Threat intelligence processing method and device, equipment and medium

Abstract

The invention discloses a threat intelligence processing method and device, equipment and a medium, and relates to the technical field of threat intelligence processing, and the method comprises the steps: determining the intelligence accuracy of an intelligence source to which to-be-processed threat intelligence belongs according to first identification information, second identification information and third identification information; determining available processing duration of the threat intelligence to be processed according to the receiving time and the occurrence time; according to the first threat parameter and the third threat parameter, determining a credibility rate of the threat intelligence to be processed; according to a second threat parameter of a known threat, a threat attack parameter of the known threat and the first threat parameter in a threat database, determining a target correlation rate between the to-be-processed threat intelligence and the known threat; and judging whether to process the threat intelligence to be processed or not according to the intelligence accuracy, the available processing duration, the credibility rate and the target correlation rate. According to the method, the threat intelligence can be filtered, so that the number of threat intelligence needing to be processed is reduced, and the processing efficiency of batch threat intelligence is improved.

Description

Technical Field

[0001] The present invention relates to the field of threat intelligence processing technology, and in particular to a method, device, equipment and medium for processing threat intelligence. Background Art

[0002] At present, the power grid sector is facing increasingly severe network security challenges. In particular, with the accelerated construction of new energy systems, the access of numerous new energy power stations and third-party market players has greatly increased the complexity of the network environment and the risk exposure, resulting in frequent network security incidents in the power grid system and the continuous emergence of new vulnerabilities, which directly impact the network security and business continuity of the power grid.

[0003] However, the existing technology needs to obtain a large amount of threat intelligence from multiple intelligence sources and analyze each threat intelligence, resulting in a long waiting time for obtaining the analysis results of a large amount of threat intelligence, which in turn makes it impossible for technical personnel to handle the threat events that are about to occur in a timely manner. Summary of the invention

[0004] The present invention provides a method, device, equipment and medium for processing threat intelligence to filter threat intelligence, thereby improving the processing efficiency of threat intelligence.

[0005] In a first aspect, the present invention provides a method for processing threat intelligence, comprising:

[0006] Obtain a first threat parameter in the threat intelligence to be processed, a time when the threat intelligence to be processed is received, a time when a threat event corresponding to the threat intelligence to be processed occurs, first identification information of an intelligence source to which the threat intelligence to be processed belongs, second identification information of an intelligence source to which historical threat intelligence belongs, third identification information of an intelligence source to which historical accurate intelligence belongs, second threat parameters of known threats in a threat database, threat attack parameters of known threats, and third threat parameters recorded in a power system operation log;

[0007] Determine, based on the first identification information, the second identification information, and the third identification information, the intelligence accuracy rate of the intelligence source to which the threat intelligence to be processed belongs;

[0008] Determine the available processing time of the threat intelligence to be processed based on the time of receipt and the time of occurrence;

[0009] Determining the credibility rate of the threat intelligence to be processed according to the first threat parameter and the third threat parameter;

[0010] Determine a target correlation rate between the threat intelligence to be processed and the known threat according to a second threat parameter of the known threat in the threat database, a threat attack parameter of the known threat, and a first threat parameter;

[0011] Determine whether to process the threat intelligence based on the intelligence accuracy, available processing time, credibility, and target relevance.

[0012] In a second aspect, the present invention further provides a threat intelligence processing device, comprising:

[0013] A parameter acquisition module is used to obtain a first threat parameter in the threat intelligence to be processed, a time when the threat intelligence to be processed is received, a time when a threat event corresponding to the threat intelligence to be processed occurs, first identification information of an intelligence source to which the threat intelligence to be processed belongs, second identification information of an intelligence source to which historical threat intelligence belongs, third identification information of an intelligence source to which historical accurate intelligence belongs, second threat parameters of known threats in a threat database, threat attack parameters of known threats, and third threat parameters recorded in a power system operation log;

[0014] An accuracy determination module, used to determine the intelligence accuracy of the intelligence source to which the threat intelligence to be processed belongs according to the first identification information, the second identification information and the third identification information;

[0015] A duration determination module is used to determine the available processing duration of the threat intelligence to be processed based on the receiving time and the occurrence time;

[0016] A credibility rate determination module, used to determine the credibility rate of the threat intelligence to be processed according to the first threat parameter and the third threat parameter;

[0017] A correlation rate determination module, used to determine a target correlation rate between the threat intelligence to be processed and the known threat according to a second threat parameter of the known threat in the threat database, a threat attack parameter of the known threat, and a first threat parameter;

[0018] The processing judgment module is used to determine whether to process the threat intelligence to be processed based on the intelligence accuracy, available processing time, credibility and target relevance.

[0019] In a third aspect, an embodiment of the present invention further provides an electronic device, including:

[0020] at least one processor; and

[0021] a memory communicatively coupled to at least one processor; wherein

[0022] The memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor so that the at least one processor can execute the threat intelligence processing method provided by any embodiment of the present invention.

[0023] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement a method for processing threat intelligence of any embodiment of the present invention when executed.

