Threat intelligence perception method and device, equipment and medium

Abstract

The invention discloses a threat intelligence perception method and device, equipment and a medium, and relates to the technical field of information security, and the method comprises the steps: constructing a network matrix according to the historical threat intelligence data of each node in a target network; performing iterative simulation on the network matrix by using a fast extended random tree algorithm to obtain attack paths in the network matrix and pheromones of nodes in the attack paths; based on the attack paths and the pheromones of the nodes, acquiring pheromone important values among the nodes, and storing threat feature samples and threat intelligence data links screened from the historical threat intelligence data and the attack paths according to the pheromone important values in a preset rule base; and collecting current traffic data of each node in the target network, and comparing the current traffic data with the threat feature sample and the threat intelligence data link so as to determine whether the current traffic data has a threat attack according to an obtained comparison result. Through the scheme, the efficiency of threat intelligence perception can be improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to threat intelligence perception methods, devices, equipment and media. Background Art

[0002] With the continuous advancement of information technology, information security issues are becoming more and more prominent. Real-time and rapid identification of attack sources has become a key point. However, at present, technical personnel analyze based on past experience and find attack paths associated with threat intelligence, which wastes a lot of manpower and material resources and cannot cope with complex and chaotic attack methods. In the face of a large amount of threat intelligence data, it is difficult to find the attack source in a short time, let alone determine whether there is a threatening attack in a short time.

[0003] In summary, how to improve the efficiency of threat intelligence perception is a problem to be solved in this field. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a threat intelligence perception method, device, equipment and medium to improve the efficiency of threat intelligence perception. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a threat intelligence perception method, comprising:

[0006] Build a network matrix based on the historical threat intelligence data of each node in the target network;

[0007] Iteratively simulating the network matrix using a rapidly expanding random tree algorithm to obtain each attack path in the network matrix and the pheromone of each node in the attack path;

[0008] Based on the attack path and the pheromone of the node, the pheromone importance value between each of the nodes is obtained, and the threat feature samples and threat intelligence data links respectively selected from the historical threat intelligence data and the attack path according to the pheromone importance value are stored in a preset rule library;

[0009] The current traffic data of each node in the target network is collected, and the current traffic data is compared with the threat feature samples and the threat intelligence data link stored in the preset rule base, so as to determine whether the current traffic data contains a threatening attack based on the comparison result.

[0010] Optionally, constructing a network matrix according to historical threat intelligence data of each node in the target network includes:

[0011] Use hard probes and soft probes deployed at each node in the target network to collect historical threat intelligence data, and perform redundant data cleaning on the historical threat intelligence data to obtain effective threat intelligence data;

[0012] A network matrix is ​​constructed according to the effective threat intelligence data; wherein the network matrix is ​​used to describe the connection relationship and data transmission path between each node.

[0013] Optionally, the iterative simulation of the network matrix using a rapidly expanding random tree algorithm to obtain each attack path in the network matrix and the pheromone of each node in the attack path includes:

[0014] The attack start node and the attack target node corresponding to the historical threat intelligence data in the network matrix are determined by using a rapidly expanding random tree algorithm, and each attack path between the attack start node and the attack target node and the pheromone of each node in the attack path are iteratively simulated in the target network.

[0015] Optionally, iteratively simulating each attack path between the attack start node and the attack target node in the target network includes:

[0016] Determining a current target node of the attack start node in the target network, and performing random sampling in the target network based on the current target node to obtain a current sampling node of the current target node;

[0017] If the current sampling node is not within the preset obstacle and the line between the new node of the current sampling node and the current existing node does not pass through the preset obstacle, the new node of the current sampling node is determined as the next target node of the current target node;

[0018] The next target node is updated to the current target node, and the step of randomly sampling the target network based on the current target node is jumped again until the next target node obtained is the attack target node, so as to obtain each attack path between the attack start node and the attack target node.

