted entity probability distribution sequence and the prior entity probability distribution sequence have a large difference in the negative log-likelihood sense), the adjustment factor α=0.5, then the third error value L'=0.5×0.5=0.25. Through this softening process, the computer system reduces the weight of the first error value in the subsequent network debugging error calculation, making the calculation of the network debugging error more flexible and able to adjust the influence of different error values ​​according to actual conditions. This processing method is of great significance in practical applications, because in some cases, the error measured by the negative log-likelihood error function may be too sensitive or inaccurate due to the characteristics of the data or the initial state of the model. Softening through the adjustment factor can improve the stability and accuracy of network debugging.

[0099] In step S422, the computer system determines the network debugging error of the threat entity identification network based on the sum of the third error value and the second error value. The second error value is the error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence determined by the computer system in step S410 according to the cross entropy error function. This error value measures the degree of difference between the prediction result and the prior knowledge from the perspective of cross entropy.

[0100] Assume the third error value is L', the second error value is H, and the network debugging error is E, then E = L' + H. For example, continuing the above example, assuming the second error value H = 0.3, the third error value L' = 0.25, then the network debugging error E = 0.25 + 0.3 = 0.55. This network debugging error combines the negative log-likelihood error (represented by the third error value) and the cross entropy error (second error value) after processing by the adjustment factor, which reflects the overall deviation between the predicted entity probability distribution and the prior entity probability distribution.

[0101] In the scenario of network threat intelligence analysis, this network debugging error is of key significance for the optimization of the threat entity identification network. For example, assuming that network threat intelligence involves the identification of network attack sources, the predicted entity probability distribution sequence represents the probability distribution of different attack sources predicted by the current threat entity identification network, and the prior entity probability distribution sequence is the probability distribution of attack sources obtained based on a large amount of existing network attack data or expert knowledge. If the network debugging error is large, it means that the current threat entity identification network has a large deviation from the prior knowledge or actual situation in identifying the attack source, and the computer system needs to adjust the threat entity identification network according to this network debugging error. This adjustment may involve various parameters in the network, such as weights and biases in the neural network. By continuously adjusting the threat entity identification network according to the network debugging error, the computer system can improve the accuracy and reliability of the network in identifying network threat intelligence entities, thereby better realizing the security protection function based on network threat intelligence analysis.

[0102] The operation of the computer system in steps S421-S422 is a process of comprehensively considering different error factors and making reasonable adjustments. By obtaining the adjustment factor to soften the first error value, and then combining the second error value to determine the network debugging error, the computer system can more accurately evaluate the deviation between the threat entity identification network and the prior knowledge, and then effectively debug and optimize the network, which plays an indispensable role in improving the performance of the entire security protection system based on network threat intelligence analysis.

[0103] As an implementation mode, in step S100, characterization information is extracted from the network threat intelligence training text according to the threat entity identification network, and the training entity distribution positions of the threat intelligence entities contained in the network threat intelligence training text and the training entity distribution features corresponding to the training entity distribution positions are obtained, which may include:

[0104] Step S110: Loading network threat intelligence training text into the threat entity identification network;

[0105] Step S120: performing representation information mining on the network threat intelligence training text to obtain text representation information of the network threat intelligence training text;

[0106] Step S130: performing feature conversion on the text representation information to obtain conversion representation information;

[0107] Step S140: performing full connection mapping on the converted representation information to obtain predicted representation information;

[0108] Step S150: obtaining the training entity distribution positions of the threat intelligence entities contained in the network threat intelligence training text and the training entity distribution features corresponding to the training entity distribution positions based on the predicted representation information.

[0109] In step S110, the operation performed by the computer system is to load the network threat intelligence training text into the threat entity identification network. The network threat intelligence training text is text data containing information related to network threats, which may cover various elements of network attacks, such as attack sources, attack targets, attack methods, etc. For example, a network threat intelligence training text may be as follows: "On May 10, 2023, malware from IP address 192.168.1.100 launched a SQL injection attack on the company server through port 8080." This text contains potential threat intelligence entity information such as the attack source (IP address 192.168.1.100 and malware), attack target (company server), and attack method (SQL injection attack).

[0110] A threat entity identification network is a specially constructed network structure designed to identify various entities in cyber threat intelligence. It may be built on a neural network architecture, such as a convolutional neural network (CNN), a recurrent neural network (RNN), or their variants, such as a long short-term memory network (LSTM) or a gated recurrent unit (GRU). The computer system loads the cyber threat intelligence training text into this network for subsequent operations such as feature extraction. The computer system formats the text so that it can be accepted by the threat entity identification network. This may involve converting the text into a specific encoding format, such as UTF-8 encoding, and organizing it according to the network's input requirements. For example, if the input requirement of the threat entity identification network is a fixed-length vector sequence, the computer system may need to truncate or pad the text to meet this requirement.

[0111] In step S120, the computer system performs representation information mining, that is, feature extraction, on the network threat intelligence training text that has been loaded into the threat entity identification network. This process aims to extract information that can represent text features from the original text data. For each word element in the network threat intelligence training text (a word element can be a word or a specific character combination, for example, in the above example, "May 10, 2023", "IP address", "malware", etc. can all be regarded as a word element), the computer system will calculate its related features.

[0112] One feasible technical means is to use a word vector model. For example, the Word2Vec model can map each word to a vector space of fixed dimension. Assuming a 300-dimensional Word2Vec model is used, the word "malware" will be represented as a 300-dimensional vector. This vector contains the semantic information of the word, such as the distance relationship with other similar words (such as "virus", "Trojan", etc.) in the semantic space. In addition to the word vector model, computer systems may also use other technical means, such as part-of-speech tagging. For each word in the network threat intelligence training text, determining its part of speech (noun, verb, adjective, etc.) is also a feature extraction method. For example, the part of speech of the word "attack" is a verb, and this information is helpful for understanding the semantic structure of the text and the relationship between threat intelligence entities.

[0113] Through these feature extraction operations, the computer system obtains the text representation information of the network threat intelligence training text. This text representation information is an abstract representation of the original text, which contains the semantics, part of speech and other feature information of the words in the original text. For example, for the network threat intelligence training text mentioned above, its text representation information may be a matrix or sequence structure composed of feature vectors of each word (such as word vector and part of speech tagging information).

[0114] In step S130, the computer system performs feature conversion on the text representation information obtained in step S120. The fully connected layer is a feasible neural network layer structure and plays an important role in feature conversion. Assume that the text representation information is a matrix X with a dimension of m×n (m represents the number of words, and n represents the feature dimension of each word). Each neuron in the fully connected layer is connected to all neurons in the previous layer. The dimension of the weight matrix W of the fully connected layer is n×p (p is the feature dimension of the output of the fully connected layer). Through matrix multiplication Y=X×W + b (where b is the bias vector), the computer system can convert the input text representation information X into a new feature representation Y, which is part of the converted representation information.

[0115] The attention mechanism is also an effective technical means for feature transformation. In the network threat intelligence training text, different words have different importance for identifying threat intelligence entities. For example, in the text "On May 10, 2023, malware from IP address 192.168.1.100 launched a SQL injection attack on the company server through port 8080.", "malware", "IP address 192.168.1.100", "company server" and other words are more critical for identifying threat intelligence entities. The attention mechanism can automatically assign weights based on the relationship between these words and other words. Let Q, K, and V be the query vector, key vector, and value vector, respectively (they can be obtained from the text representation information through linear transformation), and the attention weights (where d_k is the dimension of the key vector), and then Output=AV is used to obtain the feature representation processed by the attention mechanism, which will also be integrated into the transformation representation information.