[0024] The embodiments of the present invention can respectively determine the intelligence accuracy, available processing time, credibility and target relevance of the threat intelligence to be processed; and then comprehensively judge whether to process the threat intelligence to be processed based on the intelligence accuracy, available processing time, credibility and target relevance of the threat intelligence to be processed, thereby filtering out the threat intelligence to be processed with a lower effectiveness, reducing the amount of threat intelligence to be processed, and improving the processing efficiency of processing a large amount of threat intelligence to be processed.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 is a flowchart of a method for processing threat intelligence provided according to Embodiment 1 of the present invention;

[0028] Figure 2 is a flowchart of a method for processing threat intelligence provided according to Embodiment 2 of the present invention;

[0029] Figure 3 It is a structural diagram of a threat intelligence processing device provided according to Embodiment 3 of the present invention;

[0030] Figure 4 It is a structural schematic diagram of an electronic device for implementing the threat intelligence processing method of an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", "third" and "fourth" etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] In the technical solution of the embodiment of the present invention, the acquisition, storage and application of the first threat parameter in the threat intelligence to be processed and the time of receiving the threat intelligence to be processed, etc., all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0034] Embodiment 1

[0035] Figure 1 A flowchart of a method for processing threat intelligence provided in Embodiment 1 of the present invention. This embodiment can be applied to situations where it is determined whether to process threat intelligence. The method can be executed by a threat intelligence processing device, which can be implemented in the form of hardware and / or software and specifically configured in an electronic device, such as a server.

[0036] See also Figure 1 The threat intelligence processing methods shown include:

[0037] S101. Obtain the first threat parameter in the threat intelligence to be processed, the time of receiving the threat intelligence to be processed, the time of occurrence of the threat event corresponding to the threat intelligence to be processed, the first identification information of the intelligence source to which the threat intelligence to be processed belongs, the second identification information of the intelligence source to which the historical threat intelligence belongs, the third identification information of the intelligence source to which the historical accurate intelligence belongs, the second threat parameter of the known threat in the threat database, the threat attack parameter of the known threat, and the third threat parameter recorded in the power system operation log.

[0038] In this embodiment, the threat intelligence to be processed may be threat intelligence that needs to be determined whether it needs to be processed. The threat intelligence may include, but is not limited to, information about potential attack threats that the power system may face, that is, information about threat events. The data format of the threat intelligence to be processed may be JSON (JavaScript Object Notation), CSV (Comma-Separated Values), STIX (Structured Threat Information Expression), and TAXII (Trusted Automated Exchange of Indicator Information) and other formats.

[0039] The first threat parameter is the threat parameter in the threat intelligence to be processed. The threat parameter may include but is not limited to malicious IP (internet protocol) addresses, malicious domain names, malicious file hash values, registry keys, malicious scripts or macros, etc. The present invention does not limit the specific type of the first threat parameter. Historical threat intelligence may be threat intelligence whose reception time is before the reception time of the threat intelligence to be processed. Historical accurate intelligence may be historical threat intelligence in which a corresponding threat event has occurred; correspondingly, historical threat intelligence may also include historical error intelligence, and historical error intelligence may be historical threat intelligence in which a corresponding threat event has not occurred. The intelligence source may be the data source for sending threat intelligence. The first identification information may be used to identify the intelligence source to which the threat intelligence to be processed belongs; the second identification information may be used to identify the intelligence source to which the historical threat intelligence belongs; and the third identification information may be used to identify the intelligence source to which the historical accurate intelligence belongs.

[0040] The threat database may be a database for storing third threat parameters and threat attack parameters of known threats. A known threat may be a threat for which specific information has been obtained. The second threat parameter is the threat parameter of the known threat. The third threat parameter may be a threat parameter recorded in the power system operation log.

[0041] The receiving time may be the time when the electronic device deployed with the threat intelligence processing method provided by the embodiment of the present invention receives the threat intelligence to be processed. The occurrence time may be the time when the threat event corresponding to the threat intelligence to be processed occurs. In an optional embodiment, the threat occurrence time prediction model can be used to predict the occurrence time of the threat event corresponding to the threat intelligence to be processed according to the first threat parameter of the threat intelligence to be processed, so as to obtain the occurrence time of the threat event corresponding to the threat intelligence to be processed. In a specific implementation, the threat occurrence time prediction model can be obtained by training the occurrence time of historical threat intelligence and the threat parameters of historical threat intelligence; the threat occurrence time prediction model is a time series analysis model, for example, it can be an ARIMA model (Autoregressive Integrated Moving Average Model).

[0042] S102: Determine the intelligence accuracy rate of the intelligence source to which the threat intelligence to be processed belongs based on the first identification information, the second identification information, and the third identification information.

[0043] In this embodiment, the intelligence accuracy rate can be used to characterize the accuracy rate of the threat intelligence provided by the intelligence source to which the threat intelligence to be processed belongs; the higher the intelligence accuracy rate, the greater the possibility of the threat event corresponding to the threat intelligence provided by the intelligence source; the higher the intelligence accuracy rate, the smaller the possibility of the threat event corresponding to the threat intelligence provided by the intelligence source.

[0044] Specifically, a certain algorithm is used to determine the intelligence accuracy rate of the intelligence source to which the threat intelligence to be processed belongs according to the first identification information, the second identification information, and the third identification information.