[0019] Optionally, the acquiring of pheromone importance values ​​between the nodes based on the attack path and the pheromone of the node, and storing threat feature samples and threat intelligence data links respectively screened from the historical threat intelligence data and the attack path according to the pheromone importance values ​​in a preset rule library, includes:

[0020] Inputting the attack path and the pheromone of the node into a preset pheromone calculation formula to obtain the pheromone importance value between each of the nodes;

[0021] Determine the average value of each pheromone importance value, and select key nodes whose pheromone importance value is greater than the average value from each node;

[0022] A two-dimensional matrix is ​​constructed based on the pheromone importance values ​​between the key nodes and the serial numbers of the key nodes, and whether there is a threat intelligence data element in the two-dimensional matrix is ​​analyzed. If so, the historical threat intelligence data corresponding to the key node is determined as a threat feature sample, and the attack path where the key node exists is determined as a threat intelligence data link;

[0023] The threat feature sample and the threat intelligence data link are stored in a preset rule library.

[0024] Optionally, the storing the threat feature sample and the threat intelligence data link in a preset rule library includes:

[0025] Collecting preset normal traffic data of each node in the target network; wherein the preset normal traffic data does not include threat intelligence data;

[0026] Acquire the characteristic sample of the preset normal traffic data, and remove the characteristics corresponding to the characteristic sample of the preset normal traffic data in the threat characteristic sample to obtain the target characteristic sample, and save the target characteristic sample and the threat intelligence data link in a preset rule library.

[0027] Optionally, determining whether the current traffic data contains a threatening attack according to the obtained comparison result includes:

[0028] If the comparison result obtained indicates that the current traffic data, the threat feature sample, and the threat intelligence data link meet the preset matching conditions, it is determined that there is a threatening attack in the current traffic data, and corresponding threat intelligence alarm processing is performed.

[0029] In a second aspect, the present application discloses a threat intelligence perception device, comprising:

[0030] A matrix building module is used to build a network matrix based on the historical threat intelligence data of each node in the target network;

[0031] An iterative simulation module, used for iteratively simulating the network matrix using a rapidly expanding random tree algorithm to obtain each attack path in the network matrix and the pheromone of each node in the attack path;

[0032] A data storage module, used for obtaining the pheromone importance value between each of the nodes based on the attack path and the pheromone of the node, and storing the threat feature samples and threat intelligence data links respectively screened from the historical threat intelligence data and the attack path according to the pheromone importance value in a preset rule library;

[0033] The threat perception module is used to collect the current traffic data of each node in the target network, and compare the current traffic data with the threat feature samples and the threat intelligence data link stored in the preset rule library, so as to determine whether the current traffic data has a threatening attack based on the comparison results.

[0034] In a third aspect, the present application discloses an electronic device, comprising:

[0035] Memory, used to store computer programs;

[0036] A processor is used to execute the computer program to implement the steps of the aforementioned disclosed threat intelligence perception method.

[0037] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned disclosed threat intelligence perception method are implemented.

[0038] The beneficial effects of the present application are as follows: the present application constructs a network matrix according to the historical threat intelligence data of each node in the target network; uses a rapidly expanding random tree algorithm to iteratively simulate the network matrix to obtain each attack path in the network matrix and the pheromone of each node in the attack path; obtains the pheromone importance value between each of the nodes based on the attack path and the pheromone of the node, and saves the threat feature samples and threat intelligence data links screened out from the historical threat intelligence data and the attack path according to the pheromone importance value in a preset rule library; collects the current traffic data of each node in the target network, and compares the current traffic data with the threat feature samples and the threat intelligence data links saved in the preset rule library, so as to determine whether the current traffic data has a threatening attack based on the comparison result. It can be seen that the present application uses a rapidly expanding random tree algorithm to iteratively simulate the network matrix to obtain the pheromones of each attack path in the network matrix and each node in the attack path, breaking the traditional method of manually intervening to find the source of attack. Further, the pheromone importance value between each node is obtained, and the threat feature samples and threat intelligence data links are screened out from the historical threat intelligence data and the attack path according to the pheromone importance value. When facing the current traffic data of each node in the target network, the current traffic data can be analyzed based on the threat feature samples and the threat intelligence data links to see if there is a threatening attack, avoiding manual search for attack paths associated with threat intelligence, and can be combined with the threat feature samples and threat intelligence data links of the historical threat intelligence data, and automatically find the main attack means and attack sources, so as to cope with complex and chaotic attack means. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A flowchart of a threat intelligence perception method disclosed in this application;

[0041] Figure 2 A pseudo code schematic diagram of a specific attack path iterative simulation disclosed in this application;

[0042] Figure 3 A schematic diagram of the structure of a threat intelligence perception device disclosed in this application;

[0043] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0045] With the continuous advancement of information technology, information security issues are becoming more and more prominent. Real-time and rapid identification of attack sources has become a key point. However, at present, technical personnel analyze based on past experience and find attack paths associated with threat intelligence, which wastes a lot of manpower and material resources and cannot cope with complex and chaotic attack methods. In the face of a large amount of threat intelligence data, it is difficult to find the attack source in a short time, let alone determine whether there is a threatening attack in a short time.

