Network false threat intelligence intelligent analysis method and system of security big model

Abstract

The invention relates to the technical field of network security, in particular to a network false threat intelligence intelligent analysis method and system for a security big model, and the method comprises the following steps: obtaining threat intelligence data; constructing a threat intelligence knowledge graph; constructing a threat intelligence confrontation network; identifying false threat intelligence; the network false threat intelligence intelligent analysis method and system of the security big model have the beneficial effects that open source threat intelligence data are acquired; then constructing a threat intelligence knowledge graph which is used as a calling tool of the large security model; afterwards, a security big model is used to perceive an enterprise network environment, false threat intelligence is generated, and the enterprise network security level is improved through identification of false threat intelligence attacks and the defense condition of the attack process.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for intelligently analyzing network false threat intelligence of a large security model. Background Art

[0002] As cyberattack methods continue to evolve, threat intelligence data has become highly diverse and complex, including structured data (such as records in databases), semi-structured data (such as tables and lists on web pages), and unstructured data (such as text, images, and videos). These data come from a wide range of sources and in different formats, which poses a huge challenge to the collection, processing, and analysis of threat intelligence.

[0003] Traditional threat intelligence analysis methods often rely on manual analysis and expert experience, which makes it difficult to deal with massive and complex threat intelligence data. At the same time, these methods are insufficient in identifying false network threat intelligence and are easily deceived by attackers using fake intelligence. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for intelligent analysis of network false threat intelligence of a large security model to solve the problems raised in the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a method for intelligent analysis of network false threat intelligence of a security large model, the method comprising the following steps:

[0006] Obtain threat intelligence data;

[0007] Construction of threat intelligence knowledge graph;

[0008] Threat intelligence countermeasure network construction;

[0009] Identification of false threat intelligence.

[0010] Preferably, the specific operations for obtaining threat intelligence data include:

[0011] Obtain open source threat intelligence data. Obtain intelligence data through public intelligence sources. Obtain raw intelligence data through JSON parsing. Parse semi-structured intelligence data through web page DOM and obtain raw intelligence data. Unstructured data can obtain raw intelligence data through web page URL mapping. Store intelligence data in a unified manner in the intelligence database.

[0012] The process of preprocessing intelligence data, completing incomplete data, removing redundant data, and storing the data in a database in a unified format.

[0013] Preferably, the specific operations of constructing the threat intelligence knowledge graph include:

[0014] Get the word vector of intelligence data through word2vec method;

[0015] Use the previous word vector as the input of the BiLSTM layer and obtain the feature encoding of the intelligence data;

[0016] Combined with the attention mechanism to obtain the context features, and the result value based on the attention mechanism layer is used as the input data of the LSTM layer to obtain the label sequence vector of the intelligence data;

[0017] The label sequence of intelligence data is output through the Softmax function, and then the triple of entity-relationship semantics of intelligence data is obtained: entity-relationship-ID mapping.

[0018] Preferably, the specific operations of building a threat intelligence countermeasure network include:

[0019] After initializing the adversarial model, the corresponding word features of the threat intelligence are obtained through the word2vec model, and the word position features are obtained based on the position distance of the words in the sentence sequence of the threat intelligence data. The entity, attribute, and relationship triple features of the threat intelligence are obtained through part-of-speech tagging and feature extraction of the sentence sequence. The above features are used as input data to obtain the global and local features of the threat intelligence, and feature fusion is performed to enhance the semantic feature expression of the threat intelligence knowledge graph and the knowledge reasoning and analysis capabilities of the large security model.

[0020] Preferably, the specific operations of false threat intelligence identification include:

[0021] Generate false threat intelligence, sandbox environment simulation and false threat intelligence detection through security big models.

[0022] A network false threat intelligence intelligent analysis system of a security large model, the system is composed of the following modules:

[0023] Data acquisition module, which acquires threat intelligence data;

[0024] Graph construction module, threat intelligence knowledge graph construction;

[0025] Network construction module, threat intelligence countermeasure network construction;

[0026] Intelligence identification module, false threat intelligence identification.