[0045] Optionally, the intelligence accuracy rate of the intelligence source to which the threat intelligence to be processed belongs is determined based on the identification information of the intelligence source to which the threat intelligence to be processed belongs, the identification information of the intelligence source to which the historical threat intelligence belongs, and the identification information of the intelligence source to which the historical accurate intelligence belongs, including: based on the identification information of the intelligence source to which the threat intelligence to be processed belongs, counting a first number of historical threat intelligence whose intelligence source is the same as the intelligence source to which the threat intelligence to be processed belongs in the identification information of the intelligence source to which the historical threat intelligence belongs; based on the identification information of the intelligence source to which the threat intelligence to be processed belongs, counting a second number of historical accurate intelligence whose intelligence source is the same as the intelligence source to which the threat intelligence to be processed belongs in the identification information of the intelligence source to which the historical accurate intelligence belongs; and determining the intelligence accuracy rate of the intelligence source to which the threat intelligence to be processed belongs based on the first number and the second number.

[0046] Specifically, search for historical threat intelligence whose identification information is the same as the identification information of the intelligence source to which the threat intelligence to be processed belongs, and count the number of historical threat intelligence found; determine the number obtained by counting as the first number; search for historical accurate intelligence whose identification information is the same as the identification information of the intelligence source to which the threat intelligence to be processed belongs, and count the number of historical accurate intelligence found; determine the number obtained by counting as the second number; calculate the ratio between the second number and the first number, and determine the calculated ratio as the intelligence accuracy rate.

[0047] It can be understood that by adopting the above technical solution, a first number of historical threat intelligence whose intelligence source is the same as the intelligence source to which the threat intelligence to be processed belongs can be counted, and a second number of historical accurate intelligence whose intelligence source is the same as the intelligence source to which the threat intelligence to be processed belongs can be counted; based on the first number and the second number, the intelligence accuracy of the intelligence source to which the threat intelligence to be processed belongs can be determined, and an intelligence accuracy rate with a higher correctness rate can be obtained.

[0048] S103: Determine the available processing time of the threat intelligence to be processed according to the receiving time and the generating time.

[0049] In this embodiment, the available processing time may be the time available for processing the threat intelligence to be processed after the threat intelligence to be processed is received and before the threat event corresponding to the threat intelligence to be processed occurs. Specifically, a certain algorithm is used to determine the available processing time of the threat intelligence to be processed according to the receiving time and the occurrence time.

[0050] Optionally, determining the available processing time of the threat intelligence to be processed based on the receiving time and the occurrence time includes: calculating the time between the receiving time and the occurrence time, and determining the calculated time as the available processing time of the threat intelligence to be processed.

[0051] It can be understood that by adopting the above technical solution, the duration between the receiving time and the occurrence time is calculated, and the calculated duration is determined as the available processing time of the threat intelligence to be processed, thereby improving the accuracy of the available processing time.

[0052] S104: Determine the credibility of the threat intelligence to be processed according to the first threat parameter and the third threat parameter.

[0053] In this embodiment, the credibility rate can be used to characterize the authenticity of the threat intelligence to be processed; the higher the credibility rate, the greater the probability of the threat event corresponding to the threat intelligence to be processed; the lower the credibility rate, the smaller the probability of the threat event corresponding to the threat intelligence to be processed. Specifically, a certain algorithm is used to determine the credibility rate of the threat intelligence to be processed according to the first threat parameter and the third threat parameter.

[0054] Optionally, the number of first threat parameters is at least one; the number of third threat parameters is at least one: based on the first threat parameters and the third threat parameters, determining the credibility rate of the threat intelligence to be processed, including: for each first threat parameter, searching the third threat parameters for a third threat parameter that is the same as the first threat parameter, and determining the found third threat parameter as the threat evidence corresponding to the first threat parameter; counting the number of threat evidences corresponding to the first threat parameter; and determining the credibility rate of the threat intelligence to be processed based on the number of threat evidences corresponding to each first threat parameter.

[0055] Among them, the threat evidence can be a third threat parameter recorded in the power system operation log that is the same as the first threat parameter of the threat intelligence to be processed. Specifically, for each first threat parameter, find the third threat parameter that is the same as the first threat parameter, and determine the third threat parameter found as the threat evidence corresponding to the first threat parameter; count the number of threat evidences corresponding to the first threat parameter; calculate the total number of threat evidences corresponding to each first threat parameter; multiply the calculated total number by the credibility coefficient to obtain the credibility of the threat intelligence to be processed. Exemplarily, the first threat parameter of the threat intelligence to be processed includes malicious IP address A, malicious domain name B and malicious file hash value C; then, in each malicious IP address recorded in the power system operation log, query the number of malicious IP address A; in each malicious domain name recorded in the power system operation log, query the number of malicious domain name B; in each malicious file hash value recorded in the power system operation log, query the number of malicious file hash value C; according to the number of malicious IP addresses A, the number of malicious domain names B and the number of malicious file hash values ​​C found in the power system operation log, determine the credibility of the threat intelligence to be processed.

[0056] It can be understood that, by adopting the above technical solution, for each first threat parameter, a third threat parameter that is the same as the first threat parameter is searched in the third threat parameters, and the found third threat parameter is determined as the threat evidence corresponding to the first threat parameter; the number of threat evidences corresponding to the first threat parameter is counted; and the credibility rate of the threat intelligence to be processed is determined based on the number of threat evidences corresponding to each first threat parameter, thereby improving the accuracy of the determined credibility rate.