[0046] To this end, this application provides a threat intelligence perception solution to improve the efficiency of threat intelligence perception.

[0047] See also Figure 1 As shown, the embodiment of the present application discloses a threat intelligence perception method, including:

[0048] Step S11: Construct a network matrix based on the historical threat intelligence data of each node in the target network.

[0049] In this embodiment, the network matrix is ​​constructed based on the historical threat intelligence data of each node in the target network, including: using hard probes and soft probes deployed at each node in the target network to collect historical threat intelligence data, and performing redundant data cleaning on the historical threat intelligence data to obtain effective threat intelligence data; constructing a network matrix based on the effective threat intelligence data; wherein the network matrix is ​​used to describe the connection relationship and data transmission path between each node.

[0050] Historical threat intelligence data comes from hard probes and soft probes deployed at each node in the target network. These probes can obtain traffic information, that is, historical threat intelligence data, such as interface changes, host asset changes, port access, access information, etc., and perform redundant data cleaning on the various detailed traffic information obtained, filter out traffic information that does not carry threats, and obtain an effective set of threat intelligence data, that is, obtain effective threat intelligence data, and then build a network matrix based on the effective threat intelligence data to describe the connection relationship between nodes and the data transmission path.

[0051] Step S12: using a rapidly expanding random tree algorithm to iteratively simulate the network matrix to obtain each attack path in the network matrix and the pheromone of each node in the attack path.

[0052] In this embodiment, the iterative simulation of the network matrix using a rapidly expanding random tree algorithm to obtain each attack path in the network matrix and the pheromone of each node in the attack path includes: using a rapidly expanding random tree algorithm to determine the attack start node and the attack target node corresponding to the historical threat intelligence data in the network matrix, and iteratively simulating each attack path between the attack start node and the attack target node and the pheromone of each node in the attack path in the target network.

[0053] The Rapidly Exploring Random Tree (RRT) algorithm is an efficient path planning algorithm. Its basic idea is to start from an initial point (root node) and generate a random expanding tree by adding leaf nodes in space through random sampling. When the leaf node of the random tree contains the target point or enters the target area, a path consisting of tree nodes from the initial point to the target point can be found in the random tree. The implementation process of the RRT algorithm is as follows: first, initialize and set the starting point and the end point; then enter a loop, randomly select a point in the space, and find the node closest to the point (if it is the first time, it is the initial node); then grow the tree, connect the nearest node with the randomly selected point as the direction of tree growth, and set the step size as the length of the branch to generate a new node; if the new node collides with an obstacle, give up this growth; after continuous growth, the new node gets closer and closer to the end point; when the distance between the new node and the target point is less than a set threshold, connect the new node and the end point, so that the path from the starting point to the end point is found, so this embodiment can use the rapid expansion random tree algorithm to determine the attack start node and the attack target node corresponding to the historical threat intelligence data in the network matrix, and iteratively simulate the attack paths between the attack start node and the attack target node and the pheromone of each node in the attack path in the target network.

[0054] In this embodiment, the attack paths between the attack start node and the attack target node are iteratively simulated in the target network, including: determining the current target node of the attack start node in the target network, and performing random sampling in the target network based on the current target node to obtain the current sampling node of the current target node; if the current sampling node is not within the preset obstacle and the line between the newborn node of the current sampling node and the attack start node does not pass through the preset obstacle, then determining the newborn node of the current sampling node as the next target node of the current target node; updating the next target node to the current target node, and re-jumping to the step of performing random sampling in the target network based on the current target node until the next target node obtained is the attack target node, so as to obtain the attack paths between the attack start node and the attack target node. For example Figure 2 A pseudo code diagram of a specific attack path iterative simulation is shown in FIG. 1 , and the specific process of iteratively simulating each attack path between the attack start node and the attack target node is as follows:

[0055] 1) Set the attack starting node X init With the attack target node X goal , set the state sampling space by yourself;

[0056] 2) Randomly sample the target network to obtain the current sampling node X rand , if the current sampling node X rand If it is within the preset obstacle, random sampling is performed again;

[0057] 3) If the current sampling node X rand If it is not within the preset obstacle, calculate the current sampling node X rand The distance between each currently existing node in the generated node set is obtained by calculating the distance between the generated node set and the current sampling node X. rand The closest node X near , and then from node X near Go to node X with step size new , that is, generate a new node X new , if X near With X new Connection E i After passing the preset obstacle, random sampling is performed again; it can be understood that the generated node set includes all the currently existing nodes, and the currently existing nodes are the nodes that have been determined as target nodes. If the current node generation is the first time, then the currently existing nodes are the attack start nodes, the attack target nodes, and the nearest point X near The attack starts at node X. init , if the current node generation is the second time, the current existing nodes are the attack start node, the attack target node and the current target node; if the current node generation is the third time, the current existing nodes are the attack start node, the attack target node, the current target node and the next target node;

[0058] 4) After repeated iterations, a random expansion tree is generated. When each target node in the random expansion tree enters the target area, a path from the initial point to the target point can be found in the random expansion tree.

[0059] Figure 2 In , i represents the data node position in the attack path stored in the graph matrix. The formula in the second row describes the data update process each time the data node is traversed in reverse, and the value of the previous optimal data is accumulated. The calculation result is the value of the pheromone, which is similar to the work of finding highly relevant malicious threat intelligence keywords in threat intelligence. Each individual threat information is regarded as a set of texts, and some destructive keyword sets are extracted from the texts using algorithms. Normal single traffic access operations are unlikely to cause harm, but malicious traffic access will cause harm to users. Some normal operation combinations will inevitably cause damage to user rights. Therefore, such a set of keywords is extracted from qualitative threat information to form a feature sample of malicious threat information for detecting other traffic behaviors.

[0060] Step S13: based on the attack path and the pheromone of the node, the pheromone importance value between each node is obtained, and the threat feature samples and threat intelligence data links screened out from the historical threat intelligence data and the attack path according to the pheromone importance value are saved in a preset rule library.

[0061] In this embodiment, the pheromone importance values ​​between each of the nodes are obtained based on the pheromones of the attack path and the nodes, and the threat feature samples and threat intelligence data links screened out from the historical threat intelligence data and the attack path according to the pheromone importance values ​​are stored in a preset rule library, including: inputting the pheromones of the attack path and the nodes into a preset pheromone calculation formula to obtain the pheromone importance values ​​between each of the nodes; determining the average value of each pheromone importance value, and screening out key nodes whose pheromone importance values ​​are greater than the average value from each node; constructing a two-dimensional matrix based on the pheromone importance values ​​between each of the key nodes and the numbers of each of the key nodes, and analyzing whether there are threat intelligence data elements in the two-dimensional matrix, if so, determining the historical threat intelligence data corresponding to the key node as a threat feature sample, and determining the attack path with the key node as a threat intelligence data link; storing the threat feature sample and the threat intelligence data link in a preset rule library.

[0062] The pheromones of the attack path and the node are input into the preset pheromone calculation formula to obtain the pheromone importance value between each node, determine the average value of each pheromone importance value, and screen out the key nodes whose pheromone importance value is greater than the average value from each node, and construct a two-dimensional matrix based on the pheromone importance value between each key node and the number of each key node. That is to say, the position of each router node is numbered according to the preset pheromone calculation formula, and the key nodes are associated with the key nodes to form a two-dimensional data matrix, in which the data storage value X(i, j) is represented as the pheromone importance value between the key nodes numbered i and j, and it is analyzed whether there is a threat intelligence data element in the two-dimensional matrix. If so, the historical threat intelligence data corresponding to the key node is determined as a threat feature sample, and the attack path with the key node is determined as a threat intelligence data link; the threat feature sample and the threat intelligence data link are saved in a preset rule library.

