A threat intelligence platform sorting method, system and medium

Abstract

The present invention discloses a method, system and medium for ranking a threat intelligence platform, the method comprising: using real malicious IP data to continuously collect a threat intelligence platform database for a period of time; analyzing the collected threat intelligence based on the threat intelligence source and the threat intelligence content to obtain a corresponding evaluation score; performing similarity analysis on the intelligence judgment result time series of the threat intelligence platform within the time window to obtain the citation situation of each platform; constructing a correlation graph of the threat intelligence platform and calculating a weighted probability transfer matrix; substituting the weighted probability transfer matrix and the damping factor into the PR formula for Markov iteration to obtain a ranking score based on the source and the citation situation; performing weighted calculation on the ranking score based on the source and the evaluation score based on the threat intelligence content to obtain the final evaluation ranking result. The present invention can help security practitioners select high-quality threat intelligence sources and improve the ability and accuracy of intelligence acquisition.

Description

Technical Field

[0001] The present invention relates to the field of threat intelligence technology, and in particular to a threat intelligence platform ranking method based on an improved PageRank algorithm. Background Art

[0002] At present, with the continuous emergence of various new technologies, network threats and attacks have become more complex and serious. Therefore, more and more security organizations need threat intelligence data provided by threat intelligence platforms to protect their infrastructure from cyber attacks. These threat intelligence platforms usually provide the latest threat intelligence information and interfaces for querying threat intelligence databases, making it convenient for security practitioners to obtain the required threat intelligence data. At the same time, with the development of the cybersecurity industry and the increasing attention paid to threat intelligence in various industries, the number of threat intelligence platforms is also increasing. Faced with a threat intelligence sharing system with rich selection space, it is particularly important to select a high-quality threat intelligence platform. This is because low-quality threat intelligence platforms often lead to a large number of false positives and missed positives. At the same time, because the intelligence they provide is repeated and redundant, it adds additional time costs and economic expenses to security organizations.

[0003] PageRank is an algorithm used by search engines to calculate the importance of web pages using hyperlinks between web pages. In fact, PageRank can be defined on any directed graph, and was later applied to multiple problems such as social influence analysis and text summarization. The basic idea of ​​the PageRank algorithm is to define a random walk model on a directed graph, namely a first-order Markov chain, which describes the behavior of a random walker randomly visiting each node along the directed graph. PageRank represents the stationary distribution of this Markov chain, and the stationary probability value of each node is its PageRank value. It gives a positive real number to each web page, indicating the importance of the web page, and the whole constitutes a vector. The higher the PageRank value, the more important the web page is, and it may be ranked at the front in the ranking of Internet searches. PageRank is defined recursively, and the calculation of PageRank can be performed through an iterative algorithm. Through iteration, the PageRank values ​​of all web pages are continuously calculated until convergence.

[0004] In recent years, there have been numerous studies on the evaluation of threat intelligence platforms, but most of them focus on evaluating single indicators of threat intelligence platforms. In 2018, Meier et al. proposed FeedRank, a ranking method for network threat intelligence push. The key idea is to model the correlation between network threat intelligence push sources into a correlation graph, and perform a ranking algorithm on the graph to obtain the evaluation results of accuracy and timeliness, and then rank the threat intelligence push sources overall based on the contribution of the source to the overall amount of threat intelligence collected.

[0005] Although FeedRank can rank threat intelligence sources by analyzing the reuse between threat intelligence sources, it has the following shortcomings: 1. The reuse analysis between sources is limited to a few snapshots, and it is not possible to analyze the reporting situation of the threat intelligence platform longitudinally in the time dimension; 2. The contribution of threat intelligence sources and the analysis of the relationship between them are relatively independent. The final comprehensive ranking is simply to find the average of the two, which lacks holistic analysis; 3. The entire evaluation process only involves the analysis of threat intelligence sources, and does not involve the analysis of the content of threat intelligence itself, while the threat intelligence content in the threat intelligence platform database contains rich text information. Summary of the invention

[0006] The main purpose of the present invention is to solve the above technical problems and propose a threat intelligence platform ranking method based on an improved PageRank algorithm to help security practitioners select high-quality threat intelligence sources, improve the ability to obtain intelligence and reduce unnecessary expenses.