[0057] S105: Determine a target correlation rate between the threat intelligence to be processed and the known threat according to the second threat parameter of the known threat in the threat database, the threat attack parameter of the known threat, and the first threat parameter.

[0058] In this embodiment, the target correlation rate can characterize the degree of correlation between the threat events corresponding to the threat intelligence to be processed and the threat events of the known threats; specifically, a certain algorithm is used to determine the target correlation rate between the threat intelligence to be processed and the known threats based on the second threat parameters of the known threats in the threat database, the threat attack parameters of the known threats, and the first threat parameters.

[0059] S106. Determine whether to process the threat intelligence to be processed based on the intelligence accuracy, available processing time, credibility, and target relevance.

[0060] Specifically, a certain algorithm is used to determine a target correlation rate between the threat intelligence to be processed and the known threat according to the second threat parameter of the known threat in the threat database, the threat attack parameter of the known threat, and the first threat parameter.

[0061] The embodiments of the present invention can respectively determine the intelligence accuracy, available processing time, credibility and target relevance of the threat intelligence to be processed; and then comprehensively judge whether to process the threat intelligence to be processed based on the intelligence accuracy, available processing time, credibility and target relevance of the threat intelligence to be processed, thereby filtering out the threat intelligence to be processed with a lower effectiveness, reducing the amount of threat intelligence to be processed, and improving the processing efficiency of processing a large amount of threat intelligence to be processed.

[0062] Embodiment 2

[0063] Figure 2 This is a flowchart of a method for processing threat intelligence provided by Embodiment 2 of the present invention. Based on the technical solutions of the above embodiments, this embodiment of the present invention optimizes and improves the operation of determining the correlation rate.

[0064] Furthermore, "determining the correlation rate between the threat intelligence to be processed and the known threats based on the second threat parameters of the known threats in the threat database, the threat attack parameters of the known threats and the first threat parameters" is refined into "identifying the target attack parameters of the threat intelligence to be processed based on the first threat parameters through the attack parameter identification model; searching for known threats matching the threat intelligence to be processed based on the second threat parameters and the first threat parameters of each known threat; determining the target correlation rate between the threat intelligence to be processed and the matching known threats based on the threat attack parameters and the target attack parameters of the matching known threats" to improve the determination operation of the target conflict detection results.

[0065] It should be noted that, for the parts not described in detail in the embodiments of the present invention, reference may be made to the descriptions in the aforementioned embodiments.

[0066] See also Figure 2 The threat intelligence processing methods shown include:

[0067] S201. Obtain the first threat parameter in the threat intelligence to be processed, the time of receiving the threat intelligence to be processed, the time of occurrence of the threat event corresponding to the threat intelligence to be processed, the first identification information of the intelligence source to which the threat intelligence to be processed belongs, the second identification information of the intelligence source to which the historical threat intelligence belongs, the third identification information of the intelligence source to which the historical accurate intelligence belongs, the second threat parameter of the known threat in the threat database, the threat attack parameter of the known threat, and the third threat parameter recorded in the power system operation log.

[0068] S202: Determine the intelligence accuracy rate of the intelligence source to which the threat intelligence to be processed belongs based on the first identification information, the second identification information, and the third identification information.

[0069] S203: Determine the available processing time of the threat intelligence to be processed according to the receiving time and the generating time.

[0070] S204: Determine the credibility of the threat intelligence to be processed according to the first threat parameter and the third threat parameter.

[0071] S205: Identify target attack parameters of the threat intelligence to be processed according to the first threat parameter through an attack parameter identification model.

[0072] In this embodiment, the target attack parameters may refer to the attack parameters of the threat event corresponding to the threat intelligence to be processed that launches an attack on the power system. Attack parameters may include but are not limited to attack techniques, attack tools, and attack methods. Attack techniques may refer to the techniques used by the threat party to launch an attack on the power system; attack tools may refer to the tools used by the threat party to launch an attack on the power system. The attack parameter identification model may be a deep learning model for identifying the target attack parameters of threat intelligence. In an optional embodiment, the attack parameter identification model can be obtained by training the threat eucalyptus of historical threat intelligence and the attack parameters of the threat events corresponding to the historical threat intelligence.

[0073] S206: Search for a known threat that matches the threat intelligence to be processed according to the second threat parameter and the first threat parameter of each known threat.

[0074] Specifically, among the known threats, a known threat whose second threat parameter is the same as the first threat parameter is searched, and the found threat is determined as the known threat that matches the threat intelligence to be processed.

[0075] S207: Determine a target correlation rate between the threat intelligence to be processed and the matched known threat according to the threat attack parameters and the target attack parameters of the matched known threat.

[0076] Specifically, a certain algorithm is used to determine the target correlation rate between the threat intelligence to be processed and the matched known threat according to the threat attack parameters and target attack parameters of the matched known threat.

[0077] Optionally, the threat attack parameters are attack parameters of known threats; the target attack parameters are attack parameters of threat intelligence to be processed; the attack parameters include attack technology, attack method and attack tool; according to the threat attack parameters and target attack parameters of the matched known threats, the target correlation rate between the threat intelligence to be processed and the matched known threats is determined, including: calculating a first correlation rate between the attack technology of the matched known threats and the attack technology of the threat intelligence to be processed; calculating a second correlation rate between the attack method of the matched known threats and the attack method of the threat intelligence to be processed; calculating a third correlation rate between the attack tool of the matched known threats and the attack tool of the threat intelligence to be processed; and determining the target correlation rate between the threat intelligence to be processed and the matched known threats according to the first correlation rate, the second correlation rate and the third correlation rate.