[0063] In this embodiment, the threat feature sample and the threat intelligence data link are stored in the preset rule base, including: collecting the preset normal traffic data of each node in the target network; wherein the preset normal traffic data does not include threat intelligence data; obtaining the feature sample of the preset normal traffic data, and removing the features corresponding to the feature sample of the preset normal traffic data in the threat feature sample to obtain the target feature sample, and storing the target feature sample and the threat intelligence data link in the preset rule base. In order to ensure the validity of the results, it is necessary to conduct a comparative experiment, remove invalid pheromone sets, and input several groups of normal traffic operations into the system, that is, collect the preset normal traffic data of each node in the target network, the preset normal traffic data does not include threat intelligence data, and after the same processing as the historical threat intelligence data, some features of normal communication behavior are obtained, that is, obtain the feature sample of the preset normal traffic data, and compare it with the threat feature sample of the historical threat intelligence data, and remove the normal features contained in the threat information features, that is, remove the features corresponding to the feature sample of the preset normal traffic data in the threat feature sample to avoid misjudgment of detection.

[0064] Step S14: Collect current traffic data of each node in the target network, and compare the current traffic data with the threat feature samples and the threat intelligence data link stored in the preset rule base, so as to determine whether the current traffic data contains a threatening attack based on the comparison results.

[0065] In this embodiment, it is determined whether the current traffic data contains a threatening attack based on the comparison result obtained, including: if the comparison result obtained indicates that the current traffic data and the threat feature sample and the threat intelligence data link meet the preset matching conditions, then it is determined that the current traffic data contains a threatening attack, and corresponding threat intelligence alarm processing is performed.

[0066] Collect the current traffic data of each node in the target network, analyze the current traffic data to obtain its information set, and compare it with the threat intelligence feature set stored in the system, that is, compare the current traffic data with the threat feature samples and threat intelligence data links stored in the preset rule library; if the comparison result indicates that most of the features match, it can be concluded that the input threat intelligence is likely to be malware of this type, that is, the comparison result indicates that the current traffic data and the threat feature samples and threat intelligence data links meet the preset matching conditions, then the current traffic data has a threatening attack, and corresponding threat intelligence alarm processing is performed, and the specific threat intelligence alarm processing is, for example, immediately blocking subsequent processes or saving the current traffic data in a sandbox; the comparison result indicates that the current traffic data and the threat feature samples and threat intelligence data links do not meet the preset matching conditions, that is, the comparison result indicates that most of the features do not match, then it means that the current traffic data does not have a threatening attack, and the subsequent process can be carried out. At the beginning of the experiment, known threat information is input into the training system. When a new threat information is input into the training system, if it cannot be identified, it is used as the input of the training system to improve the system. That is to say, if it is impossible to identify whether the current traffic data contains a threatening attack, then the current traffic data should also be used as historical threat intelligence data to improve the threat feature samples and threat intelligence data links stored in the preset rule library.

[0067] Based on the RRT algorithm, according to the existing hard detection and soft detection technology, the basic information of the attack traffic data is obtained, and the key steps, port behaviors, attack frequencies and common parameters in the recording process are recorded. Through the RRT algorithm calculation, the initial network matrix is ​​constructed, and the distance between each attacked location and the threat source is iteratively calculated. The attack address of the threat source is gradually calculated. At the same time, the model is repeatedly trained to obtain the most appropriate learning constant factor parameters to make the model more accurate. By recording the frequency of access to threat data, the attack mode and more information of the threat intelligence can be analyzed. The existing intelligence is screened and analyzed through the RRT algorithm to form a behavioral data set, and new threat feature data can be expanded in real time, so as to retrain and obtain a new RRT algorithm model; and the RRT algorithm can face complex or confusing threat intelligence with a functional method to improve detection capabilities.

[0068] The beneficial effects of the present application are as follows: the present application constructs a network matrix according to the historical threat intelligence data of each node in the target network; uses a rapidly expanding random tree algorithm to iteratively simulate the network matrix to obtain each attack path in the network matrix and the pheromone of each node in the attack path; obtains the pheromone importance value between each of the nodes based on the attack path and the pheromone of the node, and saves the threat feature samples and threat intelligence data links screened out from the historical threat intelligence data and the attack path according to the pheromone importance value in a preset rule library; collects the current traffic data of each node in the target network, and compares the current traffic data with the threat feature samples and the threat intelligence data links saved in the preset rule library, so as to determine whether the current traffic data has a threatening attack based on the comparison result. It can be seen that the present application uses a rapidly expanding random tree algorithm to iteratively simulate the network matrix to obtain the pheromones of each attack path in the network matrix and each node in the attack path, breaking the traditional method of manually intervening to find the source of attack. Further, the pheromone importance value between each node is obtained, and the threat feature samples and threat intelligence data links are screened out from the historical threat intelligence data and the attack path according to the pheromone importance value. When facing the current traffic data of each node in the target network, the current traffic data can be analyzed based on the threat feature samples and the threat intelligence data links to see if there is a threatening attack, avoiding manual search for attack paths associated with threat intelligence, and can be combined with the threat feature samples and threat intelligence data links of the historical threat intelligence data, and automatically find the main attack means and attack sources, so as to cope with complex and chaotic attack means.