[0027] Preferably, the data acquisition module acquires open source threat intelligence data, acquires intelligence data through public intelligence sources, obtains original intelligence data through JSON parsing, parses semi-structured intelligence data through web page DOM and acquires original intelligence data, and obtains original intelligence data through web page URL mapping of unstructured data, and stores the intelligence data in an intelligence database in a unified manner; the process of preprocessing intelligence data, completing incomplete data, removing redundant processing, and storing data in a database in a unified format.

[0028] Preferably, the graph construction module obtains the word vector of the intelligence data through the word2vec method; uses the previous word vector as the input of the BiLSTM layer to obtain the feature encoding of the intelligence data; obtains the features of the context in combination with the attention mechanism, and uses the result value based on the attention mechanism layer as the input data of the LSTM layer to obtain the label sequence vector of the intelligence data; outputs the label sequence of the intelligence data through the Softmax function, and then obtains the triple of entity-relationship semantics of the intelligence data: entity-relationship-ID mapping.

[0029] Preferably, the network construction module performs adversarial model initialization processing, obtains corresponding word features of threat intelligence through the word2vec model, and obtains word position features based on the position distance of words in the sentence sequence of threat intelligence data; obtains entity, attribute, and relationship triple features of threat intelligence based on part-of-speech tagging and feature extraction of sentence sequences; uses the above features as input data to obtain global and local features of threat intelligence, and performs feature fusion, thereby improving the semantic feature expression of threat intelligence knowledge graph and improving the knowledge reasoning and analysis capabilities of large security models.

[0030] Preferably, the intelligence identification module generates false threat intelligence, sandbox environment simulation and false threat intelligence detection through a large security model.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The network false threat intelligence intelligent analysis method and system of the security big model proposed in the present invention obtains open source threat intelligence data; then constructs a threat intelligence knowledge graph as a calling tool for the security big model; then, uses the security big model to perceive the enterprise network environment, generates false threat intelligence, and improves the enterprise network security level by identifying false threat intelligence attacks and resisting the attack process. It can achieve accurate evaluation of false threat intelligence information, and at the same time, it can also use the security big model to call the knowledge graph tool to intuitively display the entity and semantic association of threat intelligence information in the form of a graph structure, ensuring the security of the enterprise network ecology and avoiding the occurrence of various security threat events. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 is a flow chart of the method of the present invention;

[0034] Figure 2 This is a system architecture diagram of the present invention;

[0035] Figure 3 The present invention is a flowchart of the application process of the large safety model. DETAILED DESCRIPTION

[0036] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] For example, see Figure 1 and Figure 2 The present invention provides a technical solution: a method for intelligently analyzing false threat intelligence of a large security model network, the method comprising the following steps:

[0038] First, it is necessary to obtain open source threat intelligence data, such as structured data, semi-structured data, and unstructured data; then build a threat intelligence knowledge graph; then, improve the performance of the knowledge graph through an adversarial network; finally, generate false threat intelligence based on the security big model, and use the "sandbox" environment to test and evaluate whether the enterprise's network security strategy can identify threat intelligence, as well as the enterprise's network security threat perception.

[0039] (1) Obtaining threat intelligence data

[0040] ① Obtain open source threat intelligence data. Here, intelligence data can be obtained through public intelligence sources. For example, structured data can obtain JSON format intelligence data information of the specified entity by calling the HTTP interface provided by the site, and then the original intelligence data can be obtained through JSON parsing. Semi-structured intelligence data can be parsed through the web page DOM and the original intelligence data can be obtained. Unstructured data can obtain the original intelligence data through web page URL mapping. The above intelligence data is then stored in the intelligence database.

[0041] ② Intelligence data preprocessing. This preprocessing mainly involves completing incomplete data, removing redundant processing, and storing the data in a database in a unified format. The purpose of this preprocessing is to improve the quality of the data.