[0007] To achieve the above object, the present invention provides a threat intelligence platform ranking method, the method comprising the following steps:

[0008] Step S100, intelligence collection, using real malicious IP data to continuously collect data from the threat intelligence platform database for a period of time;

[0009] Step S200, intelligence analysis, respectively analyzing the collected threat intelligence based on the threat intelligence source and based on the threat intelligence content to obtain corresponding evaluation scores SourceIndicatorScore and TextIndicatorScore;

[0010] Step S300, citation analysis, using a dynamic time warping algorithm to perform similarity analysis on the time series of intelligence determination results of the threat intelligence platform within the time window, and then combining the malicious determination time sequence to obtain the citation status of each platform;

[0011] Step S400, constructing a correlation graph, using each threat intelligence platform as a node and the references between the platforms as edges to construct a correlation graph of the threat intelligence platform and calculate a weighted probability transfer matrix;

[0012] Step S500, iterative calculation, substituting the weighted probability transfer matrix and the damping factor into the PR formula for Markov iteration, and obtaining a ranking score SourceScore based on the source and citation situation;

[0013] Step S600, weighted calculation is performed on the ranking score SourceScore based on the source and reference situation and the evaluation score TextIndicatorScore based on the threat intelligence content in step S200 to obtain the final evaluation ranking result FinalScore.

[0014] A further technical solution of the present invention is that step S200 comprises:

[0015] Step S210, based on the analysis of threat intelligence sources, specifically involving indicators such as hit rate and overlap rate that are not related to threat intelligence content, and then assigning corresponding weights according to the needs of security practitioners themselves to obtain the final evaluation score SourceIndicatorScore based on the threat intelligence source;

[0016] Step S220, based on the analysis of threat intelligence content, specifically involves malicious classification and content richness indicators that are only related to threat intelligence content, and then assigns corresponding weights according to the needs of security practitioners themselves to obtain the final evaluation score TextIndicatorScore based on the threat intelligence content.

[0017] A further technical solution of the present invention is that step S300 comprises:

[0018] Step S310, statistics are collected on the determination results of threat intelligence of each platform in the time dimension;

[0019] Step S320: Use the dynamic time warping algorithm to perform a pairwise similarity analysis on the time series of threat intelligence determination results from different platforms for the same malicious IP. In platform A and platform B, let S A∩Bz Represents the similarity score of the threat intelligence of the zth IP detected by platform A and platform B.

[0020] Step S330: Count the malicious judgment time of the same malicious IP between each platform, and obtain the leading / lagging situation of malicious judgment between each platform: compare the time of first detecting maliciousness of the same malicious IP between the two platforms, and obtain the IP set L whose malicious judgment time of platform B is earlier than that of platform A. AB ;

[0021] Step S340, combining the threat intelligence similarity score and the malicious judgment time, obtain the reference scores between the platforms; the reference score of platform A to platform B in N is the sum of similarity scores of all threat intelligence referenced by platform A to platform B. B The number of threat intelligence detected for platform B.

