Data processing method and device, equipment and storage medium

Abstract

The invention discloses a data processing method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining to-be-processed threat intelligence data; preprocessing the threat intelligence data to be processed to generate structured data to be interpreted, the structured data to be interpreted comprising creditworthiness information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed; and interpreting the to-be-interpreted structured data based on the security unsupervised pre-training model to generate an interpretation result of the to-be-processed threat intelligence data. Thus, the intelligence reputation information and / or the context information of the threat intelligence data are / is interpreted through the security unsupervised pre-training model, deep interpretation and analysis of the threat intelligence data are realized, and the understanding efficiency of a user for threat intelligence and the network security protection capability are improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a data processing method, device, equipment and storage medium. Background Art

[0002] With the continuous development of Internet technology, in order to protect network security, various network security protection measures are mainly used to detect network security status and process abnormal detection results. However, the above protection mode is limited by the corresponding recognition ability of the security protection measures and has a certain lag.

[0003] Today's network attack and defense environment is becoming increasingly complex. Based on this, threat intelligence has gradually gained widespread recognition as a security technology that compensates for the information asymmetry between attack and defense. Threat intelligence refers to a kind of evidence-based knowledge, including context, mechanism, label, meaning and executable suggestions. Threat intelligence can serve as an early warning before a threat occurs, assist in detection and response when a threat occurs, and can be used for analysis and tracing after the fact.

[0004] However, currently threat intelligence data is mainly aimed at relevant personnel in network security management, and the content has certain professional limitations, which makes it impossible for users to accurately grasp threat intelligence and thus effectively respond to security threats, reducing the ability to protect network security. Summary of the invention

[0005] In view of this, embodiments of the present application provide a data processing method, apparatus, device and storage medium, aiming to improve the protection capability of network security.

[0006] The technical solution of the embodiment of the present application is implemented as follows:

[0007] In a first aspect, an embodiment of the present application provides a data processing method, the method comprising:

[0008] Obtain threat intelligence data to be processed;

[0009] Preprocessing the threat intelligence data to be processed to generate structured data to be interpreted, wherein the structured data to be interpreted includes: credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed;

[0010] The structured data to be interpreted is interpreted based on a secure unsupervised pre-training model to generate an interpretation result of the threat intelligence data to be processed.

[0011] In some embodiments, the preprocessing of the threat intelligence data to be processed to generate structured data to be interpreted includes:

[0012] Preprocessing the threat intelligence data to be processed to generate structured threat intelligence data to be processed;

[0013] Based on the structured threat intelligence data to be processed, generating knowledge graph information of the threat intelligence data to be processed;

[0014] Based on the knowledge graph information, credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed is determined.

[0015] In some embodiments, generating knowledge graph information of the threat intelligence data to be processed based on the structured threat intelligence data to be processed includes:

[0016] Based on a preset extraction rule, extract an entity set and an entity relationship set corresponding to the structured threat intelligence data to be processed, wherein the entity relationship set is used to characterize the relationship between entities in the entity set;

[0017] Based on the entity set and the entity relationship set, the knowledge graph information is determined.

[0018] In some embodiments, determining the credibility information of the threat intelligence data to be processed based on the knowledge graph information includes:

[0019] For each entity in the entity set of the knowledge graph information, obtaining identification information of the entity;

[0020] Determining a reputation evaluation rule for the entity based on the identification information and a preset mapping relationship, wherein the preset mapping relationship is used to characterize a correspondence between each entity identification information and the reputation evaluation rule;

[0021] Determining the reputation information of the entity based on the reputation evaluation rule of the entity;

[0022] Based on the reputation information of each of the entities, the reputation information of the threat intelligence data to be processed is determined.

[0023] In some embodiments, determining the context information of the threat intelligence data to be processed based on the knowledge graph information includes:

[0024] For each entity in the entity set of the knowledge graph information, obtaining identification information of the entity;

[0025] Generate context information corresponding to the entity based on the identification information and the entity relationship set of the knowledge graph information, wherein the entity relationship set includes the relationship between entities in the entity set,

[0026] Based on the context information corresponding to each of the entities, the context information of the threat intelligence data to be processed is determined.

[0027] In some embodiments, the method further comprises:

[0028] Obtaining an unsupervised pre-training sample set, wherein the unsupervised pre-training sample set includes: pre-processed network security corpus;

[0029] Based on the preprocessed network security corpus, unsupervised pre-training is performed on the neural network structure model to generate an initial security unsupervised pre-training model;

[0030] Based on the preset interpretation task and the initial secure unsupervised pre-trained model, the secure unsupervised pre-trained model is generated.

[0031] In some embodiments, the generating the secure unsupervised pre-trained model based on the preset interpretation task and the initial secure unsupervised pre-trained model includes:

[0032] Based on the preset interpretation task, adjusting the initial secure unsupervised pre-training model;

[0033] Verify the adjusted initial secure unsupervised pre-trained model based on the verification data set and generate verification results;

[0034] Based on the verification result, the secure unsupervised pre-training model is generated.

[0035] In a second aspect, an embodiment of the present application provides a data processing device, the device comprising:

[0036] An acquisition module is used to obtain threat intelligence data to be processed;

[0037] A processing module, configured to pre-process the threat intelligence data to be processed to generate structured data to be interpreted, wherein the structured data to be interpreted includes: credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed;

[0038] The interpretation module is used to interpret the credibility information and / or context information of the threat intelligence data to be processed based on the secure unsupervised pre-training model to generate an interpretation result of the threat intelligence data to be processed.