[0116] Dimensionality reduction techniques can also be used for feature transformation. For example, principal component analysis (PCA) may lead to problems such as increased computational complexity and overfitting if the dimension of the text representation information is too high. PCA projects high-dimensional data into a low-dimensional space by finding the direction of the principal components in the data. Suppose the covariance matrix of the original text representation information is , calculate its eigenvalue and the eigenvector , select the eigenvectors corresponding to the first k largest eigenvalues ​​to form the projection matrix P, and then convert the text representation information X into a low-dimensional Z through Z=XP, which is also part of the transformed representation information. Through these different feature conversion technologies, the computer system comprehensively obtains the transformed representation information, which is more conducive to the subsequent identification of threat intelligence entities than the original text representation information.

[0117] In step S140, the computer system performs a fully connected mapping on the converted representation information obtained in step S130. The fully connected mapping is similar to the fully connected layer operation mentioned in step S130, but here it is to further convert the converted representation information into a form that is more suitable for predicting threat intelligence entities. Assuming that the converted representation information is Y, its dimension is m×n, and it passes through a fully connected layer again, its weight matrix W' has a dimension of n×q (q is the feature dimension output after the fully connected mapping), calculate Z=Y×W' + b' (where b' is the bias vector), and the obtained Z is the predicted representation information.

[0118] For example, in network threat intelligence analysis, if the transformed representation information contains information about network attack-related words after feature conversion, this fully connected mapping operation will further integrate and transform this information in order to more accurately predict relevant information about the threat intelligence entity, such as the entity category (whether it is an attack source, attack target, or attack method, etc.) and the specific attributes of the entity (such as the IP address range of the attack source, etc.).

[0119] In step S150, the computer system obtains the training entity distribution position and corresponding training entity distribution characteristics of the threat intelligence entity contained in the network threat intelligence training text based on the predicted representation information obtained in step S140. For the training entity distribution position, the computer system determines the position of the threat intelligence entity in the network threat intelligence training text based on some specific tags or feature values ​​in the predicted representation information. For example, in the predicted representation information, if a certain feature value has a strong correlation with a specific threat intelligence entity (such as "malware"), the computer system can trace back the source of this feature value in the processing process to determine the position of the word "malware" in the original network threat intelligence training text. This position is the training entity distribution position.

[0120] Regarding the training entity distribution features, the computer system will extract other feature information related to the location of the threat intelligence entity from the predicted representation information. For example, if the predicted representation information contains a semantic feature vector related to the threat intelligence entity "malware" (which may be obtained through the word vector model, feature conversion and other operations in the previous steps), the various dimension values ​​in this semantic feature vector can be used as part of the training entity distribution features. In addition, the predicted representation information may also contain relational features of other word units related to "malware", such as the degree of association with the word unit "attack", etc. These relational features will also be regarded as training entity distribution features. These training entity distribution features can further describe the characteristics of the threat intelligence entity at its distribution position, and provide the necessary data basis for operations such as generating a predicted entity probability distribution sequence in subsequent steps (such as step S200, etc.).

[0121] As an implementation mode, the threat entity identification network performs full connection mapping on the conversion representation information according to two decision components respectively. Based on this, step S150 obtains the training entity distribution position of the threat intelligence entity contained in the network threat intelligence training text according to the predicted representation information, and the training entity distribution features corresponding to the training entity distribution position, which may include:

[0122] Step S151: obtaining the training entity distribution position of the threat intelligence entity contained in the network threat intelligence training text according to the prediction representation information output by one of the decision components;

[0123] Step S152: obtaining training entity distribution features corresponding to training entity distribution positions based on the prediction representation information output by another decision component.

[0124] In step S151, the computer system uses the predicted representation information output by a decision component in the threat entity identification network to determine the distribution location of the training entity of the threat intelligence entity. First, it is necessary to clarify that the predicted representation information is obtained by the computer system in the previous step (such as step S140) by fully connecting the transformed representation information. This predicted representation information contains comprehensive information about various potential threat intelligence entities in the network threat intelligence training text.

[0125] The decision component is part of the threat entity identification network. Its role is to make decisions based on the input information (here, the predicted representation information) to identify relevant information about the threat intelligence entity. For example, the decision component may be a neural network-based classifier that can determine which parts may be threat intelligence entities based on the features in the predicted representation information.

[0126] Taking the network threat intelligence training text "On May 10, 2023, malware from IP address 192.168.1.100 launched a SQL injection attack on the company's server through port 8080" as an example, the prediction representation information output by the decision component may contain feature vectors related to each word (such as "May 10, 2023", "IP address", "malware", etc.). For the distribution position of the training entity of the identification threat intelligence entity, the computer system will look for the identifier related to the specific entity in this prediction representation information. Assume that in the prediction representation information output by the decision component, the feature vector corresponding to the word "IP address" has a specific index or encoding pattern in the entire vector sequence. The computer system can trace back to the original network threat intelligence training text based on this index or encoding pattern to determine the position of "IP address 192.168.1.100" in the text, which is the training entity distribution position of the threat intelligence entity "IP address".

[0127] One possible technical means is to establish an index mapping mechanism. When processing the network threat intelligence training text, the computer system establishes corresponding indexes for each word at different processing stages (such as word vector generation, feature conversion, etc.). When the decision component outputs the predicted representation information, the feature vector related to the threat intelligence entity also carries the corresponding index information. The computer system can find the location of the entity in the original text based on this index information by searching the pre-established index mapping table. For example, if the index of the feature vector corresponding to "malware" in the predicted representation information is i, the computer system searches the index mapping table for the position in the original text corresponding to index i, thereby determining the training entity distribution position of the threat intelligence entity "malware".

[0128] In step S152, the computer system obtains the training entity distribution features corresponding to the training entity distribution positions based on the prediction representation information output by another decision component in the threat entity identification network. The other decision component here is different in function from the decision component in step S151, and it is mainly responsible for extracting feature information related to the determined training entity distribution positions.

[0129] Continuing with the above-mentioned network threat intelligence training text as an example, after the training entity distribution position of the threat intelligence entity "malware" is determined in step S151, the computer system needs to obtain the training entity distribution features of this entity at this position. The prediction representation information output by another decision component may contain more detailed information about the entity features. For example, in the prediction representation information output by this decision component, the part corresponding to "malware" may include its semantic features, association features with other word units, etc.

[0130] In terms of semantic features, assuming that a word vector model is used to represent the semantic information of a word, for the word "malware", the values ​​of each dimension in its word vector constitute part of the semantic features. For example, if the word vector is a 300-dimensional vector, each dimension may represent different semantic attributes (such as similarity to a specific type of malware, functional attributes of malware, etc.). These semantic features are part of the training entity distribution features.

[0131] In terms of correlation features, the prediction representation information output by the decision component may contain information about the degree of correlation between "malware" and other terms (such as "attack", "server", etc.). One possible representation method is to calculate the correlation coefficient between them. is the feature vector corresponding to “malware”, is the feature vector corresponding to "attack", and the correlation coefficient r between them can be expressed by the formula This correlation coefficient reflects the association characteristics between "malware" and "attack" and is also part of the distribution characteristics of the training entity.

[0132] The computer system obtains the training entity distribution features corresponding to the training entity distribution positions by analyzing the semantic features, association features and other information in the prediction representation information output by another decision component. These training entity distribution features can more comprehensively describe the characteristics of the threat intelligence entity at its distribution position, and provide the necessary data basis for operations such as generating a prediction entity probability distribution sequence based on the training entity distribution features in subsequent steps (such as step S200), which helps to improve the accuracy and effectiveness of the entire security protection method based on network threat intelligence analysis.

[0133] As another implementation, in step S100, characterization information is extracted from the network threat intelligence training text according to the threat entity identification network, and the training entity distribution positions of the threat intelligence entities contained in the network threat intelligence training text and the training entity distribution features corresponding to the training entity distribution positions are obtained, which may include:

[0134] Step S100A: mining text representation information of network threat intelligence training text;

[0135] Step S100B: restoring and mapping the text representation information based on the predetermined entity representation information set by the representation information restoration mapping component to obtain a restored mapping representation information set; wherein the restored mapping representation information in the restored mapping representation information set corresponds to the entity representation information in the predetermined entity representation information set;

[0136] Step S100C: based on the restored mapping representation information set, inferring to obtain a plurality of inference results;

[0137] Step S100D: multiple inference results correspond to the restored mapping representation information in the restored mapping representation information set; each inference result includes a training entity distribution position, a training entity distribution feature corresponding to the distribution position, and a correlation between an entity in a position corresponding to the distribution position and multiple entities in a position corresponding to the distribution position in the multiple inference results;

[0138] Step S100E: Based on the correlation and the training entity distribution characteristics, determine the training entity distribution positions of entities in the corresponding positions, and merge the training entity distribution positions of entities with correlation in multiple entities to obtain the training entity recognition results.

