Security information acquisition, processing and disposal system

Abstract

The invention belongs to the technical field of data processing, and provides a safety information acquisition, processing and disposal system which comprises an information source module, an information rule module, an information acquisition module, an information processing module, an information disposal module, an information monitoring module, an information report module, an information algorithm analysis module and an information display module. According to the system, the information algorithm analysis module is arranged, so that the collected information can be analyzed more deeply, potential threats and risk levels in the information can be identified conveniently, a more accurate basis is provided for disposal, and the requirement of deeper analysis and assessment of information data proposed in the background technology is met; through automatic acquisition, processing, disposal and monitoring processes, comprehensive, timely and efficient discovery, disposal and management of the security vulnerability information are realized, the problems of single data source and only manual offline processing in the prior art are solved, and the processing efficiency and accuracy of the system on the security vulnerability information are improved.

Description

Technical Field

[0001] The invention belongs to the technical field of information security data processing, and in particular is a system for collecting, processing and disposing information security intelligence. Background Art

[0002] Security intelligence is an important tool for ensuring security. It involves all security information that affects system security behavior. Security intelligence is the "eyes, ears, and staff" of system security management, and is the premise and foundation for carrying out system security management work. It is designed to serve system security management and help organizations conduct security prediction activities, security decision-making activities, and security execution activities. Currently, most solutions in the industry are to publish security vulnerability intelligence information through public accounts or subscriptions, that is, there is only the part of security intelligence collection, and there are no related products for tracking and handling security vulnerability intelligence; this makes the current security intelligence management system have the following problems:

[0003] 1) The data source is relatively single, or only part of the data source is aggregated, but the data source is not effectively aggregated in combination with the enterprise characteristics;

[0004] 2) There is no security vulnerability intelligence tracking and handling, all of which are handled manually offline;

[0005] The above defects result in the current system being unable to comprehensively, timely and efficiently discover and handle security vulnerability intelligence, affecting the application effect of the system.

[0006] To this end, those skilled in the art have proposed a system for collecting, processing and disposing security intelligence to solve the problems raised by the background technology. Summary of the invention

[0007] In order to solve the above technical problems, the present invention provides a system for collecting, processing and handling security intelligence, comprising:

[0008] Intelligence source module, which is used to aggregate multiple intelligence sources according to business needs to ensure the comprehensiveness of security intelligence;

[0009] The intelligence rule module is used to customize the rules for different processing strategies according to the identification ID field of the intelligence source module; according to the customized intelligence processing rules, the collected intelligence is automatically processed to improve the processing efficiency;

[0010] The intelligence collection module is used to collect intelligence from intelligence sources according to the strategies customized by the intelligence source module;

[0011] The intelligence processing module is used to process the collected intelligence according to the rules customized by the intelligence rule module;

[0012] The intelligence processing module is used to display processed intelligence and support users to perform processing operations;

[0013] Intelligence monitoring module, used to monitor intelligence handling and issue alerts for unprocessed intelligence;

[0014] Intelligence report module, used to generate statistical reports to display data from intelligence collection, processing, disposal and other aspects;

[0015] Intelligence algorithm analysis module, used to perform algorithm analysis and judgment on monitored intelligence data;

[0016] The intelligence display module is used to display intelligence data.

[0017] Preferably, the specific working steps of the intelligence collection module are: reading the "intelligence source module" field, customizing the reading and parsing of the "intelligence source URL" results with different IDs according to the "intelligence source identification ID", and storing the collection results.

[0018] Preferably, the specific working steps of the intelligence processing module are: processing the data of the "intelligence collection module" using the data rules of the "intelligence rule module" and obtaining the processed results, for example: marking each vulnerability information of the intelligence, such as what the "intelligence processing priority" is, whether the "default disposal behavior" is no need to pay attention, etc.