[0039] In a third aspect, an embodiment of the present application provides a data processing device, comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein:

[0040] The processor is used to execute the steps of the method described in the first aspect when running a computer program.

[0041] In a fourth aspect, an embodiment of the present application provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0042] The technical solution provided by the embodiment of the present application provides a data processing method, which includes: obtaining threat intelligence data to be processed; preprocessing the threat intelligence data to be processed to generate structured data to be interpreted, and the structured data to be interpreted includes: credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed; interpreting the credibility information and / or context information of the threat intelligence data to be processed based on a secure unsupervised pre-trained model to generate an interpretation result of the threat intelligence data to be processed. In this way, a new threat intelligence interpretation method is provided, which interprets the intelligence credibility information and / or context information of the threat intelligence data through a secure unsupervised pre-trained model, realizes in-depth interpretation and analysis of the threat intelligence data, and improves the user's understanding efficiency of threat intelligence and network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flowchart of a data processing method provided in one embodiment of the present application;

[0044] Figure 2 A flowchart of a threat intelligence data interpretation solution provided for an application example of this application;

[0045] Figure 3 A schematic diagram of the process of constructing a knowledge graph in an application example of this application;

[0046] Figure 4 A schematic diagram of the process of pre-training a secure GPT model in an application example of this application;

[0047] Figure 5 A flowchart of threat intelligence data interpretation based on secure GPT in an application example of this application;

[0048] Figure 6 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0049] Figure 7 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0052] The present application embodiment provides a data processing method, which can be applied to a data processing device, such as Figure 1 As shown, the method comprises the following steps:

[0053] Step 110: Obtain threat intelligence data to be processed.

[0054] Here, the data processing device can obtain the threat intelligence data to be processed sent by at least one intelligence source based on the network crawler and data collection technology. The at least one intelligence source here can include but is not limited to at least one of the following: internal intelligence source, cooperative exchange source, supply business source and public intelligence source.

[0055] Step 120: pre-process the threat intelligence data to be processed to generate structured data to be interpreted, where the structured data to be interpreted includes: credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed.

[0056] Here, reputation information is the evaluation information of the security credibility of network entities. For example, reputation can be represented by black or white. Context information can provide relevant information in multiple dimensions, such as domain name resolution, historical behavior, etc. Here, reputation information provides a credibility assessment of entities in threat intelligence data. Based on the evaluation results of historical behavior and trusted sources, it can help users identify potential false information or highly credible threat sources.

[0057] Here, the acquired threat intelligence data to be processed is preprocessed to generate structured data to be interpreted. Preprocessing includes converting various types of threat intelligence data into a unified format. For example, a preset format standard can be used to unify the data format of the threat intelligence to be processed to improve the consistency of the threat intelligence to be processed. The structured data to be interpreted includes: the credibility information of the threat intelligence data to be processed and / or the context information of the threat intelligence data to be processed. The context information also provides a more comprehensive background for the interpretation, which helps to more fully understand the severity and scope of the threat event.

[0058] Step 130: Interpret the structured data to be interpreted based on the secure unsupervised pre-training model to generate interpretation results of the threat intelligence data to be processed.

[0059] Here, the secure unsupervised pre-training model can be a secure GPT (Generative Pre-Trained Transformer) model. The secure GPT model is a pre-training model based on the Transformer architecture, which is specially optimized for the field of network security and has strong natural language processing capabilities and security knowledge. Unsupervised pre-training means that the pre-training of the secure GPT is carried out in an unsupervised learning manner, that is, the model has no training labels or manual annotation guidance during the pre-training stage. During the pre-training process, the model masks some words or fragments in the text based on the self-attention mechanism of the Transformer, and then predicts the content of these masked parts. The secure GPT model learns the contextual information, grammatical structure, and semantic representation in the text by predicting the masked parts.

[0060] Exemplarily, after the structured data to be interpreted is generated, the data is input into the security GPT model, and the security GPT model automatically interprets the structured data to be interpreted to generate an interpretation result of the threat intelligence data to be processed.

[0061] Here, by obtaining the threat intelligence data to be processed; pre-processing the threat intelligence data to be processed to generate structured data to be interpreted, the structured data to be interpreted includes: the credibility information of the threat intelligence data to be processed and / or the context information of the threat intelligence data to be processed; interpreting the credibility information and / or context information of the threat intelligence data to be processed based on the secure unsupervised pre-trained model to generate the interpretation result of the threat intelligence data to be processed. In this way, a new threat intelligence interpretation method is provided, which interprets the intelligence credibility information and / or context information of the threat intelligence data through the secure unsupervised pre-trained model, realizes the in-depth interpretation and analysis of the threat intelligence data, and improves the user's understanding efficiency of threat intelligence and network security protection capabilities.

[0062] In some embodiments, the threat intelligence data to be processed is preprocessed to generate structured data to be interpreted, including:

[0063] Preprocess the threat intelligence data to be processed to generate structured threat intelligence data to be processed;

[0064] Based on the structured threat intelligence data to be processed, generate knowledge graph information of the threat intelligence data to be processed;

[0065] Based on the knowledge graph information, the credibility information of the threat intelligence data to be processed and / or the context information of the threat intelligence data to be processed is determined.