[0139] In step S100A, the computer system first mines the text representation information of the network threat intelligence training text. The network threat intelligence training text is text data containing information related to network threats, such as "In recent network monitoring, suspicious traffic from IP address 10.0.0.1 was found, which is suspected to be related to malware infection and the target is the server group of the company's internal network." Such text contains potential threat intelligence entity information such as the attack source (IP address 10.0.0.1), the possible result of the attack (malware infection) and the attack target (the server group of the company's internal network).

[0140] Mining text representation information is a process of extracting meaningful features from raw text. Computer systems can use a variety of technical means to achieve this. One feasible method is the Bag-of-Words model. In this model, the computer system will regard the text as a collection of words, ignoring the word order and only focusing on the frequency of word occurrence. For example, for the above-mentioned network threat intelligence training text, after being processed by the Bag-of-Words model, a vector representation containing each word (such as "network", "monitoring", "IP address", "suspicious traffic", etc.) and its number of occurrences will be obtained. However, the Bag-of-Words model has limitations, and it does not consider word order and semantic relationships.

[0141] To overcome these limitations, computer systems can also use neural network-based methods, such as word vector models (such as Word2Vec). Word2Vec is able to map each word to a low-dimensional vector space in which semantically similar words are closer. For example, the vectors of the words "malware" and "virus" in the vector space generated by Word2Vec will be relatively close. In this way, the computer system can mine richer semantic representation information for each word (word or specific character combination) in the network threat intelligence training text. In addition to word-level representations, computer systems may also mine sentence-level representation information. For example, a recurrent neural network (RNN) or its variants (such as a long short-term memory network LSTM or a gated recurrent unit GRU) is used to process the word sequence in a sentence to capture the semantic and grammatical structure information in the sentence, which is also part of the text representation information.

[0142] In step S100B, the computer system uses the representation information restoration mapping component to process the text representation information obtained in step S100A. The predetermined entity representation information set here is a predefined set that contains typical representation information of various entities related to network threat intelligence. For example, for the attack source entity in the network threat, the predetermined entity representation information set may include representation information of different types of IP addresses (such as public IP, private IP), representation information of common malware names, etc.; for the attack target entity, it may include representation information of various server types (such as Web servers, database servers), network services (such as HTTP services, FTP services), etc.

[0143] The computer system first obtains index representation information (i.e., KEY) and content representation information (i.e., VALUE) based on the text representation information. For example, when using a data structure based on a hash table to store text representation information, the index representation information can be an index value calculated by a hash function based on the words or word units in the text. This index value is used for fast positioning and retrieval. The content representation information is the detailed representation information of the word or word unit corresponding to this index value, which may include its word vector, part of speech, and other information.

[0144] Then, the computer system obtains entity representation information based on the predetermined entity representation information set. Assuming that the predetermined entity representation information set is stored in the form of a database, the computer system can obtain the representation information of various entities related to network threat intelligence through query operations. For example, querying entity representation information of the type "attack source-IP address" may obtain relevant representation information about different IP address ranges, the region to which the IP address belongs, etc.

[0145] Finally, the computer system inputs the entity representation information, index representation information and content representation information into the representation information restoration mapping component. The function of this component is to find the mapping relationship between the text representation information and the predetermined entity representation information set based on the input information, so as to obtain the restoration mapping representation information set. For example, if there is an IP address "10.0.0.1" in the network threat intelligence training text, it has corresponding index representation information and content representation information in the text representation information. The representation information restoration mapping component will map the representation information of the IP address "10.0.0.1" in the text to the relevant representation information in the predetermined entity representation information set based on the entity representation information about the IP address in the predetermined entity representation information set, and obtain more comprehensive and standardized restoration mapping representation information about this IP address in terms of network threat intelligence entities. These restoration mapping representation information constitute the restoration mapping representation information set.

[0146] In step S100C, the computer system performs reasoning based on the restored mapping representation information set obtained in step S100B. Each restored mapping representation information in the restored mapping representation information set contains detailed information about the network threat intelligence entity, which provides a basis for reasoning.

[0147] The computer system can use a rule-based reasoning method. For example, in network threat intelligence, if there is a rule: "If the IP address of the attack source belongs to a certain private IP address range and the target is a specific type of server, then there may be a risk of internal network attack." The computer system will look for the restoration mapping representation information about the attack source IP address and the attack target server in the restoration mapping representation information set, and then make inferences based on this rule. If it is found in the restoration mapping representation information set that the IP address "10.0.0.1" of the attack source belongs to a certain private IP address range, and the attack target is the company's internal database server, then the computer system can draw the inference result that there is a risk of internal network attack.

[0148] In addition to rule-based reasoning, computer systems can also use probability-based reasoning methods. For example, suppose it is known that in certain network environments, the probability of a specific type of malware (identified by malware restoration mapping representation information in the restoration mapping representation information set) attacking a specific type of server (also identified by restoration mapping representation information) is p. The computer system can calculate the possibility of such an attack occurring in the scenario described by the current network threat intelligence training text based on this probability and the relevant information in the restoration mapping representation information set, thereby obtaining the corresponding reasoning results. Through these different reasoning methods, the computer system can obtain multiple reasoning results, which reflect the analysis of potential threats in the network threat intelligence training text from different perspectives.

[0149] In step S100D, the multiple inference results obtained by the computer system and the restored mapping representation information in the restored mapping representation information set are in a corresponding relationship with each other. For each inference result, it contains important information.

[0150] The training entity distribution location refers to the location information of the threat intelligence entity in the network threat intelligence training text. For example, in the network threat intelligence training text mentioned above, "In recent network monitoring, suspicious traffic from IP address 10.0.0.1 was found, which is suspected to be related to malware infection and targets the server group of the company's internal network." If the IP address "10.0.0.1" is a threat intelligence entity in the inference result, then its position in the text (such as the starting word and the ending word) is the training entity distribution location.

[0151] The training entity distribution features corresponding to the distribution position describe some characteristics of this entity at that position. Continuing with "10.0.0.1" as an example, its training entity distribution features may include information such as the type of this IP address (private IP), its role in the network (possibly an attack source), etc. These features can be obtained from the restored mapping representation information corresponding to this IP address in the restored mapping representation information set, or they can be obtained through other related technical means. For example, if a computer system learns information such as the network operator to which "10.0.0.1" belongs by querying an external IP address database, this can also be used as part of the training entity distribution features.

[0152] The correlation between the entity in the position corresponding to the distribution position and the multiple entities in the position corresponding to the distribution position in the multiple inference results reflects the relationship between different entities. For example, in the above network threat intelligence training text, if there are two inference results, one is about "10.0.0.1" (attack source) and the other is about "server group of the company's internal network" (attack target), then there is an attack and attacked relationship between the two entities, and this relationship can be quantified by calculating the correlation between them. One possible way to calculate the correlation is to use information gain. Let S be the information entropy of the entire network threat intelligence training text, S_1 is the information entropy of the text when the entity "10.0.0.1" is known, and S_2 is the information entropy of the text when the entity "server group of the company's internal network" is known, then the correlation (information gain) between the two entities IG=S-S_1-S_2. In this way, each inference result contains comprehensive information such as the location, characteristics, and correlation with other entities of the entity.