[0019] Preferably, the specific working steps of the processing of the intelligence processing module are:

[0020] First, the intelligence processing module obtains the collected data from the intelligence collection module; this data includes security intelligence information collected from multiple intelligence sources, which may include key contents such as vulnerability description, vulnerability level, impact scope, etc.

[0021] Next, the intelligence processing module processes the collected intelligence according to the data rules customized by the intelligence rule module; these rules may include intelligence classification standards, processing priorities, keyword filtering, etc., aiming to ensure the accuracy, pertinence and practicality of the intelligence;

[0022] During the processing, the intelligence processing module will conduct a detailed analysis of each piece of intelligence; according to the rules of the intelligence rule module, it will perform necessary screening, marking and sorting of intelligence; for example, it can classify intelligence according to different types of security vulnerabilities according to the rules, or set processing priorities according to the urgency and importance of intelligence; in addition, the intelligence processing module can also use the keyword filtering function to exclude intelligence information that is not related to current business needs, so as to improve the efficiency and accuracy of intelligence processing;

[0023] Finally, the intelligence processing module stores the processed results and prepares to pass them to the subsequent intelligence disposal module for display and further processing; the processed results may include a classified, sorted and marked intelligence list, as well as relevant processing suggestions and disposal measures;

[0024] Through such a processing flow, the intelligence processing module can ensure that the data obtained from the intelligence collection module is fully utilized and effectively processed, providing strong support for subsequent security vulnerability intelligence disposal.

[0025] Preferably, the specific working steps of the intelligence handling module are: classify the results of the "intelligence processing module" according to the intelligence source mark ID, sort the classified intelligence according to priority, handling behavior and intelligence collection time, and display them to users through the front-end web page. Users can update and mark relevant results. For example, if the processing behavior does not need to be paid attention to, it does not need to be processed, but this status can be modified manually to ensure that each piece of intelligence is processed and followed up in place, forming a closed-loop management to avoid omissions.

[0026] Preferably, the intelligence monitoring module specifically reads the intelligence processing identification ID of the "intelligence processing module", and then compares it with the intelligence disposal identification ID of the "intelligence disposal module" to check whether there is an intelligence processing identification ID to be processed, and performs related alarm reminder functions, such as alarming a certain intelligence processing update time and current time, and alarming intelligence that has not been followed up and disposed of according to the combination sorting of "disposal behavior", "priority", and "current time-intelligence processing update time" to ensure timely follow-up. When the intelligence monitoring module detects that the intelligence corresponding to the intelligence processing identification ID has not been processed, it will start the alarm reminder function, and once the intelligence is processed by the "intelligence disposal module", the corresponding intelligence disposal identification ID will be updated to the system. The intelligence monitoring module can detect that the intelligence has been processed by comparing the intelligence processing identification ID and the intelligence disposal identification ID regularly or in real time.

[0027] Preferably, the intelligence reporting module specifically refers to query statistics on intelligence sources, intelligence rules, intelligence collection, intelligence processing, intelligence disposal, intelligence monitoring, intelligence reporting and other modules, so as to facilitate users to understand the situations of each link such as intelligence collection, processing and disposal.

[0028] Preferably, the intelligence algorithm analysis module specifically performs algorithmic analysis on the monitored intelligence data, and its function is to analyze the authenticity of the data and determine the risk level, etc. It is composed of a data reading sub-module, a data classification sub-module, an algorithm analysis sub-module, an algorithm verification sub-module, a data display sub-module and an intelligence display sub-module.