[0022] A further technical solution of the present invention is that step S400 comprises:

[0023] Step S410: In the correlation graph, each threat intelligence platform node determines a weight according to the evaluation score SourceIndicatorScore based on the threat intelligence source, and obtains a weight matrix of each threat intelligence platform node. Where S A SourceIndicatorScore is the evaluation score of platform A based on threat intelligence sources A , N is the number of threat intelligence platform nodes;

[0024] Step S420: The reference relationship between threat intelligence platforms is represented by directed edges. The directed edges point from the referencing platform to the referenced platform. The weight of the directed edges is determined by the citation score between the platforms:

[0025] The reference of platform B to platform A is represented in the relevant graph as a directed edge from B to A, with a weight of Citation AB , thus obtaining the citation score matrix between N threat intelligence platforms Among them C AB Citation score for platform A's citation of platform B AB , the citation score of each platform for itself C AA =0, C BB =0…C NN =0;

[0026] Step S430, broadcast the weight matrix W in step S410 as an N*N matrix W′, and then perform a Hadamard product operation with the citation score matrix in step S420 to obtain the final weighted probability transfer matrix And perform normalization operation.

[0027] A further technical solution of the present invention is that step S500 comprises:

[0028] Step S510, calculating the damping factor d: using the average path length of threat intelligence citation propagation to calculate the damping factor d=1-1 / l, where l is the average path length of all threat intelligence with citation relationships. In PageRank, the damping factor describes the probability of a user visiting another website through a link when browsing a website.

[0029] Step S520: Substitute the damping factor into the PR formula to obtain the calculation formula of the PR value of each platform in the Markov iteration, where the calculation formula of the PR value of the threat intelligence platform A node in each Markov iteration is PR A=(1-d) / N+d*∑ p∈P M Ap *PR p , where N is the number of threat intelligence platform nodes, P represents the set of all threat intelligence platforms, and M Ap Represents the matrix element S corresponding to platform A and platform p in the weighted probability transfer matrix M A *C Ap ;

[0030] Step S530, substitute the weighted probability matrix into the PR calculation formula in step S520 to obtain the matrix form of the PR value calculation formula for each Markov iteration

[0031]

[0032] The PR matrix subscript i represents the PR matrix obtained in the i-th iteration. When i = 0, it is the initial PR matrix. Where S A SourceIndicatorScore is the evaluation score of platform A based on threat intelligence sources A ;

[0033] Step S540, set the number of iterations to repeatedly perform Markov iterative calculations to obtain the final threat intelligence platform ranking score SourceScore based on the source and citation situation.

[0034] To achieve the above objectives, the present invention also proposes a threat intelligence platform sorting system, which includes a memory, a processor, and a threat intelligence platform sorting program stored on the processor, and the threat intelligence platform sorting program executes the steps of the method described above when run by the processor.

[0035] To achieve the above objectives, the present invention also proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a threat intelligence platform sorting program, and the threat intelligence platform sorting program is executed by a processor to perform the steps of the method described above.

[0036] The beneficial effects of the threat intelligence platform sorting method, system and medium of the present invention are:

[0037] The present invention adopts the above-mentioned technical scheme: intelligence collection, using real malicious IP data to continuously collect the threat intelligence platform database for a period of time; intelligence analysis, respectively analyzing the collected threat intelligence based on the threat intelligence source and based on the threat intelligence content to obtain corresponding evaluation scores; citation analysis, using a dynamic time warping algorithm to perform similarity analysis on the time series of the intelligence judgment results of the threat intelligence platform within the time window, and then combining the malicious judgment time sequence to obtain the citation situation of each platform; correlation graph construction, using each threat intelligence platform as a node, and the citation situation between each platform as an edge to construct a correlation graph of the threat intelligence platform and calculate the weighted probability transfer matrix; iterative calculation, substituting the weighted probability transfer matrix and the damping factor into the PR formula for Markov iteration to obtain a ranking score based on the source and the citation situation, and weightedly calculating the above-mentioned ranking score based on the source and the citation situation and the evaluation score based on the threat intelligence content to obtain the final evaluation ranking result, which can help security practitioners select high-quality threat intelligence sources and improve the ability and accuracy of intelligence acquisition. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0039] Figure 1 It is a flowchart of a preferred embodiment of the threat intelligence platform sorting method of the present invention;

[0040] Figure 2 Step S200 is a detailed flowchart of the intelligence analysis step;

[0041] Figure 3 Step S300 is a detailed flowchart of the reference analysis step;

[0042] Figure 4 Step S400 is a detailed flowchart of the step of building a correlation graph;

[0043] Figure 5 Step S500 is a detailed flowchart of the iterative calculation step;

[0044] Figure 6 It is a hardware architecture diagram of the threat intelligence platform sorting system of the present invention.