[0153] In step S100E, the computer system determines the final training entity distribution position and training entity recognition result based on the correlation and training entity distribution characteristics obtained in step S100D. First, the computer system will screen and determine the truly meaningful training entity distribution position based on the correlation. For example, if in multiple reasoning results, the training entity distribution position of an entity is mentioned many times, but the correlation with other entities is very low (based on the correlation indicators calculated previously, such as information gain), then the computer system may believe that the entity at this position is unlikely to be a true threat intelligence entity, thereby excluding this position or reducing the weight of this position.

[0154] Then, the training entity distribution locations of entities that are related among multiple entities are merged. For example, in the network threat intelligence training text, there may be multiple places where information related to a certain malware is mentioned, such as the name of the malware when describing the attack source, and the way the malware is spread when describing the attack process. The information about the malware in these different locations is related, and the computer system will merge the training entity distribution locations related to the malware to form a more complete description of the training entity distribution location of the malware.

[0155] Through this processing based on correlation and training entity distribution characteristics, the computer system obtains a training entity recognition result. This result includes the training entity distribution position and corresponding training entity distribution characteristics of the threat intelligence entity after screening and merging, providing the necessary data basis for subsequent steps (such as step S200, etc.), and helping to improve the accuracy and effectiveness of the entire security protection method based on network threat intelligence analysis.

[0156] Through the operation of steps S100A-S100E, the computer system obtains the training entity distribution position and training entity distribution characteristics of the threat intelligence entity from the network threat intelligence training text in a method different from the traditional method. This method comprehensively considers various information in the text and the relationship between entities, and provides more comprehensive and accurate data support for the security protection system based on network threat intelligence analysis.

[0157] As an implementation manner, step S100B, performing restoration mapping on the text representation information based on a predetermined entity representation information set by a representation information restoration mapping component to obtain a restoration mapping representation information set, may include:

[0158] Step S100B1: obtaining index representation information and content representation information based on text representation information;

[0159] Step S100B2: obtaining entity representation information based on a predetermined entity representation information set;

[0160] Step S100B3: input the entity representation information, the index representation information and the content representation information into the representation information restoration mapping component to obtain a restoration mapping representation information set output by the representation information restoration mapping component.

[0161] In step S100B1, the computer system first obtains index representation information and content representation information based on the text representation information of the network threat intelligence training text that has been mined. The text representation information is information extracted from the original network threat intelligence training text by various technical means in the previous step (such as step S100A), and it contains multiple feature representations of word units (words or specific character combinations) in the text.

[0162] A common technical means for a computer system to obtain index representation information is through a hash function. For example, for each word in the text representation information, the computer system can convert it into a specific hash value as the index representation information. Suppose there is a simple hash function h(x). For word x, the calculated h(x) is its index representation information. Taking the network threat intelligence training text "Malware from IP address 192.168.1.1 attacks the target server" as an example, for the word "IP address", a specific hash value is calculated by the hash function, and this hash value is used as the index representation information of the word "IP address". The advantage of the hash function is that it can quickly map data to an index space of a fixed size, which is convenient for fast search and storage.

[0163] In terms of obtaining content representation information, the computer system will build it based on various features related to the word in the text representation information. Continuing with the above example, the content representation information of the word "IP address" may include its part of speech (noun), the vector representation in the word vector model (if a word vector model such as Word2Vec is used, this vector may represent the relationship between "IP address" and other related words in the semantic space), and the grammatical role in the sentence (here it may be part of the attack source). This content representation information comprehensively describes the characteristics of the word "IP address" in the network threat intelligence training text.

[0164] The computer system can also obtain index representation information and content representation information through other technical means. For example, when processing text representation information, if a tree structure (such as a syntax tree) is used to represent the sentence structure, the index representation information can be generated based on the position of the word in the tree structure, and the content representation information can include information such as the parent-child node relationship and sibling node relationship of the word in the tree structure. This relationship information helps to more deeply understand the semantic and grammatical role of the word in the sentence.

[0165] In addition, it is worth mentioning the application of position embedding technology in obtaining index representation information and content representation information. When processing network threat intelligence training text, the position of the word in the text is also an important information. For example, for the word "malware", if it is located earlier in the text, it may be more closely related to the attack source described at the beginning of the text; if it is located later, it may be related to the attack results or subsequent processing. Computer systems can encode the position information of word elements into a vector through position embedding technology. This vector can be used as part of the content representation information, and index representation information can also be generated based on this vector. For example, the position embedding function p(i) can generate a specific vector based on the position i of the word element in the text. This vector can be used as content representation information, and can also be further processed (such as combined with the hash value of the word element itself) to become index representation information.

[0166] In step S100B2, the computer system acquires entity representation information based on a predetermined entity representation information set. The predetermined entity representation information set is a predefined set of typical representation information of various entities related to network threat intelligence. This set is carefully constructed to provide standard reference information for identifying entities in network threat intelligence.

[0167] For example, for the attack source entity in the network threat, the predetermined entity characterization information set may include detailed characterization information of different types of IP addresses (such as public IP, private IP). For public IP addresses, the entity characterization information may include information such as its address range (such as a specific IP segment), the network organization to which it belongs (such as an Internet service provider), and its common uses in network security (such as the IP address of a server used to provide services to the outside world). For private IP addresses, the entity characterization information may include information such as its role in the local network (such as the IP address of the internal office network) and its relationship with network boundary devices (such as routers).

[0168] For the target entity, the predetermined entity representation information set may include the representation information of various server types (such as Web servers, database servers), network services (such as HTTP services, FTP services), etc. Taking a Web server as an example, its entity representation information may include the type of operating system it runs (such as Linux, Windows), the Web server software used (such as Apache, IIS), and feasible security configurations (such as whether to enable firewalls, access control lists, etc.). For network services, such as HTTP services, the entity representation information may include its protocol version (such as HTTP / 1.1, HTTP / 2), supported request methods (such as GET, POST), etc.

[0169] The computer system can obtain entity representation information from a predetermined entity representation information set through a query operation. If the predetermined entity representation information set is stored in the form of a database, the computer system can use an SQL query statement to obtain the required entity representation information. For example, if you want to obtain attack source entity representation information about a specific IP address range, the computer system can execute an SQL query statement similar to "SELECT * FROM attack_source WHERE ip_range='specific IP range'", where "attack_source" is the name of the table that stores the attack source entity representation information, and "ip_range" is a field in the table that is used to store IP address range information. Through this query operation, the computer system can accurately obtain the representation information of various entities related to network threat intelligence, providing the necessary basis for subsequent restoration mapping operations.

[0170] In step S100B3, the computer system inputs the entity representation information, index representation information and content representation information obtained in the previous steps into the representation information restoration mapping component. The function of this component is to establish a mapping relationship between the text representation information and the predetermined entity representation information set, thereby obtaining a restoration mapping representation information set.

[0171] The representation information restoration mapping component can use a variety of technical means to achieve this mapping relationship. One possible way is rule-based matching. For example, for the "IP address 192.168.1.1" in the network threat intelligence training text, its index representation information (hash value), content representation information (part of speech, word vector, etc.) and the entity representation information about the IP address obtained from the predetermined entity representation information set (such as IP address range, network, etc.) are input into the representation information restoration mapping component. If there is a rule: "If the IP address belongs to the range of 192.168.0.0-192.168.255.255, and the part of speech is a noun, and there is a specific distance relationship with other network-related words in the word vector space, then it is mapped to the restoration mapping representation information of the private IP address type in the local network", then according to this rule, the representation information restoration mapping component will map the text representation information of "IP address 192.168.1.1" to the corresponding restoration mapping representation information.

[0172] Another possible technical approach is mapping based on machine learning models. For example, a neural network model can be constructed, taking entity representation information, index representation information, and content representation information as input features, and outputting restored mapping representation information after multi-layer processing of the neural network. Assume that this neural network model has an input layer, a hidden layer, and an output layer. The input layer receives the vector representation of entity representation information, index representation information, and content representation information, and after nonlinear transformation of neurons in the hidden layer (such as using the ReLU function as an activation function), the output layer outputs the vector representation of the restored mapping representation information. This vector representation contains more comprehensive and accurate mapping information about the network threat intelligence entity in the predetermined entity representation information set, which constitutes the restored mapping representation information set.