[0066] Here, the collected threat intelligence data may come from multiple different sources, and their formats and structures may vary. In order to integrate this data into a unified format and eliminate the noise and redundancy therein, data preprocessing and data cleaning are required, including data format conversion, data deduplication and redundancy processing, data labeling and classification. Here, the data format of the threat intelligence to be processed is converted, the data format is unified, and structured threat intelligence data to be processed is generated. For example, a preset format standard can be used to unify the data format of the threat intelligence to be processed to improve the consistency of the threat intelligence to be processed. In addition, data cleaning is to discover and correct identifiable errors in the threat intelligence data file to be processed, so as to improve the correctness of the threat intelligence to be processed. Data deduplication is to discover and remove the same threat intelligence in the threat intelligence to be processed, reduce the subsequent processing cost, and improve the processing efficiency.

[0067] Here, based on the structured threat intelligence data to be processed, the knowledge graph technology can be used to construct the knowledge graph of the structured threat intelligence data to be processed, and generate the knowledge graph information of the threat intelligence data to be processed. The knowledge graph of threat intelligence refers to a structured model that uses a graph to represent the entities in the threat intelligence and the relationships between them, so as to more effectively understand and analyze the threat intelligence. Based on the knowledge graph information, the intelligence reputation information and / or context information in the knowledge graph is extracted to determine the reputation information of the threat intelligence data to be processed and / or the context information of the threat intelligence data to be processed.

[0068] In this way, a threat intelligence knowledge graph is constructed through the knowledge graph tool to generate threat intelligence knowledge graph information, thereby determining the credibility information of the threat intelligence data to be processed and / or the context information of the threat intelligence data to be processed, which can ensure the subsequent effective understanding and analysis of the threat intelligence.

[0069] In some embodiments, based on the structured threat intelligence data to be processed, knowledge graph information of the threat intelligence data to be processed is generated, including:

[0070] Based on the preset extraction rules, the entity set and entity relationship set corresponding to the structured threat intelligence data to be processed are extracted. The entity relationship set is used to represent the relationship between the entities in the entity set.

[0071] Determine the knowledge graph information based on the entity set and entity relationship set.

[0072] Here, in the embodiment of the present application, the entity of the structured threat intelligence data to be processed may include at least one of the following: IP address, domain name, file hash, DNS server, whois information, and the entity set is a set of the above entities. The entity relationship of the structured threat intelligence data to be processed may include at least one of the following: download, release file, communication, analysis, subordination, registration, and the entity relationship set is used to characterize the relationship between the entities in the entity set.

[0073] Here, based on the preset extraction rules, the entity set and entity relationship set corresponding to the structured threat intelligence data to be processed are extracted. The preset extraction rules here include threat intelligence named entity recognition rules and threat intelligence entity relationship extraction rules based on graph neural networks. Based on the threat intelligence named entity recognition rules, entities with specific meanings are identified and marked from the threat intelligence data to generate an entity set. Then, based on the threat intelligence entity relationship extraction rules of the graph neural network, the association relationship between entities in the text of the threat intelligence data, that is, the entity relationship, is extracted to generate an entity relationship set.

[0074] Here, based on the above-mentioned entity set and entity relationship set, a knowledge graph of structured threat intelligence data to be processed can be constructed, and the knowledge graph information of the structured threat intelligence data to be processed can be determined.

[0075] In this way, by extracting the entity set and entity relationship set of the threat intelligence data to be processed, the knowledge graph information of the threat intelligence data is generated, which provides an important data foundation for the subsequent calculation of intelligence reputation information and the integration of contextual information.

[0076] In some embodiments, determining the reputation information of the threat intelligence data to be processed based on the knowledge graph information includes:

[0077] For each entity in the entity set of the knowledge graph information, obtain the entity identification information;

[0078] Determine the reputation evaluation rule of the entity based on the identification information and the preset mapping relationship, where the preset mapping relationship is used to characterize the correspondence between the identification information of each entity and the reputation evaluation rule;

[0079] Determining the entity's reputation information based on the entity's reputation evaluation rules;

[0080] Based on the reputation information of each entity, the reputation information of the threat intelligence data to be processed is determined.

[0081] Here, for each entity in the entity set of the knowledge graph information, its corresponding reputation information is determined, and then based on the reputation information of each entity, the reputation information of the threat intelligence data to be processed is determined. For different entities, the corresponding entity reputation evaluation rules are different. Here, a mapping relationship can be stored in advance, and the mapping relationship characterizes the correspondence between each entity identification information and the reputation evaluation rule. Based on the entity identification information and the preset mapping relationship, the entity reputation evaluation rule is determined. The entity reputation evaluation rule can take into account multiple factors, such as historical attack behaviors, trusted agency evaluations, etc. Based on the reputation evaluation rule, the entity's reputation is calculated to generate the entity's reputation information.

[0082] In this way, by determining the reputation information of the threat intelligence data to be processed based on the reputation information of each entity, the reputation information provides a credibility assessment of the entities in the threat intelligence data, and helps users identify potential false information or highly credible threat sources based on the evaluation results of historical behaviors and trusted sources. This enables a more in-depth analysis and evaluation of threat intelligence data, which helps improve the understanding and application of threat intelligence data.

[0083] In some embodiments, based on the knowledge graph information, determining the context information of the threat intelligence data to be processed includes:

[0084] For each entity in the entity set of the knowledge graph information, obtain the entity identification information;

[0085] Generate context information corresponding to the entity based on the entity relationship set of identification information and knowledge graph information. The entity relationship set includes the relationship between the entities in the entity set.

[0086] Based on the context information corresponding to each entity, the context information of the threat intelligence data to be processed is determined.

