Network threat analysis method and system based on privacy protection

Abstract

The invention provides a network threat analysis method and system based on privacy protection, and the method comprises the steps: building a professional channel to issue information, enabling users which can join in after authorization and meet specific and sensitive information, carrying out the modeling analysis of the expected benefits shared by different users, carrying out the quantitative analysis through the learning evolutionary game, and obtaining a reasonable excitation strategy. And each entity user inquires from the open community to obtain the required threat intelligence, analyzes the threat intelligence and deploys own network defense measures, so that the network security defense capability can be improved, the defect that the sensitive information is leaked or misused in the shared threat intelligence in the prior art is overcome, and the user experience is improved. And serious consequences and huge loss can be caused.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network threat analysis method and system based on privacy protection. Background Art

[0002] Sharing network threat intelligence can improve the efficiency of network defense. However, threat intelligence often contains sensitive information. If this sensitive information is leaked or misused, it may lead to serious consequences and huge losses. Therefore, how to control access to threat intelligence and protect its privacy has become one of the key links in threat intelligence exchange and sharing.

[0003] Therefore, there is an urgent need for a targeted network threat analysis method and system based on privacy protection. Summary of the invention

[0004] The purpose of the present invention is to provide a network threat analysis method and system based on privacy protection. By constructing a professional channel to issue intelligence, only authorized users can join, so as to meet the needs of users with specific and sensitive information. At the same time, the expected benefits shared by different users are modeled and analyzed, and learning evolutionary games are used for quantitative analysis to obtain reasonable incentive strategies, thereby protecting the privacy of user sensitive information and improving network security defense capabilities.

[0005] In a first aspect, the present application provides a network threat analysis method based on privacy protection, the method comprising:

[0006] The entity user submits a registration request to the authentication server, and the authentication server returns a digital certificate to the entity user. The entity user can perform encrypted communication with other entities based on the digital certificate, and can create a shared model and share threat intelligence with other entities;

[0007] According to the digital certificate, the entity user joins the open community and applies to join the professional channel according to needs; the joining of the open community is automatically reviewed by the smart contract, which is stored on the blockchain and provided to users for invocation; the professional channel is independent of the open community and is reviewed by the authentication server. After the review is passed, the authentication server issues a label signed by the digital certificate to the entity user, and the label carries the authority scope and validity period information;

[0008] The entity users share their acquired threat intelligence with the open community. The threat intelligence comes from one or more of the following: their own network monitoring, intrusion detection system, intrusion protection system, security information, event management system, network traffic, log data, and return incentives from the open community. If the threat intelligence needs to protect privacy, the entity users carry their own corresponding tags in the threat intelligence;

[0009] In the process of returning incentives, the open community first creates a sharing model together with all entity users. The sharing model is based on learning evolution game. Each entity user carries its own digital certificate C and / or label L in the shared threat intelligence. It is assumed that each entity user is a limited rational participant. In the initial stage of the game, each entity user chooses to share threat intelligence with a certain probability P. Participating in sharing threat intelligence can obtain a certain benefit U. The higher the quality of the threat intelligence, the greater the coefficient w associated with it. The digital certificate C and / or label L, probability P and coefficient w are used as input items of the sharing model, and the benefit U is used as the output item of the sharing model. The sharing model is trained with the goal of optimizing the benefit U. Each entity user with limited rationality uses the sharing model to participate in repeated games. The open community calculates the expected benefit of sharing according to the output benefit U and returns it to each entity user as an incentive.

[0010] The open community performs a quality assessment on the threat intelligence shared by each entity user, and shares the quality assessment result in the open community, wherein the quality assessment result is positively correlated with the coefficient w;

[0011] Each entity user initiates a query request. After identity verification, the open community returns threat intelligence that meets the query conditions to the entity user. If the threat intelligence obtained by the query carries a label, it means that it contains sensitive information. The authentication server will be notified to review whether the entity user who initiated the query request has the label signed by the digital certificate, and whether the scope of authority and validity period information meet the requirements. If it meets the requirements, the threat intelligence containing sensitive information will be sent to the entity user through a professional channel;

[0012] Physical users analyze the threat intelligence obtained from the query and deploy their own network defense measures based on the analysis results.