[0173] In this way, the representation information restoration mapping component processes various input information, matches and maps the text representation information of the word in the network threat intelligence training text with the entity representation information in the predetermined entity representation information set, thereby obtaining a restoration mapping representation information set. Each restoration mapping representation information in this restoration mapping representation information set contains more comprehensive and accurate information about the network threat intelligence entity, providing an important data basis for the reasoning operation in subsequent steps (such as step S100C, etc.), and helping to improve the accuracy and effectiveness of the entire security protection method based on network threat intelligence analysis.

[0174] The computer system, through the operation of steps S100B1-S100B3, starts from the text representation information, combines the predetermined entity representation information set, and obtains the restored mapping representation information set through the representation information restoration mapping component. This process plays an important role in the security protection system based on network threat intelligence analysis.

[0175] As an implementation manner, step S100B1, obtaining index representation information and content representation information based on text representation information, may include:

[0176] Step S100B11: performing position embedding on the network threat intelligence training text to obtain position representation information;

[0177] Step S100B12: Integrate the position representation information and the text representation information to obtain integrated representation information;

[0178] Step S100B13: obtaining index representation information and content representation information based on the integrated representation information.

[0179] In step S100B11, the computer system performs a position embedding operation on the network threat intelligence training text to obtain position representation information. Position embedding is a technical means of encoding the position information of a word (a word or a specific character combination) in a text into a vector. In the network threat intelligence training text, the position of the word is of great significance for understanding the semantics and entity relationship of the text.

[0180] For example, consider the cyber threat intelligence training text "On May 10, 2023, malware attacked the company server through port 8080." For the word "malware", its position in the text is the third word (assuming it is counted from left to right). The computer system converts this position information into a vector through position embedding technology. One feasible position embedding method is Sinusoidal Positional Embedding.

[0181] Assume that the length of the text is n, the position of the word is pos, and the dimension of the vector is d. For dimension i (i=0,1,…,d-1), if i is an even number, the i-th element of the position representation information vector is ; If i is an odd number, then Taking d=512 as an example, for the word "malware" at position pos=3, the computer system can calculate a 512-dimensional position representation information vector according to the above formula. This vector encodes the position information of the word in a continuous and learnable way, allowing the model to better capture the sequential relationship between word units.

[0182] The advantage of position embedding is that it can provide the model with position information without the limitations of traditional position encoding methods (such as simple serial number encoding). For example, simple serial number encoding may only represent the position as an integer, while the sine-cosine position embedding vector can reflect more complex relationships such as periodicity and relativity of positions in different dimensions, which is very helpful for processing text with complex semantic structures such as cyber threat intelligence.

[0183] In step S100B12, the computer system integrates the position representation information obtained in step S100B11 and the text representation information obtained previously, thereby obtaining integrated representation information. The text representation information is various feature information about word units extracted from the network threat intelligence training text through previous operations (such as word vector model, grammatical analysis, etc.).

[0184] For example, for the word "malware", its text representation information may include the word vector obtained by Word2Vec (assuming it is a 300-dimensional vector, representing the relationship between "malware" and other words in the semantic space), and part of speech (noun) information obtained by part of speech tagging. The position representation information obtained in step S100B11 is a 512-dimensional vector (calculated according to the sine-cosine position embedding mentioned above).

[0185] Computer systems can be integrated in many ways. A simple way is to directly concatenate the two vectors. For the word "malware", the 300-dimensional text representation information vector and the 512-dimensional position representation information vector are concatenated together to obtain an 812-dimensional integrated representation information vector. This concatenation method is simple and direct, and can combine the position information with the semantic, grammatical and other feature information of the text, so that subsequent operations can use both information at the same time.

[0186] Another possible integration method is weighted summation. Let the text representation information vector be x, and the position representation information vector be y. The computer system can define weights α and β (α+β=1), and integrate the representation information vector z=αx+βy. For example, α=0.6, β=0.4, then z=0.6x+0.4y. This weighted summation method can adjust the importance of position information and text feature information in the integrated representation information according to actual conditions. By integrating position representation information and text representation information, the integrated representation information obtained by the computer system can more comprehensively describe the characteristics of word elements in the network threat intelligence training text, providing a richer basis for the subsequent acquisition of index representation information and content representation information.

[0187] In step S100B13, the computer system obtains index representation information and content representation information based on the integrated representation information obtained in step S100B12. The index representation information is an identifier for quickly locating and retrieving a word, while the content representation information is a more detailed and comprehensive feature description of the word.

[0188] For index representation information, the computer system can adopt a clustering-based method. First, the integrated representation information of all word units is regarded as points in a high-dimensional space. Then, a clustering algorithm (such as the K-means clustering algorithm) is used to cluster these points into several clusters. Assuming that the clustering result is k clusters, for the integrated representation information of each word unit, the computer system determines the cluster number to which it belongs as part of the index representation information. For example, the integrated representation information of the word "malware" is divided into the third cluster after clustering, so 3 can be used as part of the index representation information. In addition, the relative position within the cluster (such as the ranking calculated according to a certain distance metric within the cluster) can also be added to the index representation information to further refine the index identification.

[0189] In terms of obtaining content representation information, the computer system directly uses the integrated representation information as the basis of the content representation information. In addition to the information contained in the integrated representation information itself (such as semantic and grammatical features from text representation information and positional features from positional representation information), the computer system can also further analyze and process the integrated representation information. For example, the correlation coefficient between the integrated representation information and the integrated representation information of other related words (such as "attack", "server" and other words related to "malware") can be calculated. Suppose the integrated representation information of "malware" is A, and the integrated representation information of "attack" is B, and the correlation coefficient between them is , where n is the dimension of the integrated representation information vector, and are the means of A and B respectively. This correlation coefficient can be used as part of the content representation information to describe the relationship characteristics between "malware" and other words.

[0190] In this way, the computer system obtains index representation information and content representation information based on the integrated representation information. These information will be used together with the entity representation information in subsequent steps (such as steps S100B2 and S100B3) to construct a restored mapping representation information set, thereby providing important data support for the entire security protection method based on network threat intelligence analysis, and helping to more accurately identify entities and their relationships in network threat intelligence.

[0191] The computer system starts with the position embedding of the network threat intelligence training text through the operation of steps S100B11-S100B13, and finally obtains index representation information and content representation information after integration with the text representation information. This process lays a solid foundation for subsequent restoration mapping and other operations based on a predetermined entity representation information set, and is of great significance in the entire security protection system based on network threat intelligence analysis.

[0192] As an implementation mode, step S300, obtaining a priori entity probability distribution sequence corresponding to the network threat intelligence training text, may include:

[0193] Step S310: obtaining the annotated entity distribution position of the threat intelligence entity contained in the network threat intelligence training text and the preset prior entity distribution characteristics, taking the annotated entity distribution position as the Gaussian distribution center, establishing a Gaussian model based on the prior entity distribution characteristics, and obtaining the prior entity probability distribution sequence corresponding to the network threat intelligence training text;

[0194] or;

[0195] Step S310A: construct a network according to the entity probability distribution sequence that has been debugged in advance, and generate a priori entity probability distribution sequence corresponding to the network threat intelligence training text according to the entity probability distribution sequence.

[0196] In step S310, the computer system first obtains the annotated entity distribution position of the threat intelligence entity contained in the network threat intelligence training text. The annotated entity distribution position is a pre-marked position information about the threat intelligence entity in the text. For example, in a network threat intelligence training text "Attackers use malware to attack the target server 10.0.0.1 from IP address 192.168.1.100, and the attack method is DDoS attack", for the IP address of the attack source "192.168.1.100" (threat intelligence entity), its starting position (for example, the character that starts) and ending position (the character that ends) in the text are the annotated entity distribution positions. These annotations may be manually marked or generated based on the results of previous accurate identification.