[0078] Specifically, a set data conversion algorithm may be used to convert the attack technology, attack method, and attack tool in the threat attack parameter and the attack technology, attack method, and attack tool in the target attack parameter into corresponding values, respectively; the Pearson correlation coefficient method is used to calculate the correlation rate between the attack technology value of the matched known threat and the attack technology value of the threat intelligence to be processed, and the calculated correlation rate is determined as the first correlation rate;

[0079] The Pearson correlation coefficient method is used to calculate the correlation rate between the numerical value of the attack technology of the matched known threat and the numerical value of the attack technology of the threat intelligence to be processed, and the calculated correlation rate is determined as the first correlation rate; the Pearson correlation coefficient method is used to calculate the correlation rate between the numerical value of the attack tool of the matched known threat and the numerical value of the attack tool of the threat intelligence to be processed, and the calculated correlation rate is determined as the second correlation rate; the Pearson correlation coefficient method is used to calculate the correlation rate between the numerical value of the attack mode of the matched known threat and the numerical value of the attack mode of the threat intelligence to be processed, and the calculated correlation rate is determined as the third correlation rate; the average of the first correlation rate, the second correlation rate and the third correlation rate is determined as the target correlation rate between the threat intelligence to be processed and the matched known threat.

[0080] It can be understood that, by adopting the above technical scheme, by calculating the first correlation rate between the attack technology of the matched known threat and the attack technology of the threat intelligence to be processed; calculating the second correlation rate between the attack method of the matched known threat and the attack method of the threat intelligence to be processed; calculating the third correlation rate between the attack tool of the matched known threat and the attack tool of the threat intelligence to be processed; and determining the target correlation rate between the threat intelligence to be processed and the matched known threat based on the first correlation rate, the second correlation rate and the third correlation rate, the accuracy of the target correlation rate between the threat intelligence to be processed and the matched known threat is improved.

[0081] S208. Determine whether to process the threat intelligence to be processed based on the intelligence accuracy, available processing time, credibility, and target relevance.

[0082] Optionally, judging whether to process the threat intelligence to be processed is performed based on the intelligence accuracy, available processing time, credibility and relevance, including: taking a weighted sum of the intelligence accuracy, available processing time, credibility and target relevance to obtain an effective value of the threat intelligence to be processed; judging whether to process the threat intelligence to be processed based on the effective value of the threat intelligence to be processed.

[0083] Specifically, the intelligence accuracy rate, the available processing time, the credibility rate, and the target relevance rate may be weighted and summed to obtain the effective value of the threat intelligence to be processed. Exemplarily, the effective value of the threat intelligence to be processed may be expressed by the following formula:

[0084] Y=ax 1 +bx 2 +cx 3 +d(1-x 4 );

[0085] Among them, Y represents the effective value; a represents the intelligence accuracy weight; x 1 represents the accuracy of intelligence; b represents the credibility weight; x 2 represents the credibility rate; c represents the target relevance weight; x 3 represents the target relevance rate; d represents the available processing time weight; x 4 Indicates the available processing time.

[0086] If the effective value of the threat intelligence to be processed is greater than or equal to the set threshold, it is determined that the threat intelligence to be processed needs to be processed; if the effective value of the threat intelligence to be processed is less than the set threshold, it is determined that the threat intelligence to be processed does not need to be processed.

[0087] It can be understood that by adopting the above technical solution, the intelligence accuracy, available processing time, credibility and target relevance rate can be weighted and summed to obtain the effective value of the threat intelligence to be processed; based on the effective value of the threat intelligence to be processed, it is judged whether to process the threat intelligence to be processed, thereby improving the accuracy of judging whether the threat intelligence to be processed needs to be processed.

[0088] In an optional embodiment, the threat intelligence to be processed that is finally determined to be required to be processed can be determined as the target threat intelligence; a visualization tool is used to visualize each target threat intelligence and integrate it into a unified view to facilitate analysis and processing of each target threat intelligence; the visualization tool may include but is not limited to chart tools, graphic tools, and dashboard tools.

[0089] In an optional embodiment, a time view of the threat event corresponding to the threat intelligence to be processed may also be generated based on the reception time and the occurrence time, so that the technical personnel can understand the evolution process of the threat.

[0090] In an optional embodiment, the geographical location information of the attacked power equipment of the threat event corresponding to the target threat intelligence can also be analyzed to visualize the affected geographical area and other information on a map.

[0091] In an optional embodiment, the threat database may periodically notify technicians to update the data in the threat database; users may update the data in the threat database by manual input, manual upload, or using removable media; the threat database may export or share threat parameters, etc. with technicians of power grid systems in other regions.

[0092] In an optional embodiment, the number of threat intelligence to be processed may be at least one. Before determining the intelligence accuracy of the intelligence source to which the threat intelligence to be processed belongs based on the first identification information, the second identification information, and the third identification information, data cleaning may be performed on the information recorded in each threat intelligence to be processed, and the threat intelligence to be processed may be updated based on the cleaning result.