[0013] In a second aspect, the present application provides a network threat analysis system based on privacy protection, the system comprising: an entity user, an authentication server, an open community, a professional channel and a blockchain;

[0014] The entity user submits a registration request to the authentication server, and the authentication server returns a digital certificate to the entity user. The entity user can perform encrypted communication with other entities based on the digital certificate, and can create a shared model and share threat intelligence with other entities;

[0015] According to the digital certificate, the entity user joins the open community and applies to join the professional channel according to needs; the joining of the open community is automatically reviewed by the smart contract, which is stored on the blockchain and provided to users for invocation; the professional channel is independent of the open community and is reviewed by the authentication server. After the review is passed, the authentication server issues a label signed by the digital certificate to the entity user, and the label carries the authority scope and validity period information;

[0016] The entity users share their acquired threat intelligence with the open community. The threat intelligence comes from one or more of the following: their own network monitoring, intrusion detection system, intrusion protection system, security information, event management system, network traffic, log data, and return incentives from the open community. If the threat intelligence needs to protect privacy, the entity users carry their own corresponding tags in the threat intelligence;

[0017] In the process of returning incentives, the open community first creates a sharing model together with all entity users. The sharing model is based on learning evolution game. Each entity user carries its own digital certificate C and / or label L in the shared threat intelligence. It is assumed that each entity user is a limited rational participant. In the initial stage of the game, each entity user chooses to share threat intelligence with a certain probability P. Participating in sharing threat intelligence can obtain a certain benefit U. The higher the quality of the threat intelligence, the greater the coefficient w associated with it. The digital certificate C and / or label L, probability P and coefficient w are used as input items of the sharing model, and the benefit U is used as the output item of the sharing model. The sharing model is trained with the goal of optimizing the benefit U. Each entity user with limited rationality uses the sharing model to participate in repeated games. The open community calculates the expected benefit of sharing according to the output benefit U and returns it to each entity user as an incentive.

[0018] The open community performs a quality assessment on the threat intelligence shared by each entity user, and shares the quality assessment result in the open community, wherein the quality assessment result is positively correlated with the coefficient w;

[0019] Each entity user initiates a query request. After identity verification, the open community returns threat intelligence that meets the query conditions to the entity user. If the threat intelligence obtained by the query carries a label, it means that it contains sensitive information. The authentication server will be notified to review whether the entity user who initiated the query request has the label signed by the digital certificate, and whether the scope of authority and validity period information meet the requirements. If it meets the requirements, the threat intelligence containing sensitive information will be sent to the entity user through a professional channel;

[0020] Physical users analyze the threat intelligence obtained from the query and deploy their own network defense measures based on the analysis results.

[0021] In a third aspect, the present application provides a network threat analysis system based on privacy protection, the system comprising: an entity user, an authentication server, an intermediate device, a professional channel and a blockchain, the intermediate device comprising: a processor and a memory:

[0022] The memory is used to store program code and transmit the program code to the processor;

[0023] The processor is configured to execute any one of various possible methods of the first aspect according to instructions in the program code.

[0024] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to be executed by a processor to implement any of the various possible methods of the first aspect.

[0025] Beneficial Effects

[0026] The present invention provides a network threat analysis method and system based on privacy protection. By constructing a professional channel to issue intelligence, only authorized users can join, so as to meet the needs of users with specific and sensitive information. At the same time, the expected benefits shared by different users are modeled and analyzed, and a learning evolutionary game is used for quantitative analysis to obtain a reasonable incentive strategy, so as to protect the privacy of user sensitive information. Each entity user queries the open community to obtain the required threat intelligence, analyzes the threat intelligence and deploys its own network defense measures, which can improve the network security defense capability and overcome the problem of the prior art that the leakage or misuse of sensitive information in the shared threat intelligence may lead to serious consequences and huge losses.

[0027] The present invention has the following advantages and effects:

[0028] Reasonable incentives can promote the sharing and utilization efficiency of cyber threat intelligence;

[0029] Build a professional channel to distribute intelligence, and only authorized users can join to meet the needs of users with specific and sensitive information;

[0030] Each entity user obtains the most detailed threat intelligence possible from the open community, which enables them to better deploy their own network defense measures, improve defense capabilities and reduce the resources required to obtain intelligence;

[0031] Improve the efficiency of intelligence sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 It is a flow chart of the network threat analysis method based on privacy protection of the present invention;

[0034] Figure 2 This is an architecture diagram of the network threat analysis system based on privacy protection of the present invention. DETAILED DESCRIPTION