[0197] At the same time, the computer system also requires preset a priori entity distribution features. A priori entity distribution feature is a pre-set description of some characteristics of the threat intelligence entity around its distribution location. For example, for a threat intelligence entity such as an IP address, the a priori entity distribution feature may include the frequency of occurrence of the address segment to which the IP address belongs in historical network threat events, the frequency of association with other related entities (such as a specific type of malware or attack targets), etc. Assuming that in historical data, an attack source from a specific IP address segment has a higher probability of attacking when combined with a specific type of malware, this is a priori entity distribution feature.

[0198] Then, the computer system uses the distribution position of the annotated entity as the center of the Gaussian distribution. Finally, a Gaussian model is established based on the prior entity distribution characteristics to obtain the prior entity probability distribution sequence corresponding to the network threat intelligence training text. The standard deviation and other parameters of the Gaussian distribution are determined based on the information in the prior entity distribution characteristics. For example, if the prior entity distribution characteristics indicate that the distribution of a threat intelligence entity around its distribution position is relatively scattered (the association with other entities varies in a large range), then the value of the standard deviation will be larger; conversely, if the distribution is relatively concentrated, the value of the standard deviation will be smaller. After determining the mean and standard deviation, the computer system can calculate the probabilities under different values ​​according to the probability density function of the Gaussian distribution, thereby obtaining the prior entity probability distribution sequence. For example, for other entities related to the IP address "192.168.1.100" (such as possible attack targets, attack methods, etc.), the computer system can calculate the probability of different attack targets or attack methods appearing around the IP address based on this prior entity probability distribution sequence. This probability sequence is the prior entity probability distribution sequence.

[0199] In step S310A, the computer system first relies on the entity probability distribution sequence that has been debugged in advance to build a network. This entity probability distribution sequence that has been debugged in advance is constructed and debugged based on a large amount of prior knowledge or previous network threat intelligence data. For example, in a network security research institution, by analyzing a large amount of network threat intelligence data, a database of probability relationships between various network threat entities (such as different types of attack sources, attack targets, attack methods, etc.) has been established. After the data in this database is processed and modeled, a previously debugged entity probability distribution sequence is formed.

[0200] This entity probability distribution sequence construction network is a specially designed network structure, which can be built based on neural networks (such as convolutional neural networks, recurrent neural networks, etc.) or other statistical models. Taking the convolutional neural network (CNN) as an example, the convolution layer of the network can automatically extract local features in the entity probability distribution sequence, the pooling layer can compress and aggregate these features, and the fully connected layer can map these features to the final output space. The parameters of this network structure (such as the size and number of convolution kernels, the connection weights between neurons, etc.) are determined in the previous debugging process, with the aim of accurately generating appropriate outputs based on the input entity probability distribution sequence.

[0201] When the computer system wants to obtain the prior entity probability distribution sequence corresponding to the network threat intelligence training text, it inputs the network threat intelligence training text into the pre-debugged entity probability distribution sequence construction network. For example, for a new network threat intelligence training text "Attackers use new malware to attack the database server of the company's internal network", this text is converted into a format suitable for network input (such as converting the words in the text into vector representations, etc.), and then input into the entity probability distribution sequence construction network.

[0202] Then, a network is constructed based on the entity probability distribution sequence to generate a prior entity probability distribution sequence corresponding to the network threat intelligence training text. The network processes the input network threat intelligence training text according to its internal algorithm and parameter settings, and finally outputs a prior entity probability distribution sequence. This output prior entity probability distribution sequence reflects the probability distribution of threat intelligence entities in the current network threat intelligence training text based on the existing prior knowledge (pre-debugged entity probability distribution sequence). For example, the network may output the probability of different types of database servers becoming attack targets in the case of the emergence of this new malware, as well as the probability of possible attack methods, etc. These probabilities constitute the prior entity probability distribution sequence.

[0203] The computer system can effectively obtain the prior entity probability distribution sequence corresponding to the network threat intelligence training text through the two different implementation methods of step S310 and step S310A. This prior entity probability distribution sequence plays an important role in the entire security protection method based on network threat intelligence analysis. It provides a key reference basis for subsequent steps (such as comparing with the predicted entity probability distribution sequence to determine the network debugging error, etc.), which helps to improve the accuracy and effectiveness of network threat intelligence analysis and security protection.

[0204] As an implementation mode, the threat entity identification network further executes to obtain a plurality of groups of target entity distribution features corresponding to the target entity distribution positions and a target component influence coefficient of a basic entity probability distribution sequence corresponding to each group of target entity distribution features. The security protection method based on network threat intelligence analysis may also include:

[0205] Step S500: determining the probability of the target entity distribution position according to the sum of the influence coefficients of multiple target components;

[0206] Step S600: When the probability is not less than a preset critical probability value, extracting entities according to the target entity distribution position.

[0207] In step S500, the computer system needs to determine the probability of the target entity distribution location based on the sum of multiple target component influence coefficients. The target component influence coefficient reflects the degree of influence of different factors on the target entity distribution location. The target entity distribution location here refers to the location information of the threat intelligence entity in the target network threat intelligence text.

[0208] For example, in the target network threat intelligence text "Abnormal traffic from IP address 10.0.0.1 has been detected recently, which is suspected to be related to a new type of malware and targets the company's internal financial server", for the IP address "10.0.0.1" (threat intelligence entity), its position in the text is the target entity distribution location. Assume that there are multiple groups of factors that affect the probability determination of the target entity distribution location.

[0209] The target component impact coefficient may be related to a variety of factors. On the one hand, it may be related to the semantic features of the entity. For example, for the IP address "10.0.0.1", if from a semantic point of view, it belongs to a specific private IP address segment, and in historical network threat data, this address segment has a high correlation with certain malware, then the target component impact coefficient corresponding to this semantic feature will reflect the degree of this correlation. Assume that this degree of correlation is obtained through statistical analysis of a large amount of historical data to obtain a quantitative value, such as 0.3 (indicating that the influence weight of this semantic feature on the probability of the target entity distribution location is 0.3).

[0210] On the other hand, the target component impact coefficient may also be related to the contextual relationship of the entity. In the above text, "10.0.0.1" has a contextual relationship with "new malware" and "financial server within the company". If the analysis finds that in similar network threat scenarios, when the attack source IP address appears with a specific type of malware and a specific attack target at the same time, there is a certain pattern to follow, then this contextual relationship will also be quantified as the target component impact coefficient. For example, the target component impact coefficient corresponding to this contextual relationship is 0.5.

[0211] The computer system adds the target component influence coefficients corresponding to these different factors. For example, add 0.3 corresponding to the semantic feature and 0.5 corresponding to the contextual relationship to get 0.8. This addition result is used to determine the probability of the target entity distribution location. A simple technical means to determine the probability is to use this addition result directly as the probability value (normalization may be required in some cases). Assume that after normalization (if necessary), this probability value indicates that in the current target network threat intelligence text, the probability that the IP address "10.0.0.1" is a threat intelligence entity in its target entity distribution location is 0.8. This probability reflects the degree of possibility that the entity is a real threat intelligence entity at this location after comprehensive judgment based on multiple influencing factors.

[0212] In step S600, the computer system compares the probability determined in step S500 with a preset critical probability value, and when the probability is not less than the preset critical probability value, extracts the entity according to the target entity distribution position. The preset critical probability value is a pre-set threshold value, which is determined according to the network security requirements and actual conditions.

[0213] For example, in a scenario where a high accuracy of network threat intelligence is required, the preset critical probability value may be set to 0.7. Continuing with the above target network threat intelligence text as an example, if the probability of the IP address "10.0.0.1" determined in step S500 as a threat intelligence entity in its target entity distribution location is 0.8 (greater than 0.7), then the computer system will extract the entity according to the target entity distribution location.