[0087] Here, the context information of the threat intelligence data to be processed can be determined through the context information corresponding to each entity. For each entity in the entity set of the knowledge graph information, there is at least one entity relationship corresponding to it, and at least one entity relationship constitutes the context information of the entity. Here, based on the identification information of the entity and the entity relationship set of the knowledge graph information, at least one entity relationship corresponding to the entity is determined, and at least one entity relationship constitutes the context information of the entity.

[0088] Here, the context information may also include the time, location, affected systems, etc. of the threat event. The above information may be obtained through text parsing, specific rules, and associated external data sources.

[0089] In this way, the context information of the threat intelligence data to be processed is determined through the context information corresponding to each entity. The context information can provide a more comprehensive background for subsequent interpretation, such as the time, location, and affected systems of the threat event, which helps to more comprehensively understand the severity and scope of the threat event, avoid information misunderstanding or neglect of certain key information caused by the lack of context information, and enable users to understand the meaning and threat level of threat intelligence data in a specific context.

[0090] In some embodiments, the method further comprises:

[0091] Obtain an unsupervised pre-training sample set, which includes: pre-processed network security corpus;

[0092] Based on the preprocessed network security corpus, the neural network structure model is unsupervised pre-trained to generate an initial security unsupervised pre-training model;

[0093] Generate a secure unsupervised pre-trained model based on threat intelligence sample data, preset interpretation tasks and the initial secure unsupervised pre-trained model.

[0094] Here, the cybersecurity corpus refers to the text corpus in the field of cybersecurity. It mainly includes books, papers, threat reports, etc. in the field of security. After obtaining the cybersecurity prediction, it needs to be preprocessed, including word segmentation, tokenization, removal of stop words and special symbols, etc., to facilitate subsequent model pre-training.

[0095] Here, taking the secure GPT model as an example, after preprocessing the network security prediction, the Transformer model is unsupervised pre-trained based on the preprocessed network security prediction. Unsupervised pre-training includes: the Transformer model has no training labels or manual annotation guidance during the pre-training stage. During the pre-training process, the Transformer model generates an initial secure unsupervised pre-training model by masking some words or fragments in the text and then predicting the content of these masked parts based on the Transformer's self-attention mechanism. After the pre-training stage is completed, the parameters of the initial secure unsupervised pre-training model can be saved as the initial parameters of the secure unsupervised pre-training model.

[0096] Here, after the initial security unsupervised pre-training model is generated, although the initial security unsupervised pre-training model has learned the semantic representation and knowledge in the field of network security, it is not optimized for specific threat intelligence data and interpretation tasks. Here, in order to realize the interpretation of threat intelligence data, a security unsupervised pre-training model is generated based on the preset interpretation task and the initial security unsupervised pre-training model.

[0097] Here, by obtaining an unsupervised pre-training sample set, the unsupervised pre-training sample set includes: pre-processed network security corpus; based on the pre-processed network security corpus, the neural network structure model is unsupervisedly pre-trained to generate an initial security unsupervised pre-training model; based on the threat intelligence sample data, the preset interpretation task and the initial security unsupervised pre-training model, a security unsupervised pre-training model is generated. In this way, through the security unsupervised pre-training stage, the initial security unsupervised pre-training model learns the semantics and knowledge in the field of network security based on unsupervised learning, which can provide valuable feature representation for the subsequent automatic interpretation and analysis of threat intelligence data.

[0098] In some embodiments, generating a secure unsupervised pre-trained model based on the interpretation task and the initial secure unsupervised pre-trained model includes:

[0099] Adjust the initial secure unsupervised pre-trained model based on the preset interpretation task;

[0100] Verify the adjusted initial secure unsupervised pre-trained model based on the verification data set and generate verification results;

[0101] Based on the verification results, a secure unsupervised pre-training model is generated.

[0102] Here, the interpretation task can be pre-set, that is, the goal of the threat intelligence data interpretation task can be clearly defined in advance. For example, the task can be to predict the type of threat, threat level, possible affected systems, etc. based on the description in the threat intelligence data. Based on the interpretation task, the labeled training data related to the threat intelligence data interpretation task, i.e., threat intelligence sample data, is obtained. These threat intelligence sample data should contain the input text of the threat intelligence data and the corresponding interpretation results or labels. Based on the interpretation task and the threat intelligence sample data, the initial security unsupervised pre-training model is adjusted.

[0103] Here, after the adjustment is completed, another validation data set is used to verify and evaluate the model to ensure the performance of the model in the threat intelligence data interpretation task. Based on the validation results, a secure unsupervised pre-training model is generated.

[0104] In this way, by optimizing the combination of specific threat intelligence data and interpretation tasks, and verifying based on the verification data set, a secure unsupervised pre-trained model is generated. This enables the generated secure unsupervised pre-trained model to be more suitable for specific threat intelligence data interpretation tasks, and improves the accuracy and effectiveness of the interpretation.

[0105] The following is a detailed description with reference to an application example.

[0106] In related technologies, the shortcomings of the threat intelligence data interpretation solutions include:

[0107] 1. Professional limitation: Existing threat intelligence data is often aimed at network security experts and researchers, using a lot of professional terms and technical concepts that are difficult for ordinary users to understand. This results in ordinary users being unable to accurately grasp important information and warning signals of threat intelligence and unable to effectively respond to security threats.