[0035] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0036] Figure 1 A general flow chart of the network threat analysis method based on privacy protection provided in this application, the method includes:

[0037] The entity user submits a registration request to the authentication server, and the authentication server returns a digital certificate to the entity user. The entity user can perform encrypted communication with other entities based on the digital certificate, and can create a shared model and share threat intelligence with other entities;

[0038] According to the digital certificate, the entity user joins the open community and applies to join the professional channel according to needs; the joining of the open community is automatically reviewed by the smart contract, which is stored on the blockchain and provided to users for invocation; the professional channel is independent of the open community and is reviewed by the authentication server. After the review is passed, the authentication server issues a label signed by the digital certificate to the entity user, and the label carries the authority scope and validity period information;

[0039] The entity users share their acquired threat intelligence with the open community. The threat intelligence comes from one or more of the following: their own network monitoring, intrusion detection system, intrusion protection system, security information, event management system, network traffic, log data, and return incentives from the open community. If the threat intelligence needs to protect privacy, the entity users carry their own corresponding tags in the threat intelligence;

[0040] In the process of returning incentives, the open community first creates a sharing model together with all entity users. The sharing model is based on learning evolution game. Each entity user carries its own digital certificate C and / or label L in the shared threat intelligence. It is assumed that each entity user is a limited rational participant. In the initial stage of the game, each entity user chooses to share threat intelligence with a certain probability P. Participating in sharing threat intelligence can obtain a certain benefit U. The higher the quality of the threat intelligence, the greater the coefficient w associated with it. The digital certificate C and / or label L, probability P and coefficient w are used as input items of the sharing model, and the benefit U is used as the output item of the sharing model. The sharing model is trained with the goal of optimizing the benefit U. Each entity user with limited rationality uses the sharing model to participate in repeated games. The open community calculates the expected benefit of sharing according to the output benefit U and returns it to each entity user as an incentive.

[0041] The open community performs a quality assessment on the threat intelligence shared by each entity user, and shares the quality assessment result in the open community, wherein the quality assessment result is positively correlated with the coefficient w;

[0042] Each entity user initiates a query request. After identity verification, the open community returns threat intelligence that meets the query conditions to the entity user. If the threat intelligence obtained by the query carries a label, it means that it contains sensitive information. The authentication server will be notified to review whether the entity user who initiated the query request has the label signed by the digital certificate, and whether the scope of authority and validity period information meet the requirements. If it meets the requirements, the threat intelligence containing sensitive information will be sent to the entity user through a professional channel;

[0043] Physical users analyze the threat intelligence obtained from the query and deploy their own network defense measures based on the analysis results.

[0044] In some preferred embodiments, the network defense measures include: data encryption, firewall settings, intrusion blocking, and redirection.

[0045] In some preferred embodiments, the professional channel is an encrypted communication channel.

[0046] The threat intelligence also includes: daily data and event behaviors. There is a mapping relationship between the daily data and event behaviors. According to the mapping relationship, the data feature vectors of the same event can be associated to improve the quality of the threat intelligence.

[0047] Each entity user can also query the open community for the quality assessment results of threat intelligence to determine whether the returned threat intelligence is the threat intelligence they need. If so, analyze the threat intelligence and deploy defense measures that are suitable for them. If not, feedback to the open community that the threat intelligence deviation is too large will be sent to the open community. The open community will adjust the coefficient w, restart the evolutionary game, calculate the new shared expected benefits, and obtain new incentives to return to each entity user. The incentives here also include penalties. Entity users who provide threat intelligence with excessive deviations will be punished accordingly to improve the intelligence reliability of the entire system.

[0048] Figure 2 The architecture diagram of the privacy-preserving network threat analysis system provided in this application, the system comprising: entity users, authentication servers, open communities, professional channels and blockchains;

[0049] The entity user submits a registration request to the authentication server, and the authentication server returns a digital certificate to the entity user. The entity user can perform encrypted communication with other entities based on the digital certificate, and can create a shared model and share threat intelligence with other entities;

[0050] According to the digital certificate, the entity user joins the open community and applies to join the professional channel according to needs; the joining of the open community is automatically reviewed by the smart contract, which is stored on the blockchain and provided to users for invocation; the professional channel is independent of the open community and is reviewed by the authentication server. After the review is passed, the authentication server issues a label signed by the digital certificate to the entity user, and the label carries the authority scope and validity period information;