[0029] Preferably, the data reading submodule reads the collected data content by calling a relational database or a non-relational database, and the reading of the data content is completed according to the data object;

[0030] The data classification submodule is used to classify data retrieved from a relational database or a non-relational database, and the classifications include remote exploitation, local extraction, and social engineering;

[0031] The algorithm analysis submodule uses the CVSS common vulnerability assessment system for assessment, classification and verification. The CVSS common vulnerability assessment system consists of the following parts:

[0032] Basic metric group: represents the intrinsic characteristics of the vulnerability, which does not change over time and user environment;

[0033] Time metric group: reflects the characteristics of vulnerabilities changing over time;

[0034] Environmental metrics group: represents vulnerability characteristics unique to the user environment;

[0035] The CVSS general vulnerability assessment system is formed by assessing the difficulty of exploitability and the size of the impact range. For example, if the exploitability of the acquired vulnerability is 10 points and the impact range is 10 points, the calculated intelligence level is 10 points. The sub-modules will sort the analyzed modules according to the intelligence level. After the sorting is completed, a data stack will be formed to complete the calculation and processing of the data.

[0036] The algorithm verification submodule uses the acquired vulnerability intelligence verification method to verify the intelligence content according to the current information system. After the verification is completed, an intelligence mark is formed, and the marked content is "affected" or "not affected". After the verification is completed, the data is stored in the database to complete the verification of the intelligence;

[0037] The data display submodule displays the threat intelligence, vulnerability intelligence verification results, and tactical data types obtained above;

[0038] The function of the intelligence display submodule is to form unified threat intelligence, and then display the data results using the web or client method. The display content can be rendered using the front end, etc. The threat intelligence in the data display submodule refers to the detailed information on system security vulnerabilities, potential threats, attack methods, etc. obtained after a series of processes such as intelligence collection, processing, and analysis.

[0039] Preferably, the intelligence display module is specifically described as follows: the data obtained by the algorithm analysis module is used to display the data in a unified manner, and the intelligence display method is displayed in the form of web, web client or other promotional posters. A large monitoring screen can be formed to complete the data display, and other methods such as text messages and emails can be used to notify the person in charge to carry out corresponding intelligence processing work.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1. By setting up an intelligence algorithm analysis module, the present invention can conduct a more in-depth analysis of the collected intelligence, facilitate the identification of potential threats and risk levels in the intelligence, provide a more accurate basis for disposal, and solve the need for a more in-depth analysis and evaluation of intelligence data proposed in the background technology.

[0042] 2. The present invention realizes the comprehensive, timely and efficient discovery, disposal and management of security vulnerability intelligence through automated collection, processing, disposal and monitoring processes, solves the problem of single data source and only manual offline processing in the prior art, and improves the system's processing efficiency and accuracy of security vulnerability intelligence.

[0043] 3. By setting up an intelligence display module, the present invention can display intelligence data in various forms, including web pages, web client, promotional posters, monitoring large screens, etc., so that users can intuitively understand and process security intelligence; at the same time, relevant persons in charge can also be notified by text messages, emails, etc. to ensure timely processing and response of intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a system framework diagram of the security intelligence collection, processing and disposal of the present invention;

[0045] Figure 2 This is a framework diagram of the intelligence algorithm analysis module of the present invention;

[0046] Figure 3 One of the data processing flow charts of the present invention;

[0047] Figure 4 This is the second data processing flow chart of the present invention;

[0048] Figure 5 This is the third data processing flow chart of the present invention.

[0049] In the figure:

[0050] 11. Intelligence source module; 12. Intelligence rule module; 13. Intelligence collection module; 14. Intelligence processing module; 15. Intelligence disposal module; 16. Intelligence monitoring module; 17. Intelligence report module; 18. Intelligence algorithm analysis module; 19. Intelligence display module;

[0051] 101. Data reading submodule; 102. Data classification submodule; 103. Algorithm analysis submodule; 104. Algorithm verification submodule; 105. Data display submodule; 106. Intelligence display submodule. DETAILED DESCRIPTION

[0052] The following embodiments of the present invention are described in further detail in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0053] Embodiment: The present invention provides a system for collecting, processing and handling security intelligence, including an intelligence source module 11, an intelligence rule module 12, an intelligence collection module 13, an intelligence processing module 14, an intelligence handling module 15, an intelligence monitoring module 16, an intelligence reporting module 17, an intelligence algorithm analysis module 18, and an intelligence display module 19. The intelligence source module 11, the intelligence rule module 12, the intelligence collection module 13, the intelligence processing module 14, the intelligence handling module 15, the intelligence monitoring module 16, the intelligence reporting module 17, the intelligence algorithm analysis module 18, and the intelligence display module 19 are electrically connected in sequence, such as Figure 1 shown.