[0042] (2) Threat intelligence knowledge graph construction (security big model calling tool)

[0043] This step proposes a deep learning extraction method based on the semantic relationship extraction process of threat intelligence entities. The process is as follows:

[0044] First, the word vector of intelligence data is obtained through the word2vec method.

[0045] Then, the previous word vector is used as the input of the Bidirectional LSTM (BiLSTM) layer to obtain the feature encoding of the intelligence data.

[0046] Afterwards, the attention mechanism is combined to obtain the features of the context, and the result value based on the attention mechanism layer is used as the input data of the LSTM layer to obtain the label sequence vector of the intelligence data.

[0047] Finally, the label sequence of the intelligence data is output through the Softmax function, and then the triples of the entity-relationship semantics of the intelligence data (entity-relationship-ID mapping) are obtained.

[0048] (3) Threat Intelligence Countermeasure Network Construction

[0049] In order to improve the overall performance of the threat intelligence knowledge graph and better assist the security big model in threat knowledge reasoning, adversarial learning is performed on the previously constructed knowledge graph. The purpose of this adversarial learning is to enhance the semantic features of threat intelligence data.

[0050] The adversarial network model is mainly composed of a generator and a discriminator. Through iterative training of the model, the generator is able to capture real threat intelligence data as much as possible to generate new threat intelligence data sets in order to deceive the discriminator, which needs to distinguish the received data sets as "true" or "false" and distinguish the generated data sets from the real data.

[0051] ①The process of this model is to maximize the optimization update under a given generation model to obtain the optimal discriminant model.

[0052] ②Fix the discriminant model to minimize the optimization update process and obtain the optimal generation model.

[0053] The training process of the adversarial model is as follows: first, the adversarial model is initialized, and the corresponding word features of the threat intelligence are obtained through the word2vec model, and the word position features are obtained based on the position distance of the words in the sentence sequence of the threat intelligence data. After that, the entity, attribute, and relationship triple features of the threat intelligence are obtained based on the part-of-speech tagging and feature extraction of the sentence sequence. Finally, the above features are used as input data to obtain the global and local features of the threat intelligence, and feature fusion is performed to improve the semantic feature expression of the threat intelligence knowledge graph, which can also improve the knowledge reasoning and analysis capabilities of the large security model.

[0054] (4) Identification of false threat intelligence

[0055] ① Generate false threat intelligence through security big models

[0056] The security big model can automatically generate sentences with threat intelligence data characteristics. Here, you can use the open source threat intelligence data set to iteratively adjust the model to achieve the automatic generation of network security threat intelligence data text. Among them, iterative adjustment is mainly divided into two core steps:

[0057] First, preliminary training: Here, the model is initially trained mainly with threat intelligence data of missing words or intelligence of predicting the next word given the previous word. For example, a large-scale open source threat intelligence dataset is used to conduct preliminary training on a large security model to generate data with basic threat intelligence semantic logic. This model framework consists of multiple decoder units of the Transformer self-attention mechanism layer. Each layer obtains dependencies through the attention mechanism to better judge the importance of the sequence in the model.

[0058] Second, adjust the training: In this iterative training, the main purpose is to adjust the local parameters of the security model through special network security scenarios, network security tasks or manually labeled threat intelligence data, so as to obtain a threat intelligence data set under a special scenario of a certain topic.

[0059] In order to ensure the randomness of threat intelligence data generation, the Top method is used here.

[0060] ②Sandbox environment simulation

[0061] Simply put, this step is to launch the threat intelligence data attack generated earlier into a certain network environment. This attack deceives the enterprise network security defense system by tampering with or forging the content of threat intelligence data. Through the sandbox, you can explore the threat intelligence data attack process and analyze the impact of this threat intelligence data attack. For example, attacks can be carried out in the threat intelligence mining stage, threat intelligence database, and threat intelligence processing stage. The purpose of this false threat intelligence identification and simulation attack process is to discover network security loopholes and hidden dangers. Because attackers are likely to forge threat intelligence data and use the loopholes in the enterprise network security to purposefully launch it to cover up the real security attack information. If the enterprise assumes that a series of false threat intelligence has been predicted, it will mine the hidden network loopholes based on the false threat intelligence attack results and repair them.