[0051] The entity users share their acquired threat intelligence with the open community. The threat intelligence comes from one or more of the following: their own network monitoring, intrusion detection system, intrusion protection system, security information, event management system, network traffic, log data, and return incentives from the open community. If the threat intelligence needs to protect privacy, the entity users carry their own corresponding tags in the threat intelligence;

[0052] In the process of returning incentives, the open community first creates a sharing model together with all entity users. The sharing model is based on learning evolution game. Each entity user carries its own digital certificate C and / or label L in the shared threat intelligence. It is assumed that each entity user is a limited rational participant. In the initial stage of the game, each entity user chooses to share threat intelligence with a certain probability P. Participating in sharing threat intelligence can obtain a certain benefit U. The higher the quality of the threat intelligence, the greater the coefficient w associated with it. The digital certificate C and / or label L, probability P and coefficient w are used as input items of the sharing model, and the benefit U is used as the output item of the sharing model. The sharing model is trained with the goal of optimizing the benefit U. Each entity user with limited rationality uses the sharing model to participate in repeated games. The open community calculates the expected benefit of sharing according to the output benefit U and returns it to each entity user as an incentive.

[0053] The open community performs a quality assessment on the threat intelligence shared by each entity user, and shares the quality assessment result in the open community, wherein the quality assessment result is positively correlated with the coefficient w;

[0054] Each entity user initiates a query request. After identity verification, the open community returns threat intelligence that meets the query conditions to the entity user. If the threat intelligence obtained by the query carries a label, it means that it contains sensitive information. The authentication server will be notified to review whether the entity user who initiated the query request has the label signed by the digital certificate, and whether the scope of authority and validity period information meet the requirements. If it meets the requirements, the threat intelligence containing sensitive information will be sent to the entity user through a professional channel;

[0055] Physical users analyze the threat intelligence obtained from the query and deploy their own network defense measures based on the analysis results.

[0056] The present application provides a network threat analysis system based on privacy protection, the system comprising: a physical user, an authentication server, an intermediate device, a professional channel and a blockchain, the intermediate device comprising: a processor and a memory:

[0057] The memory is used to store program code and transmit the program code to the processor;

[0058] The processor is used to execute the method described in any one of all embodiments of the first aspect according to the instructions in the program code.

[0059] The present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to be executed by a processor to implement the method described in any one of all the embodiments of the first aspect.

[0060] In a specific implementation, the present invention further provides a computer storage medium, wherein the computer storage medium may store a program, and when the program is executed, the program may include some or all of the steps in each embodiment of the present invention. The storage medium may be a disk, an optical disk, a read-only storage memory (abbreviated as: ROM) or a random access memory (abbreviated as: RAM), etc.

[0061] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution in the embodiments of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention or some parts of the embodiments.

[0062] The same and similar parts between the various embodiments of this specification can be referred to each other. In particular, for the embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0063] The above-described embodiments of the present invention do not limit the protection scope of the present invention.

Claims

1. A network threat analysis method based on privacy protection, characterized in that: The method comprises: The entity user submits a registration request to the authentication server, and the authentication server returns a digital certificate to the entity user. The entity user can perform encrypted communication with other entities based on the digital certificate, and can create a shared model and share threat intelligence with other entities; According to the digital certificate, the entity user joins the open community and applies to join the professional channel according to needs; the joining of the open community is automatically reviewed by the smart contract, which is stored on the blockchain and provided to users for invocation; the professional channel is independent of the open community and is reviewed by the authentication server. After the review is passed, the authentication server issues a label signed by the digital certificate to the entity user, and the label carries the authority scope and validity period information; The entity users share their acquired threat intelligence with the open community. The threat intelligence comes from one or more of the following: their own network monitoring, intrusion detection system, intrusion protection system, security information, event management system, network traffic, log data, and return incentives from the open community. If the threat intelligence needs to protect privacy, the entity users carry their own corresponding tags in the threat intelligence; In the process of returning incentives, the open community first creates a sharing model together with all entity users. The sharing model is based on learning evolution game. Each entity user carries its own digital certificate C and / or label L in the shared threat intelligence. It is assumed that each entity user is a limited rational participant. In the initial stage of the game, each entity user chooses to share threat intelligence with a certain probability P. Participating in sharing threat intelligence can obtain a certain benefit U. The higher the quality of the threat intelligence, the greater the coefficient w associated with it. The digital certificate C and / or label L, probability P and coefficient w are used as input items of the sharing model, and the benefit U is used as the output item of the sharing model. The sharing model is trained with the goal of optimizing the benefit U. Each entity user with limited rationality uses the sharing model to participate in repeated games. The open community calculates the expected benefit of sharing according to the output benefit U and returns it to each entity user as an incentive. The open community performs a quality assessment on the threat intelligence shared by each entity user, and shares the quality assessment result in the open community, wherein the quality assessment result is positively correlated with the coefficient w; Each entity user initiates a query request. After identity verification, the open community returns threat intelligence that meets the query conditions to the entity user. If the threat intelligence obtained by the query carries a label, it means that it contains sensitive information. The authentication server will be notified to review whether the entity user who initiated the query request has the label signed by the digital certificate, and whether the scope of authority and validity period information meet the requirements. If it meets the requirements, the threat intelligence containing sensitive information will be sent to the entity user through a professional channel; Physical users analyze the threat intelligence obtained from the query and deploy their own network defense measures based on the analysis results.