[0054] Specifically, the intelligence source module 11: the source address of the collected data, the address can be added according to business needs, such as NVD, CVE, CNVD, special manufacturer vulnerabilities such as fastjson / nginx / wi ndow patch announcements, etc. The system process is: program initialization-》read the data source list-》collect vulnerability intelligence, such as Figure 4 As shown;

[0055] The intelligence source module 11 stores the following fields: intelligence source identification ID, intelligence source URL, intelligence source priority, and intelligence source update time.

[0056] Specifically, the intelligence rule module 12 customizes rules for different processing strategies according to the identification ID field of the intelligence source module 11;

[0057] Intelligence rule module 12 storage fields: intelligence rule identification ID, intelligence source identification ID, default disposal behavior, intelligence processing priority, keyword list, intelligence rule update time;

[0058] Intelligence rules module 12 includes:

[0059] Default handling behavior: divided into no need for attention, attention required, and pending confirmation;

[0060] Priority: Critical, high, medium, and low. These fields correspond to the vulnerability risk levels.

[0061] Keyword list: stores defined keywords and OR operations. Multiple keywords and operations can be stored in JSON format. For example, {{"operate":"or","key":"name=https: / / www.openwa ll.com / lists / oss-secur ity / "},{"operate":"and","key":"value=CWE-415"}} is stored. This indicates that as long as the intelligence source reads a vulnerability information, as long as the "OR" condition has "name=https: / / www.openwa ll.com / lists / oss-secur i ty / " corresponding to the security vulnerability released by the manufacturer, and the "and" condition has "value=CWE-415", the "default disposal behavior" is executed if both the OR and the specified conditions are met. If all conditions need to be met, the keyword list can be set to empty to achieve the default hit.

[0062] Specifically, the intelligence collection module 13: reads the "intelligence source module 11" field, customizes the reading and parsing of the "intelligence source URL" results with different IDs according to the "intelligence source identification ID", and stores the collection results;

[0063] Intelligence collection module 13 storage fields: intelligence collection identification ID, intelligence source identification ID, intelligence collection module 13 collection result list, intelligence collection update time;

[0064] The collection result list field stores the collection results, such as {{"result":"result json array"},…}.

[0065] Specifically, the intelligence processing module 14 processes the data of the "intelligence collection module 13" using the data rules of the "intelligence rule module 12" and obtains the processed results, such as marking each vulnerability information of the intelligence, such as what is the "intelligence processing priority", such as whether the "default disposal behavior" is no need to pay attention, etc.;

[0066] The intelligence processing module 14 storage fields: intelligence processing identification ID, intelligence collection identification ID, intelligence source identification ID, intelligence rule identification ID, intelligence processing module 14 result list, intelligence processing update time;

[0067] The result list of the intelligence processing module 14, such as {{"result":"result json array","handling behavior":"no need to pay attention","intelligence processing priority":"low"},...}.

[0068] Specifically, the intelligence handling module 15: classifies the results of the "intelligence processing module 14" by the intelligence source tag ID, sorts the classified intelligence by priority, handling behavior and intelligence collection time, and displays them to the user through the front-end web page. The user can update and mark the relevant results. For example, if the handling behavior does not need to be paid attention to, it does not need to be handled. However, this status can be modified manually to ensure that each piece of intelligence is handled and followed up in place to avoid omissions.