[0062] ③ False threat intelligence detection

[0063] Here, the TextCNN convolutional neural network model can be used to identify false threat intelligence. This model mainly performs feature extraction, convolution processing, and feature integration on the local features of false threat intelligence words to obtain the authenticity label of the threat intelligence. The TextCNN convolutional neural network model is a two-category label judgment model of "true label" and "false label". By continuously adjusting the detection accuracy of the TextCNN false threat intelligence detection model with the help of the false threat intelligence dataset generated by the large security model, it is possible to resist attacks carried out by attackers using forged false threat intelligence to the greatest extent, thereby maximizing the detection capabilities of the enterprise network security defense system. Figure 2 shown.

[0064] (5) Model usage

[0065] ① Knowledge graph model: It can generate a graph structure for threat intelligence data and is the tool basis for building a large security model.

[0066] ② Adversarial learning model: Improve the overall performance of threat intelligence knowledge graph.

[0067] ③ False threat intelligence detection model: It can use the big security model to generate false threat intelligence, simulate attacks, and continuously improve the enterprise network security strategy based on the attack results. This can maximize the defense against attacks carried out by attackers using forged false threat intelligence, thereby maximizing the detection capabilities of the enterprise network security defense system.

[0068] The above is the core technical solution of this patented method.

[0069] Embodiment 2, based on embodiment 1, proposes a network false threat intelligence intelligent analysis system of a security large model, the system is composed of the following modules:

[0070] Data acquisition module, acquires threat intelligence data; acquires open source threat intelligence data, acquires intelligence data through public intelligence sources, obtains original intelligence data through JSON parsing, parses semi-structured intelligence data through web page DOM and acquires original intelligence data, and obtains original intelligence data through web page URL mapping of unstructured data, and stores intelligence data in a unified manner in the intelligence database; intelligence data preprocessing, completes incomplete data, removes redundant processing, and stores data in a database in a unified format.

[0071] Graph construction module, threat intelligence knowledge graph construction; obtain word vectors of intelligence data through word2vec method; use the previous word vector as the input of BiLSTM layer and obtain the feature encoding of intelligence data; combine attention mechanism to obtain context features, and use the result value based on attention mechanism layer as input data of LSTM layer to obtain label sequence vector of intelligence data; output label sequence of intelligence data through Softmax function, and then obtain triple of entity-relationship semantics of intelligence data: entity-relationship-ID mapping.

[0072] Network construction module, threat intelligence adversarial network construction; adversarial model initialization processing, obtain the corresponding word features of threat intelligence through the word2vec model, and obtain word position features based on the position distance of words in the sentence sequence of threat intelligence data; obtain entity, attribute, and relationship triple features of threat intelligence through part-of-speech tagging and feature extraction of sentence sequences; use the above features as input data to obtain the global and local features of threat intelligence, and perform feature fusion, thereby improving the semantic feature expression of threat intelligence knowledge graph and the knowledge reasoning and analysis capabilities of large security models.

[0073] Intelligence identification module, false threat intelligence identification, generation of false threat intelligence through large security models, sandbox environment simulation and false threat intelligence detection.

[0074] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for intelligent analysis of network false threat intelligence based on a large security model, characterized by: The method comprises the following steps: Obtain threat intelligence data; Threat intelligence knowledge graph construction; Threat intelligence countermeasure network construction; Identification of false threat intelligence.

2. According to the method for intelligent analysis of network false threat intelligence of a security big model in claim 1, it is characterized by: The specific operations for obtaining threat intelligence data include: Obtain open source threat intelligence data. Obtain intelligence data through public intelligence sources. Obtain raw intelligence data through JSON parsing. Parse semi-structured intelligence data through web page DOM and obtain raw intelligence data. Unstructured data can obtain raw intelligence data through web page URL mapping. Store intelligence data in a unified manner in the intelligence database. The process of preprocessing intelligence data, completing incomplete data, removing redundant data, and storing the data in a database in a unified format.