[0045] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] The present invention proposes a threat intelligence platform ranking method based on an improved PageRank algorithm. The technical solution adopted is mainly to obtain a comprehensive ranking of the platform through threat intelligence sources and indicator analysis based on threat intelligence content, so as to help security practitioners select high-quality threat intelligence sources and improve the ability and accuracy of intelligence acquisition.

[0048] Please refer to Figure 1 The preferred embodiment of the threat intelligence platform sorting method of the present invention includes the following steps:

[0049] Step S100, intelligence collection, using real malicious IP data to continuously collect data from the threat intelligence platform database for a period of time.

[0050] Specifically, this embodiment collects malicious IPs in the real-time alarm data set, performs a reverse query on the database through the API of the threat intelligence platform within a 30-day time window, and obtains longitudinal threat intelligence data within the time window.

[0051] Step S200, intelligence analysis, respectively performs analysis based on the threat intelligence source and analysis based on the threat intelligence content on the collected threat intelligence to obtain corresponding evaluation scores SourceIndicatorScore and TextIndicatorScore.

[0052] Please refer to Figure 2 , is a detailed flowchart of the intelligence analysis step, step S200 specifically includes the following steps:

[0053] Step S210: Based on the analysis of threat intelligence sources, specifically involving indicators such as hit rate and overlap rate that are not related to the threat intelligence content, and then assigning corresponding weights according to the needs of security practitioners themselves to obtain the final evaluation score SourceIndicatorScore based on the threat intelligence source;

[0054] Step S220: Based on the analysis of threat intelligence content, specifically involving indicators such as malicious classification and content richness that are only related to threat intelligence content, and then assigning corresponding weights according to the needs of security practitioners themselves to obtain the final evaluation score TextIndicatorScore based on the threat intelligence content.

[0055] Step S300, citation analysis, uses the dynamic time warping (DTW) algorithm to perform similarity analysis on the time series of intelligence judgment results of the threat intelligence platform within the time window, and then combines the malicious judgment time sequence to obtain the citation status of each platform.

[0056] Please refer to Figure 3 , is a flowchart of the reference analysis steps, step S300 specifically includes the following steps:

[0057] Step S310: Count and calculate the judgment results of the threat intelligence of each platform in the time dimension.

[0058] Specifically, the “malicious” and “suspicious” judgments are regarded as 1, and the other judgment categories are regarded as 0, and a string of 01 sequences with a length of 30 is obtained within the 30-day time window.

[0059] Step S320: Using the dynamic time warping (DTW) algorithm, perform pairwise similarity analysis on the time series of threat intelligence determination results from different platforms for the same malicious IP.

[0060] Specifically, the DTW distance can measure whether the changes of two time series are similar, regardless of the speed of their changes, so as to obtain the similarity score of the time series of the same malicious IP threat intelligence judgment results based on the comparison between each platform. A∩Bz Represents the similarity score of the threat intelligence of the zth IP detected by platform A and platform B.

[0061] Step S330: Count the malicious judgment time of the same malicious IP between each platform, and obtain the leading / lagging malicious judgment situation between each platform. Specifically, compare the time when the two platforms first detected the maliciousness of the same malicious IP, and obtain the IP set L whose malicious judgment time on platform B is earlier than that on platform A. AB .

[0062] Step S340: Combine the threat intelligence similarity scores and the malicious judgment time to obtain the reference scores between the platforms. in N is the sum of similarity scores of all threat intelligence referenced by platform A to platform B. B The number of threat intelligence detected for platform B.