[0093] In an optional embodiment, the IP domain name intelligence in the threat intelligence to be processed can be matched against a blacklist database; wherein, the blacklist database stores at least one known malicious IP domain name, and a search is conducted in the blacklist database to determine whether there is a malicious IP domain name that matches the IP domain name of the threat intelligence to be processed; if so, the IP domain name of the threat intelligence to be processed is determined to be malicious IP domain name intelligence, and the network traffic transmitted by the malicious IP domain name intelligence is identified, and an alarm is issued for the network traffic associated with the malicious IP domain name to prevent the power system from communicating with the malicious IP domain name.

[0094] In an optional embodiment, the assets and asset portraits corresponding to each pending threat intelligence can be compared to determine the pending threat intelligence of important-level assets. The asset portrait includes the asset level corresponding to the asset, and can determine the important-level assets, thereby determining the threat intelligence information of the important-level assets, and determining the threat intelligence information as high-risk asset threat intelligence. The asset portrait includes assets and asset levels, and the asset levels include low, medium, and high.

[0095] In an optional embodiment, malicious file information and malware information in the threat intelligence to be processed may be analyzed, including detailed information such as malicious file samples, analysis reports, malicious file behaviors, etc. The power grid system determines whether the file being transmitted over the network is a malicious file based on the threat intelligence to be processed; if it is determined to be a malicious file, an alarm is issued.

[0096] Furthermore, the malicious file information and malware information in the pending threat intelligence can be analyzed by database matching, and the matched file types include file strings, codes, digital signatures, etc. And record the attempts of malware to communicate with the outside as an analysis report, including DNS (Domain Name System) requests, HTTP (HyperText Transfer Protocol) / HTTPS (HyperText TransferProtocol Secure) traffic and C&C (Command and Control) server interactions. Check the system log, security log and application log to view the behavior of malicious files, such as registry modifications, process creation and destruction, and network connections.

[0097] The technical solution of the embodiment of the present invention can identify the target attack parameter of the threat intelligence to be processed according to the first threat parameter through the attack parameter identification model; search for known threats matching the threat intelligence to be processed according to the second threat parameter and the first threat parameter of each known threat; determine the target correlation rate between the threat intelligence to be processed and the matching known threats according to the threat attack parameters and the target attack parameters of the matching known threats, thereby improving the accuracy of the determined target correlation rate.

[0098] Embodiment 3

[0099] Figure 3 A schematic diagram of the structure of a threat intelligence processing device provided in Embodiment 3 of the present invention. This embodiment can be applied to determine whether to process threat intelligence, the device can execute a method for processing threat intelligence, the threat intelligence processing device can be implemented in the form of hardware and / or software, and the device can be configured in an electronic device, such as a server.

[0100] See also Figure 3 The threat intelligence processing device shown includes a parameter acquisition module 301, an accuracy determination module 302, a duration determination module 303, a credibility determination module 304, a correlation determination module and a processing judgment module 305, wherein:

[0101] The parameter acquisition module 301 is used to obtain the first threat parameter in the threat intelligence to be processed, the time of receiving the threat intelligence to be processed, the time of occurrence of the threat event corresponding to the threat intelligence to be processed, the first identification information of the intelligence source to which the threat intelligence to be processed belongs, the second identification information of the intelligence source to which the historical threat intelligence belongs, the third identification information of the intelligence source to which the historical accurate intelligence belongs, the second threat parameter of the known threat in the threat database, the threat attack parameter of the known threat, and the third threat parameter recorded in the power system operation log;

[0102] The accuracy determination module 302 is used to determine the intelligence accuracy of the intelligence source to which the threat intelligence to be processed belongs according to the first identification information, the second identification information and the third identification information;

[0103] The duration determination module 303 is used to determine the available processing duration of the threat intelligence to be processed according to the receiving time and the occurrence time;

[0104] A credibility determination module 304, configured to determine the credibility of the threat intelligence to be processed according to the first threat parameter and the third threat parameter;

[0105] A correlation rate determination module 305 is used to determine a target correlation rate between the threat intelligence to be processed and the known threat according to the second threat parameter of the known threat in the threat database, the threat attack parameter of the known threat, and the first threat parameter;

[0106] The processing judgment module 306 is used to judge whether to process the threat intelligence to be processed based on the intelligence accuracy, available processing time, credibility and target relevance.

[0107] The embodiments of the present invention can respectively determine the intelligence accuracy, available processing time, credibility and target relevance of the threat intelligence to be processed; and then comprehensively judge whether to process the threat intelligence to be processed based on the intelligence accuracy, available processing time, credibility and target relevance of the threat intelligence to be processed, thereby filtering out the threat intelligence to be processed with a lower effectiveness, reducing the amount of threat intelligence to be processed, and improving the processing efficiency of processing a large amount of threat intelligence to be processed.

[0108] Optionally, the accuracy determination module 302 includes:

[0109] A first quantity determination unit is used to count, based on the identification information of the intelligence source to which the threat intelligence to be processed belongs, a first quantity of historical threat intelligence whose intelligence source is the same as the intelligence source to which the threat intelligence to be processed belongs, in the identification information of the intelligence source to which the historical threat intelligence belongs;

[0110] A second quantity determination unit is used to count, based on the identification information of the intelligence source to which the threat intelligence to be processed belongs, a second quantity of historical accurate intelligence whose intelligence source is the same as the intelligence source to which the threat intelligence to be processed belongs in the identification information of the intelligence source to which the historical accurate intelligence belongs;

[0111] The accuracy determination unit is used to determine the intelligence accuracy of the intelligence source to which the threat intelligence to be processed belongs based on the first quantity and the second quantity.