[0108] 2. Difficulty in manual analysis: Currently, in the process of interpreting threat intelligence data, security experts are usually required to perform complex manual analysis to identify threat behaviors and attack types. However, due to the large scale and continuous updating of threat intelligence data, manual analysis is inefficient and prone to omissions.

[0109] 3. Poor interpretability: Traditional threat intelligence data is mostly based on statistics and rules. Although these methods can effectively identify threats, their results often lack intuitiveness and interpretability. Users find it difficult to understand the meaning behind them and are unable to take corresponding security measures.

[0110] 4. Lack of contextual information: Some existing threat intelligence interpretation solutions ignore the importance of contextual information, which makes it difficult for users to understand the meaning and threat level of threat intelligence data in a specific context. The lack of contextual information may lead to misunderstanding or neglect of certain key information.

[0111] Based on this, this application example provides a threat intelligence data interpretation solution based on secure GPT (i.e., the above-mentioned secure unsupervised pre-trained model), which aims to use the pre-trained secure GPT model, combined with the intelligence reputation information and context information constructed by the threat intelligence knowledge graph, to deeply interpret and analyze the threat intelligence data provided by users, and solve the problem that traditional threat intelligence data is difficult to understand and apply. In addition, by constructing a threat intelligence knowledge graph, extracting intelligence reputation information and context information, and using secure GPT to interpret threat intelligence data in natural language, it helps users better understand and apply threat intelligence data, and further improves network security protection capabilities.

[0112] Security GPT is a pre-trained model based on the Transformer architecture, which is optimized for the field of network security and has strong natural language processing capabilities and security knowledge. The threat intelligence knowledge graph is a structured model that uses graphics to represent entities in threat intelligence and their relationships, so as to more effectively understand and analyze threat intelligence.

[0113] The specific implementation process of threat intelligence data interpretation in this application example is as follows Figure 2 As shown, the specific steps are as follows:

[0114] Step 201: Data collection.

[0115] Data collection is the first step of this solution, which includes collecting threat intelligence data (the above-mentioned threat intelligence data to be processed) for building a knowledge graph, and obtaining security corpus to support the pre-training of the security GPT model.

[0116] Step 202: Knowledge graph construction.

[0117] Through web crawlers and data collection technology, threat intelligence data related to network security (the above-mentioned threat intelligence data to be processed) is collected from various threat intelligence sources (internal intelligence sources, cooperative exchange sources, supplier business sources and public intelligence sources). The collected data is preprocessed, cleaned and annotated to construct a knowledge graph. The specific process of constructing a knowledge graph is as follows: Figure 3 As shown, the specific steps are as follows:

[0118] Step 301: Data collection and processing.

[0119] Preprocess the threat intelligence data to be processed to generate structured threat intelligence data to be processed.

[0120] The collected threat intelligence data may come from multiple different sources, and their formats and structures may vary. In order to integrate this data into a unified format and eliminate noise and redundancy, data preprocessing and cleaning are required, including data format conversion, data deduplication and redundancy processing, data labeling and classification.

[0121] Step 302: Extract entities and entity relationships.

[0122] Based on the preset extraction rules, the entity set and entity relationship set corresponding to the structured threat intelligence data to be processed are extracted. The entity relationship set is used to characterize the relationship between the entities in the entity set.

[0123] First, entities with specific meanings are identified and marked from threat intelligence data, and then the associations between entities in the text are extracted. Entities include: IP addresses, domain names, file hashes, DNS servers, whois information, etc. Entity relationships include: downloading, releasing files, communication, parsing, subordination, registration, etc. Through the process of extracting entities and entity relationships, information about entities and their relationships can be obtained from threat intelligence data, providing an important data foundation for subsequent intelligence reputation information calculation and context information integration.

[0124] Step 303: Build a knowledge graph.

[0125] Determine the knowledge graph information based on the entity set and entity relationship set.

[0126] Here, based on the above-mentioned entity sets and entity relationship sets, a structured knowledge graph of threat intelligence data to be processed can be constructed, and the structured knowledge graph information of threat intelligence data to be processed can be determined. In this way, by extracting the entity sets and entity relationship sets of threat intelligence data to be processed, the knowledge graph information of threat intelligence data can be generated, which provides an important data foundation for the subsequent calculation of intelligence reputation information and the integration of contextual information.

[0127] Step 203: Modeling intelligence reputation information and context information.

[0128] In this application example, the intelligence reputation information and context information modeling are used to conduct a deeper analysis and evaluation of threat intelligence data. These two aspects of modeling will help improve the understanding and application of threat intelligence data and provide users with more accurate security decisions and defense recommendations.

[0129] The following is an exemplary description of the modeling process of the above two aspects:

[0130] 1. Intelligence reputation information modeling

[0131] For each entity in the entity set of the knowledge graph information, obtain the entity's identification information; based on the identification information and a preset mapping relationship, determine the entity's reputation evaluation rule, and the preset mapping relationship is used to characterize the correspondence between each entity's identification information and the reputation evaluation rule; based on the entity's reputation evaluation rule, determine the entity's reputation information; based on the reputation information of each entity, determine the reputation information of the threat intelligence data to be processed.

[0132] Intelligence reputation information modeling is based on the data in the threat intelligence knowledge graph, calculating the reputation score of each entity and associating it with the knowledge graph to form intelligence reputation information. The calculation of the reputation score takes into account multiple factors, such as historical attack behaviors, trusted agency evaluations, etc., so as to effectively evaluate the credibility and reputation level of the entity. Reputation information provides a credibility assessment of entities in threat intelligence data, and helps users identify potential false information or highly credible threat sources based on the evaluation results of historical behaviors and trusted sources.