[0063] Step S400: construct a correlation graph, using each threat intelligence platform as a node and the references between the platforms as edges to construct a correlation graph of the threat intelligence platform and calculate a weighted probability transfer matrix.

[0064] Please refer to Figure 4 , Figure 4 The flowchart of the steps of building the correlation graph is shown in step S400, wherein step S400 specifically includes the following steps:

[0065] Step S410: In the correlation graph, each threat intelligence platform node determines a weight according to the evaluation score SourceIndicatorScore based on the threat intelligence source, and obtains a weight matrix of each threat intelligence platform node Where S A SourceIndicatorScore is the evaluation score of platform A based on threat intelligence sources A , N is the number of threat intelligence platform nodes.

[0066] Step S420: The reference relationship between threat intelligence platforms is represented by directed edges. The direction of the directed edge is from the referencing platform to the referenced platform. The weight of the directed edge is determined by the citation score between the platforms. For example, the reference of platform B to platform A is represented in the relevant graph as a directed edge from B to A, and its weight is Citation. AB . From this, we can get the citation score matrix between N threat intelligence platforms: Among them C AB Citation score for platform A's citation of platform B AB , the citation score of each platform for itself C AA =0, C BB =0…C NN =0.

[0067] Step S430: broadcast the weight matrix W in step S410 as an N*N matrix W′, and then perform a Hadamard product operation with the citation score matrix in step S420 to obtain the final weighted probability transfer matrix And perform normalization operation.

[0068] Step S500, iterative calculation, substituting the weighted probability transfer matrix and the damping factor into the PR formula for Markov iteration, and obtaining a ranking score SourceScore based on the source and reference situation.

[0069] Please refer to Figure 5 , Figure 5 is a flowchart of iterative calculation steps, and step S500 specifically includes the following steps:

[0070] Step S510: Calculate the damping factor d. In PageRank, the damping factor describes the probability that a user visits another website through a link when browsing a certain website. Here, the damping factor d=1-1 / l is calculated using the average path length of threat intelligence citation propagation, where l is the average path length of all threat intelligence with citation relationships.

[0071] Step S520: Substitute the damping factor into the PR formula to obtain the calculation formula for the PR value of each platform in the Markov iteration, where the calculation formula for the PR value of node A of the threat intelligence platform in each Markov iteration is PR A =(1-d) / N+d*∑ p∈P M Ap *PR p , where N is the number of threat intelligence platform nodes, P represents the set of all threat intelligence platforms, and M Ap Represents the matrix element S corresponding to platform A and platform p in the weighted probability transfer matrix M A *C Ap .

[0072] Step S530: Substitute the weighted probability matrix into the PR calculation formula in S520 to obtain the matrix form of the PR value calculation formula for each Markov iteration.

[0073]

[0074] The PR matrix subscript i represents the PR matrix obtained in the i-th iteration. When i = 0, it is the initial PR matrix. Where S A SourceIndicatorScore is the evaluation score of platform A based on threat intelligence sources A .

[0075] Step S540: Set the number of iterations to repeatedly perform Markov iterative calculations to obtain the final threat intelligence platform ranking score SourceScore based on the source and citation situation.

[0076] In step S600, the ranking score SourceScore based on the source and citation situation is weighted with the evaluation score TextIndicatorScore based on the threat intelligence content in step S200 to obtain the final evaluation ranking result FinalScore, wherein the weights can be adjusted by security practitioners according to their own needs.