[0112] Optionally, the duration determination module 303 includes:

[0113] The duration determination unit is used to calculate the duration between the receiving time and the occurrence time, and determine the calculated duration as the available processing duration of the threat intelligence to be processed.

[0114] Optionally, the number of the first threat parameter is at least one; the number of the third threat parameter is at least one:

[0115] The credibility rate determination module 304 includes:

[0116] a correct search unit, configured to search, for each first threat parameter, in the third threat parameters for a third threat parameter that is the same as the first threat parameter, and determine the found third threat parameter as threat evidence corresponding to the first threat parameter;

[0117] A quantity counting unit, used to count the quantity of threat evidence corresponding to the first threat parameter;

[0118] The credibility rate determination unit is used to determine the credibility rate of the threat intelligence to be processed according to the amount of threat evidence corresponding to each first threat parameter.

[0119] Optionally, the correlation rate determination module 305 includes:

[0120] A target parameter determination unit, configured to identify a target attack parameter of the threat intelligence to be processed according to the first threat parameter through an attack parameter identification model;

[0121] A known threat search unit, configured to search for a known threat matching the threat intelligence to be processed according to the second threat parameter and the first threat parameter of each known threat;

[0122] The correlation rate determination unit is used to determine a target correlation rate between the threat intelligence to be processed and the matched known threat according to the threat attack parameter and the target attack parameter of the matched known threat.

[0123] Optionally, the threat attack parameters are attack parameters of known threats; the target attack parameters are attack parameters of threat intelligence to be processed; the attack parameters include attack techniques, attack methods and attack tools;

[0124] The correlation rate determination unit is specifically used for:

[0125] Calculate a first correlation rate between the attack technology of the matched known threat and the attack technology of the threat intelligence to be processed;

[0126] Calculating a second correlation rate between the attack method of the matched known threat and the attack method of the threat intelligence to be processed;

[0127] Calculating a third correlation rate between the attack tools of the matched known threats and the attack tools of the threat intelligence to be processed;

[0128] A target correlation rate between the threat intelligence to be processed and the matching known threats is determined according to the first correlation rate, the second correlation rate, and the third correlation rate.

[0129] Optionally, the processing and judgment module includes:

[0130] An effective value determination unit is used to perform a weighted summation of intelligence accuracy, available processing time, credibility, and target relevance to obtain an effective value of the threat intelligence to be processed;

[0131] The judgment unit is used to judge whether to process the threat intelligence to be processed according to the effective value of the threat intelligence to be processed.

[0132] The threat intelligence processing device provided in the embodiment of the present invention can execute the threat intelligence processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the threat intelligence processing method.

[0133] Embodiment 4

[0134] Figure 4 A schematic diagram of the structure of an electronic device 400 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0135] like Figure 4As shown, the electronic device 400 includes at least one processor 401, and a memory connected to the at least one processor 401 in communication, such as a read-only memory (ROM) 402, a random access memory (RAM) 403, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 401 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 402 or the computer program loaded from the storage unit 408 to the random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the electronic device 400 can also be stored. The processor 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0136] Multiple components in the electronic device 400 are connected to the I / O interface 405, including: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a disk, an optical disk, etc.; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the electronic device 400 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0137] Processor 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of processor 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. Processor 401 performs the various methods and processes described above, such as a method for processing threat intelligence.

[0138] In some embodiments, the method for processing threat intelligence may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 400 via the ROM 402 and / or the communication unit 409. When the computer program is loaded into the RAM 403 and executed by the processor 401, one or more steps of the method for processing threat intelligence described above may be performed. Alternatively, in other embodiments, the processor 401 may be configured to execute the method for processing threat intelligence in any other appropriate manner (e.g., by means of firmware).

[0139] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0140] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable threat intelligence processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flowchart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0141] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0142] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0143] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0144] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS (Virtual Private Server) services.

[0145] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0146] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing threat intelligence, characterized in that: The method comprises: Obtain a first threat parameter in the threat intelligence to be processed, a time of receiving the threat intelligence to be processed, a time of occurrence of a threat event corresponding to the threat intelligence to be processed, first identification information of an intelligence source to which the threat intelligence to be processed belongs, second identification information of an intelligence source to which historical threat intelligence belongs, third identification information of an intelligence source to which historical accurate intelligence belongs, a second threat parameter of a known threat in a threat database, a threat attack parameter of the known threat, and a third threat parameter recorded in a power system operation log; Determine, according to the first identification information, the second identification information, and the third identification information, the intelligence accuracy rate of the intelligence source to which the threat intelligence to be processed belongs; Determining, according to the receiving time and the occurrence time, an available processing time of the threat intelligence to be processed; Determining a credibility rate of the threat intelligence to be processed according to the first threat parameter and the third threat parameter; Determining a target correlation rate between the threat intelligence to be processed and the known threat according to a second threat parameter of the known threat in the threat database, a threat attack parameter of the known threat, and the first threat parameter; Whether to process the threat intelligence to be processed is determined according to the intelligence accuracy rate, the available processing time, the credibility rate, and the target relevance rate.