[0133] 2. Contextual Information Modeling

[0134] For each entity in the entity set of the knowledge graph information, obtain the entity's identification information; based on the identification information and the entity relationship set of the knowledge graph information, generate the context information corresponding to the entity, the entity relationship set includes the relationship between the entities in the entity set, and based on the context information corresponding to each entity, determine the context information of the threat intelligence data to be processed.

[0135] First, context information is extracted from the knowledge graph information. This information may include context information corresponding to the entity, mainly including the entity relationship corresponding to the entity. For each entity in the entity set of the knowledge graph information, there is at least one corresponding entity relationship, and at least one entity relationship constitutes the context information of the entity. Here, based on the identification information of the entity and the entity relationship set of the knowledge graph information, at least one entity relationship corresponding to the entity is determined, and at least one entity relationship constitutes the context information of the entity.

[0136] Context information can also include the time, location, and affected systems of the threat event, which is obtained through text parsing, specific rules, and associating external data sources. The extracted context information is associated with the threat intelligence data to ensure that the context information corresponds to the threat intelligence data. Context information also provides a more comprehensive background for interpretation, such as the time, location, and affected systems of the threat event, which helps to more fully understand the severity and scope of the threat event.

[0137] The integration of the above reputation information and contextual information helps users better understand the meaning of threat intelligence data in specific situations by obtaining the reputation information and contextual information of threat intelligence data, such as reputation score, time, location, etc., and combining it with the interpretation process of the security GPT.

[0138] Step 204: Pre-training of secure GPT model.

[0139] Obtain an unsupervised pre-training sample set, which includes: preprocessed network security corpus; based on the preprocessed network security corpus, perform unsupervised pre-training on the neural network structure model to generate an initial security unsupervised pre-training model; based on threat intelligence sample data, preset interpretation tasks and the initial security unsupervised pre-training model, generate a security unsupervised pre-training model.

[0140] Security GPT is a model based on the Transformer architecture, which aims to provide powerful natural language processing capabilities for the field of network security. Pre-training is an important stage for the Security GPT model to be carried out on large-scale network security text data. It allows the model to learn the semantics and knowledge of the network security field through unsupervised learning, and provides valuable feature representation for the subsequent automatic interpretation and analysis of threat intelligence data. The specific workflow is as follows: Figure 4 As shown:

[0141] Step 401: Data collection and processing.

[0142] In the pre-training stage, it is necessary to collect a large-scale text corpus in the field of cybersecurity (i.e., the above-mentioned cybersecurity corpus). These text data include books, security papers, threat reports, etc. in the field of security. The text data should be diverse and comprehensive to ensure that the model can learn different types of cybersecurity knowledge. The collected text data needs to be pre-processed, that is, the cybersecurity corpus needs to be pre-processed, including word segmentation, tokenization, removal of stop words and special symbols, etc., to facilitate subsequent model pre-training.

[0143] Step 402: Model architecture and parameter initialization.

[0144] Safe GPT uses the Transformer architecture, which includes a multi-layer self-attention mechanism and a feedforward neural network. Before pre-training, it is necessary to define hyperparameters such as the number of layers, number of hidden units, and number of attention heads of the model, and perform random initialization.

[0145] Step 403: Unsupervised learning pre-training

[0146] The pre-training of Safe GPT is carried out in an unsupervised learning manner, that is, the model has no training labels or manual annotation guidance during the pre-training stage. During the pre-training process, the model masks some words or fragments in the text based on the self-attention mechanism of Transformer, and then predicts the content of these masked parts. The Safe GPT model learns the contextual information, grammatical structure and semantic representation in the text by predicting the masked parts.

[0147] Step 404: Pre-trained model is saved.

[0148] After the pre-training phase is completed, the parameters of the secure GPT model will be saved as the initial parameters of the pre-trained model. These pre-trained parameters will contain the knowledge and semantic representation learned by the model on large-scale cybersecurity text data.

[0149] Step 205: Interpret threat intelligence data based on the secure GPT.

[0150] The pre-trained security GPT model learns the semantic representation and knowledge in the field of network security on large-scale network security text data, but it is not optimized for specific threat intelligence data interpretation tasks. In order to achieve threat intelligence data interpretation, the pre-trained security GPT model needs to be fine-tuned, and then combined with the intelligence reputation information and context information constructed by the threat intelligence knowledge graph to make it more suitable for specific threat intelligence data interpretation tasks and improve the accuracy and effectiveness of interpretation.

[0151] The specific process of interpreting threat intelligence data based on secure GPT, such as Figure 5 As shown, the specific steps are as follows:

[0152] Step 501: Prepare fine-tuning data.

[0153] Collect and prepare labeled training data related to threat intelligence data interpretation tasks. This data should include the input text of threat intelligence data and the corresponding interpretation results or labels.

[0154] Step 502: Define the interpretation task.

[0155] Clearly define the objectives of the threat intelligence data interpretation task. For example, the task could be to predict the type of threat, threat level, possible affected systems, etc. based on the description in the threat intelligence data.

[0156] Step 503: Fine-tune model parameters.

[0157] Using the prepared training data, fine-tune the secure GPT model. During the fine-tuning process, the parameters of the model will be optimized based on the training data and task objectives. The fine-tuning process uses optimization algorithms such as gradient descent to update the parameters of the model.

[0158] Step 504: Evaluate and tune.