3. The method for intelligent analysis of network false threat intelligence based on a security big model according to claim 1 is characterized by: The specific operations of building a threat intelligence knowledge graph include: Get the word vector of intelligence data through word2vec method; Use the previous word vector as the input of the BiLSTM layer and obtain the feature encoding of the intelligence data; Combined with the attention mechanism to obtain the context features, and the result value based on the attention mechanism layer is used as the input data of the LSTM layer to obtain the label sequence vector of the intelligence data; The label sequence of intelligence data is output through the Softmax function, and then the triple of entity-relationship semantics of intelligence data is obtained: entity-relationship-ID mapping.

4. The method for intelligent analysis of network false threat intelligence based on a security big model according to claim 1 is characterized by: The specific operations of threat intelligence countermeasure network construction include: After initializing the adversarial model, the corresponding word features of the threat intelligence are obtained through the word2vec model, and the word position features are obtained based on the position distance of the words in the sentence sequence of the threat intelligence data. The entity, attribute, and relationship triple features of the threat intelligence are obtained through part-of-speech tagging and feature extraction of the sentence sequence. The above features are used as input data to obtain the global and local features of the threat intelligence, and feature fusion is performed to enhance the semantic feature expression of the threat intelligence knowledge graph and the knowledge reasoning and analysis capabilities of the large security model.

5. The method for intelligent analysis of network false threat intelligence based on a security big model according to claim 1 is characterized by: The specific operations of false threat intelligence identification include: Generate false threat intelligence, sandbox environment simulation and false threat intelligence detection through security big models.

6. A network false threat intelligence intelligent analysis system of a security big model according to the network false threat intelligence intelligent analysis method of the security big model according to any one of claims 1 to 5, characterized in that: The system consists of the following modules: Data acquisition module, which acquires threat intelligence data; Graph construction module, threat intelligence knowledge graph construction; Network construction module, threat intelligence countermeasure network construction; Intelligence identification module, false threat intelligence identification.

7. The network false threat intelligence intelligent analysis system of a security large model according to claim 6 is characterized by: The data acquisition module acquires open source threat intelligence data, acquires intelligence data through public intelligence sources, obtains original intelligence data through JSON parsing, parses semi-structured intelligence data through web page DOM and acquires original intelligence data, and obtains original intelligence data through web page URL mapping of unstructured data, and stores intelligence data in an intelligence database in a unified manner; preprocesses intelligence data, completes incomplete data, removes redundant processing, and stores data in a database in a unified format.

8. The network false threat intelligence intelligent analysis system of a security large model according to claim 6 is characterized by: The graph construction module obtains word vectors of intelligence data through the word2vec method; uses the previous word vectors as inputs of the BiLSTM layer, and obtains feature encoding of the intelligence data; The attention mechanism is combined to obtain the features of the context, and the result value based on the attention mechanism layer is used as the input data of the LSTM layer to obtain the label sequence vector of the intelligence data; the label sequence of the intelligence data is output through the Softmax function, and then the triple of the entity-relationship semantics of the intelligence data is obtained: entity-relationship-ID mapping.

9. The network false threat intelligence intelligent analysis system of a security large model according to claim 6 is characterized by: The network construction module performs adversarial model initialization processing, obtains corresponding word features of threat intelligence through the word2vec model, and obtains word position features based on the position distance of words in the sentence sequence of threat intelligence data; Through part-of-speech tagging and feature extraction of sentence sequences, we obtain the entity, attribute, and relationship triple features of threat intelligence. We use the above features as input data to obtain the global and local features of threat intelligence, and perform feature fusion to improve the semantic feature expression of the threat intelligence knowledge graph and the knowledge reasoning and analysis capabilities of the large security model.

10. The network false threat intelligence intelligent analysis system of a security large model according to claim 6 is characterized by: The intelligence identification module generates false threat intelligence, sandbox environment simulation and false threat intelligence detection through a large security model.

Images