TTP description matching method, program product, electronic equipment and storage medium

Abstract

The invention provides a TTP description matching method, a program product, electronic equipment and a storage medium, and is applied to the technical field of network security, and the TTP description matching method comprises the following steps: obtaining to-be-matched data and standard description data; the to-be-matched data and the standard description data are subjected to feature extraction, target matching data corresponding to the to-be-matched data and target description data corresponding to the standard description data are obtained, the target matching data comprise matching keywords, and the target description data comprise description keywords; and matching the target matching data with the target description data to obtain a target tactics, a target technology and a target sub-technology corresponding to the to-be-matched data. In the above scheme, the matching method described by the TTP provided by the embodiment of the invention can improve the matching accuracy.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a TTP description matching method, program product, electronic device and storage medium. Background Art

[0002] In the field of network security technology, Tactics, Techniques, and Procedures (TTP) are key concepts used to describe how attackers plan and execute their attack behaviors. Among them, Tactics is the attacker's high-level goal, that is, the overall purpose or intention of the attack; Techniques is the specific means used by the attacker to achieve these tactical goals; Procedures is the detailed operation method of the attacker to implement a specific technology, which is the specific implementation and application of the technology.

[0003] At present, the frequency and complexity of cyber attacks have increased significantly, and traditional defense methods are often difficult to deal with effectively. For this reason, the role of TTP is particularly critical; TTP can reflect the behavior patterns and technical preferences of attackers, and its behavior and pattern recognition capabilities can effectively resist highly targeted advanced threats and improve the speed of security response. The cybersecurity industry's reliance on threat intelligence continues to increase, and the TTP list and framework of Adversarial Tactics, Techniques, and Common Knowledge (MITRE ATT&CK) has become a standardized language. However, the accuracy of the matching task for TTP description data in the existing technology is low. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a TTP description matching method, a program product, an electronic device and a storage medium, so as to solve the technical problem of low accuracy of the matching task for TTP description data in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a TTP description matching method, comprising: obtaining data to be matched and standard description data; performing feature extraction on the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords, and the target description data includes description keywords; matching the target matching data with the target description data to obtain target tactics, target technologies, and target sub-technologies corresponding to the data to be matched.

[0006] In the above scheme, after obtaining the data to be matched and the standard description data, the data to be matched and the standard description data can be converted into structured target matching data and target description data through feature extraction; then, by matching the target matching data and the target description data, the TTP can be located, and then the TTP description can be matched; therefore, the TTP description matching method provided in the embodiment of the present application can improve the matching accuracy.

[0007] In an optional embodiment, the target matching data is matched with the target description data to obtain the target tactics, target technology and target sub-technology corresponding to the data to be matched, including: keyword matching the target matching data with the target description data, and calculating the similarity between the target matching data and the target description data to obtain the target tactics and the target technology; calculating the scores of the target matching data and the data corresponding to the target technology under the target tactics in the target description data to obtain the target sub-technology. In the above scheme, the tactics and technologies are first preliminarily located by entity resolution to determine the target tactics and target technology; then the sub-technology is precisely located by hybridization to determine the target sub-technology. Compared with the method of matching all data in the prior art, the matching accuracy can be improved and the matching calculation amount can be reduced.

[0008] In an optional implementation, the keyword matching of the target matching data with the target description data includes: matching the matching keywords in the target matching data with the description keywords under each technology in the target description data to obtain the number of keyword hits corresponding to each technology. In the above scheme, the target tactics corresponding to the target matching data can be initially located by entity resolution, thereby improving the accuracy and efficiency of matching.

[0009] In an optional implementation, the calculation of the similarity between the target matching data and the target description data to obtain the target technology includes: calculating the similarity corresponding to each technology based on the number of keyword hits and feature weights; determining the technology under the tactic with the highest similarity as the target tactic and the target technology. In the above scheme, the target technology corresponding to the target matching data under the target tactic can be preliminarily located by entity resolution, thereby improving the matching accuracy and matching efficiency.