[0077] The beneficial effects of the threat intelligence platform ranking method of the present invention are:

[0078] The present invention adopts the above-mentioned technical scheme: intelligence collection, using real malicious IP data to continuously collect the threat intelligence platform database for a period of time; intelligence analysis, respectively analyzing the collected threat intelligence based on the threat intelligence source and based on the threat intelligence content to obtain corresponding evaluation scores; citation analysis, using a dynamic time warping algorithm to perform similarity analysis on the time series of the intelligence judgment results of the threat intelligence platform within the time window, and then combining the malicious judgment time sequence to obtain the citation situation of each platform; correlation graph construction, using each threat intelligence platform as a node, and the citation situation between each platform as an edge to construct a correlation graph of the threat intelligence platform and calculate the weighted probability transfer matrix; iterative calculation, substituting the weighted probability transfer matrix and the damping factor into the PR formula for Markov iteration to obtain a ranking score based on the source and the citation situation, and weightedly calculating the above-mentioned ranking score based on the source and the citation situation and the evaluation score based on the threat intelligence content to obtain the final evaluation ranking result, which can help security practitioners select high-quality threat intelligence sources and improve the ability and accuracy of intelligence acquisition.

[0079] To achieve the above objectives, the present invention also proposes a threat intelligence platform ranking system, such as Figure 6 As shown, the system includes a processor 1001, a CPU, a network interface 1004, a user interface 1003, a memory 1005, a communication bus 1002, and a threat intelligence platform sorting program stored on the processor, wherein the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0080] Those skilled in the art will understand that Figure 6 The system structure shown in the figure does not constitute a limitation of the system, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0081] like Figure 6 As shown, the memory 1005 as a computer storage medium may include an operating device, a network communication module, a user interface module, and a threat intelligence platform sorting program.

[0082] exist Figure 6In the system shown, the network interface 1004 is mainly used to connect to the network server and communicate data with the network server; the user interface 1003 is mainly used to interact with the user terminal and receive instructions input by the user; and the processor 1001 can be used to call the threat intelligence platform sorting program stored in the memory 1005.

[0083] To achieve the above objectives, the present invention also proposes a computer-readable storage medium, which stores a threat intelligence platform sorting program. When the threat intelligence platform sorting program is run by a processor, the steps of the method described above are executed, which will not be repeated here.

[0084] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the concept of the present invention, or directly / indirectly applied in other related technical fields are included in the patent protection scope of the present invention.

Claims

1. A threat intelligence platform ranking method, characterized in that: The method comprises the following steps: Step S100, intelligence collection, using real malicious IP data to continuously collect data from the threat intelligence platform database for a period of time; Step S200, intelligence analysis, respectively analyzing the collected threat intelligence based on the threat intelligence source and based on the threat intelligence content to obtain corresponding evaluation scores SourceIndicatorScore and TextIndicatorScore; Step S300, citation analysis, using a dynamic time warping algorithm to perform similarity analysis on the time series of intelligence determination results of the threat intelligence platform within the time window, and then combining the malicious determination time sequence to obtain the citation status of each platform; Step S400, constructing a correlation graph, using each threat intelligence platform as a node and the references between the platforms as edges to construct a correlation graph of the threat intelligence platform and calculate a weighted probability transfer matrix; Step S500, iterative calculation, substituting the weighted probability transfer matrix and the damping factor into the PR formula for Markov iteration, and obtaining a ranking score SourceScore based on the source and citation situation; Step S600, weighted calculation is performed on the ranking score SourceScore based on the source and reference situation and the evaluation score TextIndicatorScore based on the threat intelligence content in step S200 to obtain the final evaluation ranking result FinalScore.

2. The threat intelligence platform ranking method according to claim 1 is characterized in that: The step S200 includes: Step S210, based on the analysis of threat intelligence sources, specifically involving indicators such as hit rate and overlap rate that are not related to threat intelligence content, and then assigning corresponding weights according to the needs of security practitioners themselves to obtain the final evaluation score SourceIndicatorScore based on the threat intelligence source; Step S220, based on the analysis of threat intelligence content, specifically involves malicious classification and content richness indicators that are only related to threat intelligence content, and then assigns corresponding weights according to the needs of security practitioners themselves to obtain the final evaluation score TextIndicatorScore based on the threat intelligence content.