[0069] Intelligence processing module 15 storage fields: intelligence processing identification ID, intelligence processing identification ID, intelligence collection identification ID, intelligence source identification ID, intelligence rule identification ID, intelligence processing module 15 result list, intelligence processing update time;

[0070] Intelligence handling module 15 result list, such as {{"result":"result json array","handling behavior":"no need to pay attention","priority":"low"},...};

[0071] The disposal process includes:

[0072] (1) Processing content display logic:

[0073] 1) The intelligence processing results are classified by the intelligence source identification ID; for example, the intelligence processing results are {{intelligence processing result 1}, ..., {intelligence processing result n}}, where intelligence processing result n is {intelligence processing identification ID, intelligence collection identification ID, intelligence source identification ID, intelligence rule identification ID, intelligence processing module 14 result list, intelligence processing update time};

[0074] 2) Intelligence processing results n are sorted by priority, then by disposal behavior, and then by intelligence collection time;

[0075] (2) Disposal logic: Figure 3 As shown, the process is: program initialization-》set processing rules-》add or update rule base, that is, program initialization-》read intelligence processing result list L1-》L1 is classified into multiple lists LL1 according to intelligence source identification ID-》calculate the number of lists NL1 in list L1-》initialize list RL-》initialize NL1 lists in list RL-》loop read list LLLn in list LL1-》loop read intelligence records LLLLn in list LLLn-》.

[0076] More specifically, Figure 5As shown, it is the data processing rule flow, and its process is: program initialization -> read the rule base of the rule subsystem -> read the vulnerability intelligence data -> process the data source information; its effect is: by loading customized processing rules, the system can be guided to accurately and efficiently collect vulnerability intelligence data from a variety of intelligence sources, and the intelligence can be refined according to the rules to provide reliable data support for subsequent security intelligence disposal.

[0077] Specifically, the intelligence monitoring module 16: reads the intelligence processing identification ID of the "intelligence processing module 14", and then compares it with the intelligence processing identification ID of the "intelligence processing module 15" to check whether there is an intelligence processing identification ID to be processed, and performs related alarm reminder functions, such as alarming a certain intelligence processing update time and current time, and alarming intelligence that has not been followed up and handled according to the combination sorting of "handling behavior", "priority", and "current time-intelligence processing update time";

[0078] Intelligence monitoring module 16 storage fields: intelligence monitoring identification ID, intelligence collection identification ID, intelligence source identification ID, intelligence rule identification ID, intelligence processing module 14 result list, disposal status, intelligence monitoring update time;

[0079] The disposal status stage is divided into disposed and pending disposal.

[0080] Specifically, the intelligence report module 17 refers to query statistics on modules such as intelligence sources, intelligence rules, intelligence collection, intelligence processing, intelligence disposal, intelligence monitoring, and intelligence reports.

[0081] Specifically, the intelligence algorithm analysis module 18 performs algorithm analysis on the monitored intelligence data, and its function is to analyze the authenticity of the data and determine the risk level, etc. It consists of a data reading submodule 101, a data classification submodule 102, an algorithm analysis submodule 103, an algorithm verification submodule 104, a data display submodule 105 and an intelligence display submodule 106. The flow chart is as follows: Figure 2 As shown;

[0082] The data reading submodule 101 is used to read the collected data content by calling a relational database or a non-relational database, and the data content is read according to the data object;

[0083] A data classification submodule 102 is used to classify data retrieved from a relational database or a non-relational database, and the classifications include remote exploitation, local extraction, and social engineering;

[0084] The algorithm analysis submodule 103 uses the CVSS common vulnerability rating system for evaluation, classification and verification. The CVSS (Common Vulnerability Scoring System) is an open, measurable standard for evaluating the severity of security vulnerabilities in computer systems and applications. It provides a consistent and comparable vulnerability severity score for security professionals and managers by quantitatively analyzing different characteristics of the vulnerability (such as exploitability, impact range, etc.).