[0159] After fine-tuning is completed, use another validation dataset to evaluate the model to ensure the performance of the model in the threat intelligence data interpretation task. Based on the evaluation results, perform hyperparameter tuning and model selection to achieve the best performance. By fine-tuning the pre-trained secure GPT model, it can be more suitable for the threat intelligence data interpretation task and improve the accuracy and effect of the interpretation.

[0160] Step 505: Interpret threat intelligence data.

[0161] The structured data to be interpreted is interpreted based on a secure unsupervised pre-training model to generate an interpretation result of the threat intelligence data to be processed; the structured data to be interpreted includes: credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed.

[0162] This application example uses the security GPT model and threat intelligence knowledge graph technology to automatically interpret and analyze threat intelligence data, thereby improving the user's efficiency in understanding threat intelligence.

[0163] Combining the natural language processing capabilities of Security GPT with the intelligence reputation information of the threat intelligence knowledge graph can realize the automatic interpretation and comprehensive analysis of threat intelligence data. This combination is quite innovative in the field of network security and provides users with a new way to interpret threat intelligence.

[0164] In addition, the fine-tuned secure GPT model of the present application (i.e., the secure unsupervised pre-training model mentioned above) can more accurately understand and interpret threat intelligence data, combined with reputation information and contextual information. Among them, combining reputation information and contextual information is the key to secure GPT's interpretation of threat intelligence data. Reputation information provides a credibility assessment of entities in threat intelligence data, and helps users identify potential false information or highly credible sources of threats based on historical behaviors and evaluation results of trusted sources. At the same time, contextual information also provides a more comprehensive background for interpretation, such as the time, location, and affected systems of threat events, which helps to more fully understand the severity and scope of threat events.

[0165] In summary, this application example overcomes the shortcomings of related technologies. By utilizing the natural language processing capabilities and pre-trained security knowledge of the secure GPT, combined with technologies such as threat intelligence knowledge graph construction, intelligence reputation information extraction, and context information association, it achieves accurate interpretation and user-friendly presentation of threat intelligence data, thereby promoting users' understanding and application of threat intelligence data and improving network security protection capabilities.

[0166] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a data processing device, which corresponds to the above-mentioned data processing method, and each step in the above-mentioned data processing method embodiment is also fully applicable to the embodiment of the present data processing device.

[0167] like Figure 6 As shown, the data processing device 600 includes: an acquisition module 610, a generation module 620 and an interpretation module 630, the acquisition module 610 is used to acquire the threat intelligence data to be processed; the generation module 620 is used to pre-process the threat intelligence data to be processed, and generate structured data to be interpreted, and the structured data to be interpreted includes: credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed; the interpretation module 630 is used to interpret the structured data to be interpreted based on a secure unsupervised pre-training model, and generate an interpretation result of the threat intelligence data to be processed.

[0168] In some embodiments, the generation module 620 is also used to pre-process the threat intelligence data to be processed to generate structured threat intelligence data to be processed; based on the structured threat intelligence data to be processed, generate knowledge graph information of the threat intelligence data to be processed; based on the knowledge graph information, determine the credibility information of the threat intelligence data to be processed and / or the context information of the threat intelligence data to be processed.

[0169] In some embodiments, the data processing device 600 also includes an extraction module 640 and a determination module 650. The extraction module 640 is used to extract an entity set and an entity relationship set corresponding to the structured threat intelligence data to be processed based on preset extraction rules. The entity relationship set is used to characterize the relationship between entities in the entity set; the determination module 650 is used to determine the knowledge graph information based on the entity set and the entity relationship set.

[0170] In some embodiments, the acquisition module 610 is also used to obtain the identification information of the entity for each entity in the entity set of the knowledge graph information; the determination module 650 is also used to determine the reputation evaluation rules of the entity based on the identification information and a preset mapping relationship, and the preset mapping relationship is used to characterize the correspondence between each entity identification information and the reputation evaluation rules; based on the reputation evaluation rules of the entity, determine the reputation information of the entity; based on the reputation information of each entity, determine the reputation information of the threat intelligence data to be processed.

[0171] In some embodiments, the acquisition module 610 is also used to obtain the identification information of the entity for each entity in the entity set of the knowledge graph information; the generation module 620 is also used to generate context information corresponding to the entity based on the identification information and the entity relationship set of the knowledge graph information, and the entity relationship set includes the relationship between the entities in the entity set; the determination module 650 is also used to determine the context information of the threat intelligence data to be processed based on the context information corresponding to each entity.

[0172] In some embodiments, the acquisition module 610 is also used to acquire an unsupervised pre-training sample set, which includes: preprocessed network security corpus; the data processing device also includes a training module 660, which is used to perform unsupervised pre-training on the neural network structure model based on the preprocessed network security corpus to generate an initial secure unsupervised pre-training model; the generation module 620 is also used to generate a secure unsupervised pre-training model based on a preset interpretation task and the initial secure unsupervised pre-training model.

[0173] In some embodiments, the generation module 620 is also used to adjust the initial secure unsupervised pre-trained model based on a preset interpretation task; verify the adjusted initial secure unsupervised pre-trained model based on a verification data set to generate a verification result; and generate a secure unsupervised pre-trained model based on the verification result.

[0174] In actual application, the acquisition module 610, the generation module 620, the interpretation module 630, the extraction module 640, the determination module 650 and the training module 660 can be implemented by a processor in a data processing device. Of course, the processor needs to run the computer program in the memory to realize its function.