[0069] See also Figure 3 As shown, the embodiment of the present application discloses a threat intelligence perception device, including:

[0070] A matrix construction module 11 is used to construct a network matrix based on historical threat intelligence data of each node in the target network;

[0071] An iterative simulation module 12 is used to iteratively simulate the network matrix using a rapidly expanding random tree algorithm to obtain each attack path in the network matrix and the pheromone of each node in the attack path;

[0072] A data storage module 13 is used to obtain the pheromone importance value between each of the nodes based on the attack path and the pheromone of the node, and store the threat feature samples and threat intelligence data links screened from the historical threat intelligence data and the attack path according to the pheromone importance value in a preset rule library;

[0073] The threat perception module 14 is used to collect the current traffic data of each node in the target network, and compare the current traffic data with the threat feature samples and the threat intelligence data link stored in the preset rule library, so as to determine whether the current traffic data has a threatening attack based on the comparison results.

[0074] The beneficial effects of the present application are as follows: the present application constructs a network matrix according to the historical threat intelligence data of each node in the target network; uses a rapidly expanding random tree algorithm to iteratively simulate the network matrix to obtain each attack path in the network matrix and the pheromone of each node in the attack path; obtains the pheromone importance value between each of the nodes based on the attack path and the pheromone of the node, and saves the threat feature samples and threat intelligence data links screened out from the historical threat intelligence data and the attack path according to the pheromone importance value in a preset rule library; collects the current traffic data of each node in the target network, and compares the current traffic data with the threat feature samples and the threat intelligence data links saved in the preset rule library, so as to determine whether the current traffic data has a threatening attack based on the comparison result. It can be seen that the present application uses a rapidly expanding random tree algorithm to iteratively simulate the network matrix to obtain the pheromones of each attack path in the network matrix and each node in the attack path, breaking the traditional method of manually intervening to find the source of attack. Further, the pheromone importance value between each node is obtained, and the threat feature samples and threat intelligence data links are screened out from the historical threat intelligence data and the attack path according to the pheromone importance value. When facing the current traffic data of each node in the target network, the current traffic data can be analyzed based on the threat feature samples and the threat intelligence data links to see if there is a threatening attack, avoiding manual search for attack paths associated with threat intelligence, and can be combined with the threat feature samples and threat intelligence data links of the historical threat intelligence data, and automatically find the main attack means and attack sources, so as to cope with complex and chaotic attack means.

[0075] Furthermore, an embodiment of the present application also provides an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0076] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Specifically, it may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the following steps:

[0077] Build a network matrix based on the historical threat intelligence data of each node in the target network;

[0078] Iteratively simulating the network matrix using a rapidly expanding random tree algorithm to obtain each attack path in the network matrix and the pheromone of each node in the attack path;

[0079] Based on the attack path and the pheromone of the node, the pheromone importance value between each of the nodes is obtained, and the threat feature samples and threat intelligence data links respectively selected from the historical threat intelligence data and the attack path according to the pheromone importance value are stored in a preset rule library;

[0080] The current traffic data of each node in the target network is collected, and the current traffic data is compared with the threat feature samples and the threat intelligence data link stored in the preset rule base, so as to determine whether the current traffic data contains a threatening attack based on the comparison result.

[0081] In some specific implementations, the processor can implement the following steps by executing the computer program stored in the memory:

[0082] Use hard probes and soft probes deployed at each node in the target network to collect historical threat intelligence data, and perform redundant data cleaning on the historical threat intelligence data to obtain effective threat intelligence data;

[0083] A network matrix is ​​constructed according to the effective threat intelligence data; wherein the network matrix is ​​used to describe the connection relationship and data transmission path between each node.