2. The method according to claim 1, characterized in that: The network defense measures include: data encryption, firewall settings, intrusion blocking, and redirection.

3. The method according to claim 1, characterized in that: The professional channel is an encrypted communication channel.

4. A network threat analysis system based on privacy protection, characterized in that: The system includes: entity users, authentication servers, open communities, professional channels and blockchains; The entity user submits a registration request to the authentication server, and the authentication server returns a digital certificate to the entity user. The entity user can perform encrypted communication with other entities based on the digital certificate, and can create a shared model and share threat intelligence with other entities; According to the digital certificate, the entity user joins the open community and applies to join the professional channel according to needs; the joining of the open community is automatically reviewed by the smart contract, which is stored on the blockchain and provided to users for invocation; the professional channel is independent of the open community and is reviewed by the authentication server. After the review is passed, the authentication server issues a label signed by the digital certificate to the entity user, and the label carries the authority scope and validity period information; The entity users share their acquired threat intelligence with the open community. The threat intelligence comes from one or more of the following: their own network monitoring, intrusion detection system, intrusion protection system, security information, event management system, network traffic, log data, and return incentives from the open community. If the threat intelligence needs to protect privacy, the entity users carry their own corresponding tags in the threat intelligence; In the process of returning incentives, the open community first creates a sharing model together with all entity users. The sharing model is based on learning evolution game. Each entity user carries its own digital certificate C and / or label L in the shared threat intelligence. It is assumed that each entity user is a limited rational participant. In the initial stage of the game, each entity user chooses to share threat intelligence with a certain probability P. Participating in sharing threat intelligence can obtain a certain benefit U. The higher the quality of the threat intelligence, the greater the coefficient w associated with it. The digital certificate C and / or label L, probability P and coefficient w are used as input items of the sharing model, and the benefit U is used as the output item of the sharing model. The sharing model is trained with the goal of optimizing the benefit U. Each entity user with limited rationality uses the sharing model to participate in repeated games. The open community calculates the expected benefit of sharing according to the output benefit U and returns it to each entity user as an incentive. The open community performs a quality assessment on the threat intelligence shared by each entity user, and shares the quality assessment result in the open community, wherein the quality assessment result is positively correlated with the coefficient w; Each entity user initiates a query request. After identity verification, the open community returns threat intelligence that meets the query conditions to the entity user. If the threat intelligence obtained by the query carries a label, it means that it contains sensitive information. The authentication server will be notified to review whether the entity user who initiated the query request has the label signed by the digital certificate, and whether the scope of authority and validity period information meet the requirements. If it meets the requirements, the threat intelligence containing sensitive information will be sent to the entity user through a professional channel; Physical users analyze the threat intelligence obtained from the query and deploy their own network defense measures based on the analysis results.

5. A network threat analysis system based on privacy protection that implements the method according to any one of claims 1 to 3, characterized in that: The system includes: a physical user, an authentication server, an intermediate device, a professional channel and a blockchain, and the intermediate device includes: a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the function of the open community in the method according to any one of claims 1 to 3 according to the instructions in the program code.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program codes, and the program codes are used to be executed by a processor to implement the method according to any one of claims 1 to 3.

Images