[0214] The entity extraction process involves accurately obtaining complete information related to the threat intelligence entity from the target network threat intelligence text. For the IP address "10.0.0.1", the computer system may not only extract the IP address itself, but also the contextual information related to it, such as the relevant description in the text "abnormal traffic from IP address 10.0.0.1". The computer system can locate the distribution position of the target entity (such as determining the starting and ending character positions of the IP address in the text), and then extract the relevant text content within this position range as the complete threat intelligence entity information.

[0215] This method of extracting entities based on probability judgment helps to improve the accuracy of network threat intelligence analysis. In actual network security protection, there are a large number of network threat intelligence texts that need to be processed. Direct extraction without probability judgment may lead to misjudgment, treating some content that is not a real threat intelligence entity as threat intelligence, or missing some real threat intelligence entities. By setting a critical probability value, the computer system can filter out low-probability entities to a certain extent, while ensuring that high-probability entities are accurately extracted, thereby providing a more reliable basis for the subsequent formulation of security protection strategies. For example, if the IP address "10.0.0.1" and its related information are extracted as a threat intelligence entity, the security protection system can take corresponding measures against this IP address, such as more stringent monitoring or blocking of traffic from this IP address in the firewall.

[0216] Through the operation of steps S500-S600, the computer system performs more accurate probability judgment and extraction operations on the threat intelligence entities in the target network threat intelligence text in the derivative implementation of the security protection method based on network threat intelligence analysis. This helps to improve the accuracy and effectiveness of the entire network threat intelligence analysis system and provide more powerful support for network security protection.

[0217] Based on the foregoing embodiments, the embodiments of the present application provide a security protection device based on network threat intelligence analysis. The units included in the device and the modules included in each unit can be implemented by a processor in a computer device; of course, they can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0218] Figure 2 A schematic diagram of the structure of a security protection device based on network threat intelligence analysis provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the security protection device 200 based on network threat intelligence analysis includes:

[0219] The training sample acquisition module 210 is used to obtain a network threat intelligence training text used as a learning template data, extract representation information from the network threat intelligence training text according to the threat entity identification network, and obtain the training entity distribution position of the threat intelligence entity contained in the network threat intelligence training text, as well as the training entity distribution features corresponding to the training entity distribution position;

[0220] A probability distribution generating module 220, configured to use the training entity distribution position as the center of the Gaussian distribution and generate a predicted entity probability distribution sequence corresponding to the training entity distribution position according to the training entity distribution characteristics;

[0221] A training label acquisition module 230 is used to obtain a priori entity probability distribution sequence corresponding to the network threat intelligence training text, wherein the priori entity probability distribution sequence is a debugging reference mark of the threat entity identification network;

[0222] A network debugging module 240 is used to determine a network debugging error of the threat entity identification network according to the predicted entity probability distribution sequence and the prior entity probability distribution sequence, and debug the threat entity identification network according to the network debugging error until the threat entity identification network reaches a preset debugging stop condition, thereby obtaining a converged threat entity identification network;

[0223] The network calling module 250 is used to obtain the target network threat intelligence text to be subjected to threat intelligence entity identification, extract representation information of the target network threat intelligence text according to the debugged and converged threat entity identification network, and obtain the target entity distribution position of the threat intelligence entity contained in the target network threat intelligence text, so as to determine the security protection strategy based on the entity content corresponding to the target entity distribution position.

[0224] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules included in the device provided in the embodiment of the present application can be used to execute the method described in the above method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0225] The embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, some or all of the steps in the above method are implemented. The computer-readable storage medium can be transient or non-transient.

[0226] Figure 3 A hardware entity diagram of a computer system provided in an embodiment of the present application is shown in FIG. Figure 3As shown, the hardware entity of the computer system 1000 includes: a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program that can be run on the processor 1001, and the processor 1001 implements the steps in the method of any of the above embodiments when executing the program.

[0227] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A security protection method based on network threat intelligence analysis, characterized in that: include: Acquire a network threat intelligence training text used as learning template data, extract representation information from the network threat intelligence training text according to a threat entity identification network, and obtain training entity distribution positions of threat intelligence entities contained in the network threat intelligence training text, as well as training entity distribution features corresponding to the training entity distribution positions; Taking the training entity distribution position as the center of Gaussian distribution, generating a predicted entity probability distribution sequence corresponding to the training entity distribution position according to the training entity distribution characteristics; Acquire a priori entity probability distribution sequence corresponding to the network threat intelligence training text, wherein the priori entity probability distribution sequence is a debugging reference mark of the threat entity identification network; Determining a network debugging error of the threat entity identification network according to the predicted entity probability distribution sequence and the prior entity probability distribution sequence, and debugging the threat entity identification network according to the network debugging error until the threat entity identification network reaches a preset debugging stop condition, thereby obtaining a converged threat entity identification network; Obtain a target network threat intelligence text for which threat intelligence entity identification is to be performed, extract representation information from the target network threat intelligence text according to a debugged and converged threat entity identification network, and obtain the target entity distribution position of the threat intelligence entity contained in the target network threat intelligence text, so as to determine a security protection strategy based on the entity content corresponding to the target entity distribution position; The training entity distribution features include a first correlation parameter between feature dimensions of any word-meta token in the basic entity probability distribution sequence to be generated and a second correlation parameter of adjacent position features, position dispersion of character indexes of all word-meta tokens in the basic entity probability distribution sequence, and feature dispersion of feature dimensions of all word-meta tokens in the basic entity probability distribution sequence. The training entity distribution position is taken as the center of the Gaussian distribution, and a predicted entity probability distribution sequence corresponding to the training entity distribution position is generated according to the training entity distribution features, including: Taking the character index and feature dimension of any word token in the basic entity probability distribution sequence as a multidimensional feature vector, taking the training entity distribution position as the center of the Gaussian distribution, establishing a multi-component probability model according to the first association parameter, the second association parameter, the position dispersion and the feature dispersion, and obtaining the basic entity probability distribution sequence corresponding to the training entity distribution position; Obtaining a predicted entity probability distribution sequence corresponding to the training entity distribution position according to the basic entity probability distribution sequence; The determining of the network debugging error of the threat entity identification network according to the predicted entity probability distribution sequence and the priori entity probability distribution sequence includes: Determine a first error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence according to a negative log-likelihood error function, and determine a second error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence according to a cross entropy error function; Determining a network debugging error of the threat entity identification network according to an addition result of the first error value and the second error value; The obtaining of a priori entity probability distribution sequence corresponding to the network threat intelligence training text includes: Obtain the annotated entity distribution position of the threat intelligence entity contained in the network threat intelligence training text, and the preset prior entity distribution characteristics, take the annotated entity distribution position as the Gaussian distribution center, establish a Gaussian model based on the prior entity distribution characteristics, and obtain the prior entity probability distribution sequence corresponding to the network threat intelligence training text; Alternatively, a network is constructed according to a previously debugged entity probability distribution sequence, and a priori entity probability distribution sequence corresponding to the network threat intelligence training text is generated according to the network constructed according to the entity probability distribution sequence; The threat entity identification network further executes to obtain a plurality of groups of target entity distribution features corresponding to the target entity distribution positions and a target component influence coefficient of a basic entity probability distribution sequence corresponding to each group of the target entity distribution features, and the security protection method based on network threat intelligence analysis also includes: Determining the probability of the target entity distribution position according to the sum of the influence coefficients of the plurality of target components; When the probability is not less than a preset critical probability value, entities are extracted according to the target entity distribution position.

2. The method according to claim 1, characterized in that The training entity distribution features include multiple groups, the threat entity identification network further executes to obtain the training component influence coefficient of the basic entity probability distribution sequence corresponding to each group of the training entity distribution features, and the predicted entity probability distribution sequence corresponding to the training entity distribution position is obtained according to the basic entity probability distribution sequence, including: Weighting the plurality of basic entity probability distribution sequences according to the training component influence coefficients to obtain a predicted entity probability distribution sequence corresponding to the training entity distribution position; The step of establishing a multi-component probability model based on the first association parameter, the second association parameter, the position dispersion and the feature dispersion to obtain the basic entity probability distribution sequence corresponding to the training entity distribution position includes: Determine a two-dimensional array of correlation of distribution according to the association parameter, the position dispersion and the feature dispersion; Normalizing the multidimensional feature vector according to the correlation two-dimensional array and the distribution position of the training entities; A multi-component probability model is established according to the normalized result of the multi-dimensional feature vector to obtain the basic entity probability distribution sequence corresponding to the training entity distribution position.