[0084] In some specific implementations, the processor can implement the following steps by executing the computer program stored in the memory:

[0085] The attack start node and the attack target node corresponding to the historical threat intelligence data in the network matrix are determined by using a rapidly expanding random tree algorithm, and each attack path between the attack start node and the attack target node and the pheromone of each node in the attack path are iteratively simulated in the target network.

[0086] In some specific implementations, the processor can implement the following steps by executing the computer program stored in the memory:

[0087] Determining a current target node of the attack start node in the target network, and performing random sampling in the target network based on the current target node to obtain a current sampling node of the current target node;

[0088] If the current sampling node is not within the preset obstacle and the line between the new node of the current sampling node and the current existing node does not pass through the preset obstacle, the new node of the current sampling node is determined as the next target node of the current target node;

[0089] The next target node is updated to the current target node, and the step of randomly sampling the target network based on the current target node is jumped again until the next target node obtained is the attack target node, so as to obtain each attack path between the attack start node and the attack target node.

[0090] In some specific implementations, the processor can implement the following steps by executing the computer program stored in the memory:

[0091] Inputting the attack path and the pheromone of the node into a preset pheromone calculation formula to obtain the pheromone importance value between each of the nodes;

[0092] Determine the average value of each pheromone importance value, and select key nodes whose pheromone importance value is greater than the average value from each node;

[0093] A two-dimensional matrix is ​​constructed based on the pheromone importance values ​​between the key nodes and the serial numbers of the key nodes, and whether there is a threat intelligence data element in the two-dimensional matrix is ​​analyzed. If so, the historical threat intelligence data corresponding to the key node is determined as a threat feature sample, and the attack path where the key node exists is determined as a threat intelligence data link;

[0094] The threat feature sample and the threat intelligence data link are stored in a preset rule library.

[0095] In some specific implementations, the processor can implement the following steps by executing the computer program stored in the memory:

[0096] Collecting preset normal traffic data of each node in the target network; wherein the preset normal traffic data does not include threat intelligence data;

[0097] Acquire the characteristic sample of the preset normal traffic data, and remove the characteristics corresponding to the characteristic sample of the preset normal traffic data in the threat characteristic sample to obtain the target characteristic sample, and save the target characteristic sample and the threat intelligence data link in a preset rule library.

[0098] In some specific implementations, the processor may further include the following steps by executing the computer program stored in the memory:

[0099] If the comparison result obtained indicates that the current traffic data, the threat feature sample, and the threat intelligence data link meet the preset matching conditions, it is determined that there is a threatening attack in the current traffic data, and corresponding threat intelligence alarm processing is performed.

[0100] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0101] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0102] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0103] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows, Unix, Linux, etc. In addition to including a computer program that can be used to complete the threat intelligence perception method performed by the electronic device disclosed in any of the aforementioned embodiments, the computer program 222 can also further include a computer program that can be used to complete other specific tasks. In addition to data received by the electronic device and transmitted from an external device, the data 223 can also include data collected by its own input and output interface 25, etc.

[0104] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed threat intelligence perception method is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0105] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0106] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly with hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), memory, read-only memory (ROM), electrically programmable EPROM (Erasable Programmable Read Only Memory), electrically erasable programmable EEPROM (Electrically Erasable Programmable read only memory), register, hard disk, removable disk, CD-ROM (Compact Disc Read-Only Memory), or any other form of storage medium known in the technical field.

[0107] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0108] The above is a detailed introduction to a threat intelligence perception method, device, equipment and medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A threat intelligence perception method, characterized in that: include: Build a network matrix based on the historical threat intelligence data of each node in the target network; Iteratively simulating the network matrix using a rapidly expanding random tree algorithm to obtain each attack path in the network matrix and the pheromone of each node in the attack path; Based on the attack path and the pheromone of the node, the pheromone importance value between each of the nodes is obtained, and the threat feature samples and threat intelligence data links respectively selected from the historical threat intelligence data and the attack path according to the pheromone importance value are stored in a preset rule library; The current traffic data of each node in the target network is collected, and the current traffic data is compared with the threat feature samples and the threat intelligence data link stored in the preset rule base, so as to determine whether the current traffic data contains a threatening attack based on the comparison result.