[0175] It should be noted that: when the data processing device provided in the above embodiment performs data processing, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the data processing device and the data processing method embodiment provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0176] Based on the hardware implementation of the above program modules and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a data processing device. Figure 7 Only an exemplary structure of the data processing device is shown, not all structures, and can be implemented as needed. Figure 7 Partial or complete structure shown.

[0177] like Figure 7 As shown, the data processing 700 provided in the embodiment of the present application includes: at least one processor 701, a memory 702, a user interface 703 and at least one network interface 704. The various components in the data processing device 700 are coupled together through a bus system 705. It can be understood that the bus system 705 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 705 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, in Figure 7 Various buses are labeled as bus system 705.

[0178] The user interface 703 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0179] The memory 702 in the embodiment of the present application is used to store various types of data to support the operation of the data processing device. Examples of such data include: any computer program used to operate on the data processing device.

[0180] The data processing method disclosed in the embodiment of the present application can be applied to the processor 701, or implemented by the processor 701. The processor 701 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the data processing method can be completed by the hardware integrated logic circuit or software instructions in the processor 701. The above-mentioned processor 701 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 701 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 702, and the processor 701 reads the information in the memory 702, and completes the steps of the data processing method provided in the embodiment of the present application in combination with its hardware.

[0181] In an exemplary embodiment, the data processing device may be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0182] It can be understood that the memory 702 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0183] In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, which may be a computer-readable storage medium, for example, a memory 702 storing a computer program, and the computer program may be executed by a processor 701 of a data processing device to complete the steps of the method of the present application. The computer-readable storage medium may be a memory such as a ROM, a PROM, an EPROM, an EEPROM, a Flash Memory, a magnetic surface memory, an optical disk, or a CD-ROM.

[0184] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0185] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0186] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: The method comprises: Obtain threat intelligence data to be processed; Preprocessing the threat intelligence data to be processed to generate structured data to be interpreted, wherein the structured data to be interpreted includes: credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed; The structured data to be interpreted is interpreted based on a secure unsupervised pre-training model to generate an interpretation result of the threat intelligence data to be processed.

2. The method according to claim 1, characterized in that The preprocessing of the threat intelligence data to be processed to generate structured data to be interpreted includes: Preprocessing the threat intelligence data to be processed to generate structured threat intelligence data to be processed; Based on the structured threat intelligence data to be processed, generating knowledge graph information of the threat intelligence data to be processed; Based on the knowledge graph information, credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed is determined.

3. The method according to claim 2, characterized in that The step of generating knowledge graph information of the threat intelligence data to be processed based on the structured threat intelligence data to be processed includes: Based on a preset extraction rule, extract an entity set and an entity relationship set corresponding to the structured threat intelligence data to be processed, wherein the entity relationship set is used to characterize the relationship between entities in the entity set; Based on the entity set and the entity relationship set, the knowledge graph information is determined.

4. The method according to claim 2, characterized in that: The determining, based on the knowledge graph information, the credibility information of the threat intelligence data to be processed includes: For each entity in the entity set of the knowledge graph information, obtaining identification information of the entity; Determining a reputation evaluation rule for the entity based on the identification information and a preset mapping relationship, wherein the preset mapping relationship is used to characterize a correspondence between each entity identification information and the reputation evaluation rule; Determining the reputation information of the entity based on the reputation evaluation rule of the entity; Based on the reputation information of each of the entities, the reputation information of the threat intelligence data to be processed is determined.

5. The method according to claim 2, characterized in that: The determining, based on the knowledge graph information, context information of the threat intelligence data to be processed includes: For each entity in the entity set of the knowledge graph information, obtaining identification information of the entity; Generate context information corresponding to the entity based on the identification information and the entity relationship set of the knowledge graph information, wherein the entity relationship set includes the relationship between entities in the entity set, Based on the context information corresponding to each of the entities, the context information of the threat intelligence data to be processed is determined.

6. The method according to claim 1, characterized in that The method further comprises: Obtaining an unsupervised pre-training sample set, wherein the unsupervised pre-training sample set includes: pre-processed network security corpus; Based on the preprocessed network security corpus, unsupervised pre-training is performed on the neural network structure model to generate an initial security unsupervised pre-training model; Based on the preset interpretation task and the initial secure unsupervised pre-trained model, the secure unsupervised pre-trained model is generated.

7. The method according to claim 6, characterized in that The generating the secure unsupervised pre-trained model based on the preset interpretation task and the initial secure unsupervised pre-trained model includes: Based on the preset interpretation task, adjusting the initial secure unsupervised pre-training model; Verify the adjusted initial secure unsupervised pre-trained model based on the verification data set and generate verification results; Based on the verification result, the secure unsupervised pre-training model is generated.

8. A data processing device, characterized in that: The device comprises: An acquisition module is used to obtain threat intelligence data to be processed; A processing module, configured to pre-process the threat intelligence data to be processed to generate structured data to be interpreted, wherein the structured data to be interpreted includes: credibility information of the threat intelligence data to be processed and / or context information of the threat intelligence data to be processed; The interpretation module is used to interpret the credibility information and / or context information of the threat intelligence data to be processed based on the secure unsupervised pre-training model to generate an interpretation result of the threat intelligence data to be processed.

9. A data processing device, characterized in that: include: A processor and a memory for storing a computer program that can be executed on the processor, wherein: The processor is used to execute the steps of the method according to any one of claims 1 to 7 when running a computer program.

10. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images