[0085] The CVSS scoring system consists of three main parts: the basic metric group, the time metric group, and the environmental metric group. The basic metric group mainly represents the inherent characteristics of the vulnerability, which will not change over time and the user environment; the time metric group reflects the characteristics of the vulnerability that change over time; and the environmental metric group takes into account the vulnerability characteristics that are unique to the user environment;

[0086] Basic metric group: represents the intrinsic characteristics of the vulnerability, which does not change over time and user environment;

[0087] Time metric group: reflects the characteristics of vulnerabilities changing over time;

[0088] Environmental metrics group: represents vulnerability characteristics unique to the user environment;

[0089] The CVSS general vulnerability assessment system is formed by assessing the difficulty of exploitability and the size of the impact range. For example, if the exploitability of the acquired vulnerability is 10 points and the impact range is 10 points, the calculated intelligence level is 10 points. The sub-modules will sort the analyzed modules according to the intelligence level. After the sorting is completed, a data stack will be formed to complete the calculation and processing of the data.

[0090] In the present invention, the intelligence algorithm analysis module uses the CVSS universal vulnerability assessment system to perform algorithm analysis on the monitored intelligence data, thereby evaluating the authenticity and risk level of the data, providing a more accurate basis for the disposal of security vulnerability intelligence;

[0091] The algorithm verification submodule 104 uses the acquired vulnerability intelligence verification method to verify the intelligence content according to the current information system, and forms an intelligence mark after the verification is completed, and the mark content is "affected" or "not affected". After the verification is completed, the data is stored in the database to complete the verification of the intelligence;

[0092] The data display submodule 105 displays the threat intelligence, vulnerability intelligence verification results, and tactical data types obtained above;

[0093] The intelligence display submodule 106 is used to form unified threat intelligence, and then display the data results using the web or client method. The display content can be rendered using the front end, etc.

[0094] From the above, it can be seen that by setting up the intelligence algorithm analysis module 18, the collected intelligence can be analyzed more deeply, which is convenient for identifying potential threats and risk levels in the intelligence, and providing a more accurate basis for disposal, so as to meet the needs of more in-depth analysis and evaluation of intelligence data.

[0095] Specifically, the intelligence display module 19 uses the data obtained by the intelligence algorithm analysis module 18 to display the data in a unified manner. The intelligence display method is a web or web client or other promotional poster form. It can also form a monitoring large screen to complete the data display. It can also use other methods such as text messages and emails to notify the person in charge and carry out corresponding intelligence processing work.

[0096] As can be seen from the above, by setting up the intelligence display module 19, the intelligence data can be displayed in a variety of forms, including web pages, web clients, promotional posters, monitoring large screens, etc., so that users can intuitively understand and process security intelligence; at the same time, relevant persons in charge can also be notified by text messages, emails, etc. to ensure timely processing and response of intelligence.

[0097] In summary, the system achieves comprehensive, timely and efficient discovery, disposal and management of security vulnerability intelligence through automated collection, processing, disposal and monitoring processes, solves the problem of single data source and only manual offline processing in existing technologies, and improves the system's processing efficiency and accuracy of security vulnerability intelligence.

[0098] The performance indicators of the existing method (i.e., manually monitoring whether there are problems of low processing efficiency and easy omission of security intelligence) and the security intelligence collection, processing and disposal system provided by this embodiment are compared, and the comparison results are shown in Table 1:

[0099] Table 1- Performance index comparison results

[0100] Existing methods This system Intelligence sources single comprehensive Real-time intelligence processing Unable to monitor in real time Automated real-time monitoring Human intervention required Dependence on manual labor No manual work required Display effect Display Single Diversified display Data processing omission rate 43.8％ 2.3％

[0101] It can be seen from Table 1 that compared with the existing system, the security intelligence collection, processing and disposal system provided by this embodiment has better results in terms of intelligence source, real-time intelligence processing, manual intervention requirements, display effect and data processing omission rate. This system can provide enterprises with a comprehensive, timely and efficient system for discovering and disposing of security vulnerability intelligence.