2. The threat intelligence perception method according to claim 1 is characterized in that: The network matrix is ​​constructed based on the historical threat intelligence data of each node in the target network, including: Use hard probes and soft probes deployed at each node in the target network to collect historical threat intelligence data, and perform redundant data cleaning on the historical threat intelligence data to obtain effective threat intelligence data; A network matrix is ​​constructed according to the effective threat intelligence data; wherein the network matrix is ​​used to describe the connection relationship and data transmission path between each node.

3. The threat intelligence perception method according to claim 1 is characterized in that: The method of iteratively simulating the network matrix using a rapidly expanding random tree algorithm to obtain the attack paths in the network matrix and the pheromone of each node in the attack paths includes: The attack start node and the attack target node corresponding to the historical threat intelligence data in the network matrix are determined by using a rapidly expanding random tree algorithm, and each attack path between the attack start node and the attack target node and the pheromone of each node in the attack path are iteratively simulated in the target network.

4. The threat intelligence perception method according to claim 3 is characterized in that: Iteratively simulating each attack path between the attack start node and the attack target node in the target network, including: Determining a current target node of the attack start node in the target network, and performing random sampling in the target network based on the current target node to obtain a current sampling node of the current target node; If the current sampling node is not within the preset obstacle and the line between the new node of the current sampling node and the current existing node does not pass through the preset obstacle, the new node of the current sampling node is determined as the next target node of the current target node; The next target node is updated to the current target node, and the step of randomly sampling the target network based on the current target node is jumped again until the next target node obtained is the attack target node, so as to obtain each attack path between the attack start node and the attack target node.

5. The threat intelligence perception method according to claim 1, characterized in that: The step of obtaining the pheromone importance values ​​between the nodes based on the attack path and the pheromone of the nodes, and storing the threat feature samples and threat intelligence data links respectively screened from the historical threat intelligence data and the attack path according to the pheromone importance values ​​in a preset rule library includes: Inputting the attack path and the pheromone of the node into a preset pheromone calculation formula to obtain the pheromone importance value between each of the nodes; Determine the average value of each pheromone importance value, and select key nodes whose pheromone importance value is greater than the average value from each node; A two-dimensional matrix is ​​constructed based on the pheromone importance values ​​between the key nodes and the serial numbers of the key nodes, and whether there is a threat intelligence data element in the two-dimensional matrix is ​​analyzed. If so, the historical threat intelligence data corresponding to the key node is determined as a threat feature sample, and the attack path where the key node exists is determined as a threat intelligence data link; The threat feature sample and the threat intelligence data link are stored in a preset rule library.

6. The threat intelligence perception method according to claim 5 is characterized in that: The step of storing the threat feature sample and the threat intelligence data link in a preset rule library includes: Collecting preset normal traffic data of each node in the target network; wherein the preset normal traffic data does not include threat intelligence data; Acquire the characteristic sample of the preset normal traffic data, and remove the characteristics corresponding to the characteristic sample of the preset normal traffic data in the threat characteristic sample to obtain the target characteristic sample, and save the target characteristic sample and the threat intelligence data link in a preset rule library.

7. The threat intelligence perception method according to any one of claims 1 to 6, characterized in that: Determining whether the current traffic data contains a threatening attack according to the comparison result includes: If the comparison result obtained indicates that the current traffic data, the threat feature sample, and the threat intelligence data link meet the preset matching conditions, it is determined that there is a threatening attack in the current traffic data, and corresponding threat intelligence alarm processing is performed.

8. A threat intelligence perception device, characterized in that: include: A matrix building module is used to build a network matrix based on the historical threat intelligence data of each node in the target network; An iterative simulation module, used for iteratively simulating the network matrix using a rapidly expanding random tree algorithm to obtain each attack path in the network matrix and the pheromone of each node in the attack path; A data storage module, used for obtaining the pheromone importance value between each of the nodes based on the attack path and the pheromone of the node, and storing the threat feature samples and threat intelligence data links respectively screened from the historical threat intelligence data and the attack path according to the pheromone importance value in a preset rule library; The threat perception module is used to collect the current traffic data of each node in the target network, and compare the current traffic data with the threat feature samples and the threat intelligence data link stored in the preset rule library, so as to determine whether the current traffic data has a threatening attack based on the comparison results.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the threat intelligence perception method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the threat intelligence perception method as described in any one of claims 1 to 7 are implemented.

Images