3. The threat intelligence platform ranking method according to claim 2 is characterized in that: The step S300 includes: Step S310, statistics are collected on the determination results of threat intelligence of each platform in the time dimension; Step S320: Use the dynamic time warping algorithm to perform a pairwise similarity analysis on the time series of threat intelligence determination results from different platforms for the same malicious IP. In platform A and platform B, let S A∩Bz It represents the similarity score of the threat intelligence of the zth IP detected by platforms A and B; Step S330: Count the malicious judgment time of the same malicious IP between each platform, and obtain the leading / lagging situation of malicious judgment between each platform: compare the time of first detecting maliciousness of the same malicious IP between the two platforms, and obtain the IP set L whose malicious judgment time of platform B is earlier than that of platform A. AB ; Step S340, combining the threat intelligence similarity score and the malicious judgment time, obtain the reference scores between the platforms; the reference score of platform A to platform B in N is the sum of similarity scores of all threat intelligence referenced by platform A to platform B. B The number of threat intelligence detected for platform B.

4. The threat intelligence platform ranking method according to claim 3 is characterized in that: The step S400 includes: Step S410: In the correlation graph, each threat intelligence platform node determines a weight according to the evaluation score SourceIndicatorScore based on the threat intelligence source, and obtains a weight matrix of each threat intelligence platform node. Where S A SourceIndicatorScore is the evaluation score of platform A based on threat intelligence sources A , N is the number of threat intelligence platform nodes; Step S420: The reference relationship between threat intelligence platforms is represented by directed edges. The directed edges point from the referencing platform to the referenced platform. The weight of the directed edges is determined by the citation score between the platforms: The reference of platform B to platform A is represented in the relevant graph as a directed edge from B to A, with a weight of Citation AB , thus obtaining the citation score matrix between N threat intelligence platforms Among them C AB Citation score for platform A's citation of platform B AB , the citation score of each platform for itself C AA =0, C BB =0…C NN =0; Step S430, broadcast the weight matrix W in step S410 as an N*N matrix W′, and then perform a Hadamard product operation with the citation score matrix in step S420 to obtain the final weighted probability transfer matrix And perform normalization operation.

5. The threat intelligence platform ranking method according to claim 4 is characterized in that: The step S500 includes: Step S510, calculating the damping factor d: using the average path length of threat intelligence citation propagation to calculate the damping factor d=1-1 / l, where l is the average path length of all threat intelligence with citation relationships. In PageRank, the damping factor describes the probability of a user visiting another website through a link when browsing a website. Step S520: Substitute the damping factor into the PR formula to obtain the calculation formula of the PR value of each platform in the Markov iteration, where the calculation formula of the PR value of the threat intelligence platform A node in each Markov iteration is PR A =(1-d) / N+d*∑ p∈P M Ap *PR p , where N is the number of threat intelligence platform nodes, P represents the set of all threat intelligence platforms, and M Ap Represents the matrix element S corresponding to platform A and platform p in the weighted probability transfer matrix M A *C Ap ; Step S530, substitute the weighted probability matrix into the PR calculation formula in step S520 to obtain the matrix form of the PR value calculation formula for each Markov iteration The PR matrix subscript i represents the PR matrix obtained in the i-th iteration. When i = 0, it is the initial PR matrix. Where S A SourceIndicatorScore is the evaluation score of platform A based on threat intelligence sources A ; Step S540, set the number of iterations to repeatedly perform Markov iterative calculations to obtain the final threat intelligence platform ranking score SourceScore based on the source and citation situation.

6. A threat intelligence platform ranking system, characterized in that: The system includes a memory, a processor, and a threat intelligence platform sorting program stored on the processor. When the threat intelligence platform sorting program is run by the processor, the steps of the method described in any one of claims 1 to 5 are executed.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a threat intelligence platform sorting program, and when the threat intelligence platform sorting program is executed by a processor, the steps of the method described in any one of claims 1 to 5 are executed.

Images