[0102] The embodiments of the present invention are provided for the purpose of illustration and description. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations of the present invention. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A system for collecting, processing and handling security intelligence, characterized in that: include: An intelligence source module (11), used to aggregate multiple intelligence sources according to business requirements and filter the intelligence source data; An intelligence rule module (12), used to customize rules for different processing strategies according to the identification ID field of the intelligence source module (11); An intelligence collection module (13), used for collecting intelligence from intelligence sources according to the strategy customized by the intelligence source module (11); An intelligence processing module (14) is used to process the collected intelligence according to the rules customized by the intelligence rule module (12); The intelligence processing module (15) is used to display the processed intelligence and support the user to perform processing operations; An intelligence monitoring module (16) is used to monitor the intelligence processing status and issue an alarm for unprocessed intelligence; Intelligence report module (17), used to generate statistical reports, showing data from each link of intelligence collection, processing and disposal; An intelligence algorithm analysis module (18), used for performing algorithm analysis and judgment on the monitored intelligence data; The intelligence display module (19) is used to display the acquired data in a unified manner.

2. A security intelligence collection, processing and disposal system as claimed in claim 1, characterized in that: The specific working steps of the intelligence collection module (13) are: reading the "intelligence source module (11)" field, customizing the reading and parsing of "intelligence source URL" results with different IDs according to the "intelligence source identification ID", and storing the collection results.

3. A security intelligence collection, processing and disposal system as claimed in claim 1, characterized in that: The specific working steps of the intelligence processing module (14) are: processing the data of the "intelligence collection module (13)" using the data rules of the "intelligence rule module (12)" and obtaining the processed results.

4. A security intelligence collection, processing and disposal system as claimed in claim 1, characterized in that: The specific working steps of the intelligence handling module (15) are as follows: the results of the "intelligence processing module (14)" are first classified according to the intelligence source mark ID, and the classified intelligence is sorted according to priority, handling behavior and intelligence collection time, and then displayed to the user through the front-end web page, and the user can update and mark the relevant results.

5. A security intelligence collection, processing and disposal system as claimed in claim 1, characterized in that: Specifically, the intelligence monitoring module (16) reads the intelligence processing identification ID of the "intelligence processing module (14)", and then compares it with the intelligence processing identification ID of the "intelligence processing module (15)".

6. A security intelligence collection, processing and disposal system as claimed in claim 1, characterized in that: Specifically, the intelligence reporting module (17) queries and statistics the intelligence source module (11), the intelligence rule module (12), the intelligence collection module (13), the intelligence processing module (14), the intelligence disposal module (15), the intelligence monitoring module (16), and the intelligence reporting module (17).

7. A security intelligence collection, processing and disposal system as claimed in claim 1, characterized in that: Specifically, the intelligence algorithm analysis module (18) performs algorithm analysis on the monitored intelligence data. The intelligence algorithm analysis module (18) is composed of a data reading submodule (101), a data classification submodule (102), an algorithm analysis submodule (103), an algorithm verification submodule (104), a data display submodule (105) and an intelligence display submodule (106).

8. A security intelligence collection, processing and disposal system as claimed in claim 1, characterized in that: The data reading submodule (101) is used to read the collected data content by calling a relational database or a non-relational database; The data classification submodule (102) is used to classify the data retrieved from the relational database and the non-relational database, and the classification includes remote exploitation, local extraction, and social engineering; An algorithm analysis submodule (103) is used to perform assessment classification and verification using the CVSS common vulnerability assessment system; The algorithm verification submodule (104) uses the acquired vulnerability intelligence verification method to verify the intelligence content according to the current information system, and after the verification is completed, an intelligence mark is formed, and the mark content is "affected" or "not affected". After the verification is completed, the data is stored in the database to complete the verification of the intelligence; A data display submodule (105) displays data based on the acquired threat intelligence, vulnerability intelligence verification results, and tactical data types; The intelligence display submodule (106) is used to form unified threat intelligence and then display the data results using the web and client methods. The display content can be rendered using the front end.

Images