3. The method according to claim 2, characterized in that The determining the network debugging error of the threat entity identification network according to the sum of the first error value and the second error value includes: Obtaining an adjustment factor for adjusting the steepness of the parameter change rate, and performing a softening process on the first error value according to the adjustment factor to obtain a third error value; A network debugging error of the threat entity identification network is determined according to a result of adding the third error value to the second error value.

4. The method according to claim 1, characterized in that The extracting characterization information of the network threat intelligence training text according to the threat entity identification network, and obtaining the training entity distribution positions of the threat intelligence entities contained in the network threat intelligence training text, and the training entity distribution features corresponding to the training entity distribution positions, include: Loading the network threat intelligence training text into a threat entity identification network; Performing representation information mining on the network threat intelligence training text to obtain text representation information of the network threat intelligence training text; Performing feature conversion on the text representation information to obtain conversion representation information; Performing full connection mapping on the conversion representation information to obtain prediction representation information; The training entity distribution positions of the threat intelligence entities contained in the network threat intelligence training text and the training entity distribution features corresponding to the training entity distribution positions are obtained based on the predicted representation information.

5. The method according to claim 4, characterized in that The threat entity identification network performs full-connection mapping on the conversion representation information according to two decision components, and obtains the training entity distribution position of the threat intelligence entity contained in the network threat intelligence training text according to the predicted representation information, and the training entity distribution features corresponding to the training entity distribution position, including: Obtaining, based on the prediction representation information output by one of the decision components, a training entity distribution position of the threat intelligence entity contained in the network threat intelligence training text; According to the prediction representation information output by another of the decision components, the training entity distribution features corresponding to the training entity distribution positions are obtained.

6. The method according to claim 1, characterized in that The extracting characterization information of the network threat intelligence training text according to the threat entity identification network, and obtaining the training entity distribution positions of the threat intelligence entities contained in the network threat intelligence training text, and the training entity distribution features corresponding to the training entity distribution positions, include: Mining text representation information of cyber threat intelligence training text; The text representation information is restored and mapped based on a predetermined entity representation information set by a representation information restoration mapping component to obtain a restored mapping representation information set; wherein the restored mapping representation information in the restored mapping representation information set corresponds to the entity representation information in the predetermined entity representation information set; Based on the restored mapping representation information set, reasoning to obtain multiple reasoning results; The plurality of inference results correspond to the restored mapping representation information in the restored mapping representation information set; Each of the inference results includes a training entity distribution position, a training entity distribution feature corresponding to the distribution position, and a correlation between an entity in a position corresponding to the distribution position and multiple entities in positions corresponding to the distribution positions in multiple inference results; Based on the correlation and the training entity distribution characteristics, the training entity distribution positions of entities in the corresponding positions are determined, and the training entity distribution positions of entities with correlation among the multiple entities are merged to obtain a training entity recognition result.

7. The method according to claim 6, characterized in that The method of restoring and mapping the text representation information based on a predetermined entity representation information set by using a representation information restoration mapping component to obtain a restoration mapping representation information set includes: Obtaining index representation information and content representation information based on the text representation information; Obtaining entity representation information based on the predetermined entity representation information set; And the entity representation information, the index representation information and the content representation information are input into the representation information restoration mapping component to obtain a restoration mapping representation information set output by the representation information restoration mapping component.

8. The method according to claim 7, characterized in that The obtaining of index representation information and content representation information based on the text representation information includes: Performing position embedding on the network threat intelligence training text to obtain position representation information; Integrating the position representation information and the text representation information to obtain integrated representation information; And the index representation information and the content representation information are obtained based on the integrated representation information.

9. A security protection device based on network threat intelligence analysis, characterized in that: include: A training sample acquisition module is used to acquire a network threat intelligence training text used as a learning template data, extract representation information from the network threat intelligence training text according to a threat entity identification network, and obtain the training entity distribution position of the threat intelligence entity contained in the network threat intelligence training text, as well as the training entity distribution features corresponding to the training entity distribution position; A probability distribution generation module, used to use the training entity distribution position as the center of the Gaussian distribution and generate a predicted entity probability distribution sequence corresponding to the training entity distribution position according to the training entity distribution characteristics; A training label acquisition module, used to acquire a priori entity probability distribution sequence corresponding to the network threat intelligence training text, wherein the priori entity probability distribution sequence is a debugging reference mark of the threat entity identification network; A network debugging module, used to determine a network debugging error of the threat entity identification network according to the predicted entity probability distribution sequence and the prior entity probability distribution sequence, and debug the threat entity identification network according to the network debugging error until the threat entity identification network reaches a preset debugging stop condition, thereby obtaining a converged threat entity identification network; A network calling module is used to obtain a target network threat intelligence text to be subjected to threat intelligence entity identification, extract characterization information from the target network threat intelligence text according to a debugged and converged threat entity identification network, and obtain a target entity distribution position of the threat intelligence entity contained in the target network threat intelligence text, so as to determine a security protection strategy based on the entity content corresponding to the target entity distribution position; The training entity distribution features include a first correlation parameter between feature dimensions of any word-meta token in the basic entity probability distribution sequence to be generated and a second correlation parameter of adjacent position features, position dispersion of character indexes of all word-meta tokens in the basic entity probability distribution sequence, and feature dispersion of feature dimensions of all word-meta tokens in the basic entity probability distribution sequence. The training entity distribution position is taken as the center of the Gaussian distribution, and a predicted entity probability distribution sequence corresponding to the training entity distribution position is generated according to the training entity distribution features, including: Taking the character index and feature dimension of any word token in the basic entity probability distribution sequence as a multidimensional feature vector, taking the training entity distribution position as the center of the Gaussian distribution, establishing a multi-component probability model according to the first association parameter, the second association parameter, the position dispersion and the feature dispersion, and obtaining the basic entity probability distribution sequence corresponding to the training entity distribution position; Obtaining a predicted entity probability distribution sequence corresponding to the training entity distribution position according to the basic entity probability distribution sequence; The determining of the network debugging error of the threat entity identification network according to the predicted entity probability distribution sequence and the priori entity probability distribution sequence includes: Determine a first error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence according to a negative log-likelihood error function, and determine a second error value between the predicted entity probability distribution sequence and the prior entity probability distribution sequence according to a cross entropy error function; Determining a network debugging error of the threat entity identification network according to an addition result of the first error value and the second error value; The obtaining of a priori entity probability distribution sequence corresponding to the network threat intelligence training text includes: Obtain the annotated entity distribution position of the threat intelligence entity contained in the network threat intelligence training text, and the preset prior entity distribution characteristics, take the annotated entity distribution position as the Gaussian distribution center, establish a Gaussian model based on the prior entity distribution characteristics, and obtain the prior entity probability distribution sequence corresponding to the network threat intelligence training text; Alternatively, a network is constructed according to a previously debugged entity probability distribution sequence, and a priori entity probability distribution sequence corresponding to the network threat intelligence training text is generated according to the network constructed according to the entity probability distribution sequence; The threat entity identification network further executes to obtain a plurality of groups of target entity distribution features corresponding to the target entity distribution positions and a target component influence coefficient of a basic entity probability distribution sequence corresponding to each group of the target entity distribution features, and the security protection method based on network threat intelligence analysis also includes: Determining the probability of the target entity distribution position according to the sum of the influence coefficients of the plurality of target components; When the probability is not less than a preset critical probability value, entities are extracted according to the target entity distribution position.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps in the method according to any one of claims 1 to 8 are implemented.

Images