[0010] In an optional implementation, the calculation of the scores between the target matching data and the data corresponding to the target technology under the target tactics in the target description data to obtain the target tactics and the target sub-technology includes: calculating the keyword similarity corresponding to each sub-technology based on the number of keyword hits and feature weights; calculating the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactics in the target description data; calculating the weighted sum of the keyword similarity and the semantic similarity to obtain the score; and determining the sub-technology with the highest score as the target sub-technology. In the above scheme, after determining the target tactics and target technology corresponding to the target matching data, the target sub-technology corresponding to the target matching data under the target technology under the target tactics can be finely matched in combination with the semantic similarity, thereby improving the matching accuracy and matching efficiency.

[0011] In an optional implementation, feature extraction is performed on the standard description data to obtain target description data corresponding to the standard description data, including: preprocessing the standard description data; feature extraction is performed on the preprocessed standard description data based on a keyword dictionary to determine the matching keywords included in the standard description data; and format conversion is performed on the feature-extracted standard description data to obtain the target description data. In the above scheme, by performing feature extraction on the standard description data and format conversion on the standard description data, the standard description data can be converted into structured target description data, so that subsequent TTP description matching can be performed based on the structured target description data. Among them, matching based on structured data can improve the accuracy of matching.

[0012] In an optional embodiment, before obtaining the data to be matched and the standard description data, the method further includes: constructing a tree diagram based on the standard framework and storing node data corresponding to each leaf node; constructing a keyword dictionary based on the node data, wherein the keyword dictionary includes keywords and numbers corresponding to the keywords. In the above scheme, by storing the standard framework in a hierarchical tree structure and extracting features by constructing a keyword dictionary, information redundancy can be reduced.

[0013] In the second aspect, an embodiment of the present application provides a matching device for TTP description, comprising: an acquisition module, used to acquire data to be matched and standard description data; an extraction module, used to perform feature extraction on the data to be matched and the standard description data, to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords, and the target description data includes description keywords; a matching module, used to match the target matching data with the target description data, to obtain target tactics, target technologies and target sub-technologies corresponding to the data to be matched.

[0014] In the above scheme, after obtaining the data to be matched and the standard description data, the data to be matched and the standard description data can be converted into structured target matching data and target description data through feature extraction; then, by matching the target matching data and the target description data, the TTP can be located, and then the TTP description can be matched; therefore, the TTP description matching method provided in the embodiment of the present application can improve the matching accuracy.

[0015] In an optional implementation, the matching module is specifically used to: perform keyword matching between the target matching data and the target description data, and calculate the similarity between the target matching data and the target description data to obtain the target tactics and the target technology; calculate the scores of the target matching data and the data corresponding to the target technology under the target tactics in the target description data to obtain the target sub-technology. In the above scheme, the tactics and technologies are first preliminarily located by entity parsing to determine the target tactics and target technology; then the sub-technologies are mixed and accurately located to determine the target sub-technology. Compared with the method of matching all data in the prior art, the matching accuracy can be improved and the matching calculation amount can be reduced.

[0016] In an optional implementation, the matching module is further used to match the matching keywords in the target matching data with the description keywords under each technology in the target description data to obtain the number of keyword hits corresponding to each technology. In the above scheme, the target tactics corresponding to the target matching data can be initially located by entity resolution, thereby improving the accuracy and efficiency of matching.

[0017] In an optional implementation, the matching module is further used to: calculate the similarity corresponding to each technology based on the number of keyword hits and feature weights; determine the technology under the tactic with the highest similarity as the target tactic and the target technology. In the above scheme, the target technology corresponding to the target matching data under the target tactic can be preliminarily located by entity resolution, thereby improving the matching accuracy and matching efficiency.

[0018] In an optional implementation, the matching module is also used to: match the matching keywords in the target matching data with the descriptive keywords under each sub-technology in the data corresponding to the target technology under the target tactics in the target description data to obtain the number of keyword hits corresponding to each sub-technology; calculate the keyword similarity corresponding to each sub-technology based on the number of keyword hits and feature weights; calculate the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactics in the target description data; calculate the weighted sum of the keyword similarity and the semantic similarity to obtain the score; determine the sub-technology with the highest score as the target sub-technology. In the above scheme, after determining the target tactics and target technology corresponding to the target matching data, the target sub-technology corresponding to the target matching data under the target technology under the target tactics can be finely matched in combination with the semantic similarity, thereby improving the matching accuracy and matching efficiency.