2. The method according to claim 1, characterized in that The determining, according to the identification information of the intelligence source to which the threat intelligence to be processed belongs, the identification information of the intelligence source to which the historical threat intelligence belongs, and the identification information of the intelligence source to which the historical accurate intelligence belongs, the intelligence accuracy rate of the intelligence source to which the threat intelligence to be processed belongs includes: According to the identification information of the intelligence source to which the threat intelligence to be processed belongs, counting a first quantity of historical threat intelligence whose intelligence source is the same as the intelligence source to which the threat intelligence to be processed belongs in the identification information of the intelligence source to which the historical threat intelligence belongs; According to the identification information of the intelligence source to which the threat intelligence to be processed belongs, a second number of historical accurate intelligences whose intelligence sources are the same as the intelligence source to which the threat intelligence to be processed belongs is counted in the identification information of the intelligence source to which the historical accurate intelligence belongs; The intelligence accuracy rate of the intelligence source to which the threat intelligence to be processed belongs is determined according to the first quantity and the second quantity.

3. The method according to claim 1, characterized in that The determining, according to the receiving time and the occurrence time, the available processing time of the threat intelligence to be processed includes: The duration between the receiving time and the occurrence time is calculated, and the calculated duration is determined as the available processing duration of the threat intelligence to be processed.

4. The method according to claim 1, characterized in that: The number of the first threat parameter is at least one; the number of the third threat parameter is at least one: The determining, according to the first threat parameter and the third threat parameter, a credibility rate of the threat intelligence to be processed includes: For each first threat parameter, searching the third threat parameters for a third threat parameter that is the same as the first threat parameter, and determining the found third threat parameter as threat evidence corresponding to the first threat parameter; Counting the number of threat evidences corresponding to the first threat parameter; The credibility rate of the threat intelligence to be processed is determined according to the quantity of threat evidence corresponding to each of the first threat parameters.

5. The method according to claim 1, characterized in that The determining, according to the second threat parameter of the known threat in the threat database, the threat attack parameter of the known threat, and the first threat parameter, a target correlation rate between the threat intelligence to be processed and the known threat, comprises: Identify target attack parameters of the threat intelligence to be processed according to the first threat parameter through an attack parameter identification model; According to the second threat parameter of each of the known threats and the first threat parameter, searching for a known threat that matches the threat intelligence to be processed; A target correlation rate between the to-be-processed threat intelligence and the matched known threat is determined according to the threat attack parameter of the matched known threat and the target attack parameter.

6. The method according to claim 5, characterized in that The threat attack parameters are the attack parameters of the known threat; the target attack parameters are the attack parameters of the threat intelligence to be processed; the attack parameters include attack techniques, attack methods and attack tools; The determining, according to the threat attack parameter of the matched known threat and the target attack parameter, a target correlation rate between the threat intelligence to be processed and the matched known threat, comprises: Calculating a first correlation rate between the attack technology of the matched known threat and the attack technology of the threat intelligence to be processed; Calculating a second correlation rate between the attack method of the matched known threat and the attack method of the threat intelligence to be processed; Calculating a third correlation rate between the attack tool of the matched known threat and the attack tool of the threat intelligence to be processed; A target correlation rate between the threat intelligence to be processed and the matched known threat is determined according to the first correlation rate, the second correlation rate, and the third correlation rate.

7. The method according to claim 1, characterized in that The determining whether to process the threat intelligence to be processed according to the intelligence accuracy rate, the available processing time, the credibility rate, and the target relevance rate includes: Performing a weighted summation on the intelligence accuracy rate, the available processing time, the credibility rate, and the target relevance rate to obtain an effective value of the threat intelligence to be processed; According to the effective value of the threat intelligence to be processed, it is determined whether to process the threat intelligence to be processed.

8. A threat intelligence processing device, characterized in that: The device comprises: A parameter acquisition module is used to obtain a first threat parameter in the threat intelligence to be processed, a time of receiving the threat intelligence to be processed, a time of occurrence of a threat event corresponding to the threat intelligence to be processed, first identification information of an intelligence source to which the threat intelligence to be processed belongs, second identification information of an intelligence source to which historical threat intelligence belongs, third identification information of an intelligence source to which historical accurate intelligence belongs, a second threat parameter of a known threat in a threat database, a threat attack parameter of the known threat, and a third threat parameter recorded in a power system operation log; An accuracy determination module, used to determine the intelligence accuracy of the intelligence source to which the threat intelligence to be processed belongs according to the first identification information, the second identification information and the third identification information; A duration determination module, used to determine the available processing duration of the threat intelligence to be processed according to the receiving time and the occurrence time; A credibility rate determination module, used to determine the credibility rate of the threat intelligence to be processed according to the first threat parameter and the third threat parameter; a correlation rate determination module, configured to determine a target correlation rate between the threat intelligence to be processed and the known threat according to a second threat parameter of the known threat in the threat database, a threat attack parameter of the known threat, and the first threat parameter; The processing judgment module is used to judge whether to process the threat intelligence to be processed according to the intelligence accuracy rate, the available processing time, the credibility rate and the target relevance rate.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the threat intelligence processing method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the threat intelligence processing method according to any one of claims 1 to 7 when executed.

Images