[0019] In an optional implementation, the extraction module is specifically used to: preprocess the standard description data; perform feature extraction on the preprocessed standard description data based on a keyword dictionary to determine the matching keywords included in the standard description data; perform format conversion on the feature-extracted standard description data to obtain the target description data. In the above scheme, by performing feature extraction on the standard description data and format conversion on the standard description data, the standard description data can be converted into structured target description data, so that subsequent TTP description matching can be performed based on the structured target description data. Among them, matching based on structured data can improve the accuracy of matching.

[0020] In an optional embodiment, the matching method described by the TTP further includes: a first construction module for constructing a tree diagram based on a standard framework and storing node data corresponding to each leaf node; a second construction module for constructing a keyword dictionary based on the node data, wherein the keyword dictionary includes keywords and numbers corresponding to the keywords. In the above scheme, by storing the standard framework in a hierarchical tree structure and extracting features by constructing a keyword dictionary, information redundancy can be reduced.

[0021] In a third aspect, an embodiment of the present application provides a computer program product, including computer program instructions, which, when read and executed by a processor, execute the matching method described by the TTP as described in the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus; the processor and the memory communicate with each other through the bus; the memory stores computer program instructions that can be executed by the processor, and the processor calls the computer program instructions to execute the matching method described by the TTP as described in the first aspect.

[0023] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer program instructions. When the computer program instructions are executed by a computer, the computer executes the matching method described by the TTP as described in the first aspect.

[0024] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the following specifically cites the embodiments of the present application and describes them in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 A flowchart of a TTP description matching method provided in an embodiment of the present application;

[0027] Figure 2 A schematic diagram of outputting json format provided in an embodiment of the present application;

[0028] Figure 3 A standard data tree structure diagram provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram of a leaf node sub-technical data storage format provided in an embodiment of the present application;

[0030] Figure 5 A structural block diagram of a matching device for TTP description provided in an embodiment of the present application;

[0031] Figure 6 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0033] Please refer to Figure 1 , Figure 1 A flowchart of a TTP description matching method provided in an embodiment of the present application, the TTP description matching method may specifically include the following steps:

[0034] Step S101: Acquire the data to be matched and the standard description data.

[0035] Step S102: extracting features from the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords and the target description data includes description keywords.

[0036] Step S103: Match the target matching data with the target description data to obtain the target tactics, target technology and target sub-technology corresponding to the data to be matched.

[0037] Specifically, in the above step S101, the data to be matched refers to the TTP description fragment obtained from the Internet, including the TTP description fragment in other text data such as articles and reports, and the TTP name corresponding to the TTP description fragment is unknown. The standard description data refers to the official standard description fragment in the MITRE ATT&CK (MITRE Adversarial Tactics, Techniques, and Common Knowledge) attack library, and the TTP name corresponding to the standard description fragment is known.

[0038] Among them, the MITRE ATT&CK attack library divides attacks into 14 tactics; each tactic contains 196 techniques; each technique may include zero, one or more sub-techniques, with a total of 411 sub-techniques; each tactic, technique and sub-technique includes the following information: identification (ID), name and description. It is understandable that the above standard description data may include description fragments corresponding to all or part of the sub-techniques in the above attack library.

[0039] It should be noted that the embodiments of the present application do not specifically limit the specific implementation methods for obtaining the data to be matched and the standard description data, and those skilled in the art may make appropriate adjustments according to actual conditions. For example, the data to be matched and the standard description data sent by an external device may be received; or the data to be matched and the standard description data pre-stored locally or in the cloud may be read.

[0040] It can be understood that, as an implementation mode, the above-mentioned data to be matched and the standard description data can be obtained in the same manner; as another implementation mode, the above-mentioned data to be matched and the standard description data can also be obtained in different manners.

[0041] In the above step S102, the embodiment of the present application does not specifically limit the specific implementation method of obtaining the data to be matched and the standard description data, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the above data to be matched and the standard description data can be input into a pre-trained machine learning model for feature extraction; or, feature extraction can be achieved by keyword matching the above data to be matched and the standard description data.

[0042] As an implementation, after feature extraction of the data to be matched and the standard description data, the target matching data and the target description data obtained may be structured data. As another implementation, the target matching data may include matching keywords, and the target description data may include description keywords.

[0043] In the above step S103, the embodiment of the present application does not specifically limit the specific implementation method of matching the target matching data with the target description data, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the similarity between the target matching data and the target description data can be calculated; or, the target matching data and the target description data can be matched by keyword matching; or, the target matching data and the target description data can be input into a pre-trained machine learning model for matching, etc.

[0044] The result of the match is: determining the target tactics, target technology, and target sub-technology corresponding to the target matching data and the to-be-matched data. It is understandable that after determining the above target tactics, target technology, and target sub-technology, they can be further applied to the security intelligence platform to help security analysts identify the latest attack patterns, track attacker behavior, and improve intelligence analysis efficiency.

[0045] In the above scheme, after obtaining the data to be matched and the standard description data, the data to be matched and the standard description data can be converted into structured target matching data and target description data through feature extraction; then, by matching the target matching data and the target description data, the TTP can be located, and then the TTP description can be matched; therefore, the TTP description matching method provided in the embodiment of the present application can improve the matching accuracy.

[0046] Further, based on the above embodiment, the above step S103 may specifically include the following steps:

[0047] Step 1) keyword matching is performed between the target matching data and the target description data, and the similarity between the target matching data and the target description data is calculated to obtain the target tactics and target technology.

[0048] Step 2), calculate the scores of the target matching data and the data corresponding to the target technology under the target tactics in the target description data to obtain the target sub-technology.

[0049] Specifically, in the above step 1), the matching of tactics and techniques can be achieved by entity resolution (ER). Among them, the entity resolution method is often used for structured or semi-structured data, especially in the fields of database management, data cleaning and information fusion. As an implementation method, the target tactics can be obtained by keyword matching the target matching data with the target description data.

[0050] It can be understood that after the above step 1), one tactic can be determined as the target tactic from the 14 tactics, and the other 13 tactics can be discarded; one technology can be determined as the target technology from the 196 technologies under the target tactic, and the other 195 technologies can be discarded, and subsequently only the data corresponding to the target technology under the target tactic in the target description data will be further matched.

[0051] As an implementation method, the target tactics and target technology can be obtained by calculating the similarity between the target matching data and the target description data.

[0052] It should be noted that the embodiments of the present application do not specifically limit the specific implementation methods for keyword matching of target matching data and target description data, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the similarity between the keywords in the target matching data and the keywords in the target description data can be calculated; or, the keywords in the target matching data can be compared with the keywords in the target description data; or, the target matching data and the target description data can be input into a pre-trained machine learning model for keyword matching, etc.

[0053] In addition, the embodiments of the present application do not specifically limit the specific implementation method for calculating the similarity between the target matching data and the target description data, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the cosine similarity between the target matching data and the target description data can be calculated; or the Euclidean distance between the target matching data and the target description data can be calculated; or the target matching data and the target description data can be input into a pre-trained machine learning model to perform similarity calculation, etc.

[0054] As an implementation method, the target description data can be divided into blocks. In the target description data, each branch can be divided into a group based on the tree diagram, that is, a node set extending from the parent node of a certain tactical layer to its child node of the technical layer and then to the leaf node of its child technical layer. Among them, the tactical layer inherits all the field attributes of its lower technical layer; each node of the technical layer inherits all the field attributes of its extended child technical layer, including the node's own attributes. If a certain technical layer node has no child node under it, it only has its own attributes.

[0055] In the above step 2), the embodiment of the present application does not specifically limit the specific implementation method of calculating the scores of the target matching data and the data corresponding to the target technology under the target tactics in the target description data, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, the above score can be obtained by calculating the keyword similarity between the target matching data and the target description data; or, the above score can be obtained by calculating the semantic similarity between the target matching data and the target description data; or, the target matching data and the target description data can be input into a pre-trained machine learning model for score calculation, etc.

[0056] It can be understood that after the above step 2), one technology can be determined as the target sub-technology from the 411 technologies under the target technology under the target tactics; the target sub-technology is the sub-technology under the target technology under the target tactics determined in the above step 1).

[0057] In the above scheme, firstly, the tactics and technologies are initially located by entity analysis to determine the target tactics and target technologies; then, the sub-technologies are precisely located by hybridization to determine the target sub-technologies. Compared with the existing method of matching all data, this method can improve the matching accuracy and reduce the matching calculation amount.

[0058] Further, based on the above embodiment, the keyword matching of the target matching data and the target description data may specifically include the following steps:

[0059] Match the matching keywords in the target matching data with the description keywords under each technology in the target description data to obtain the number of keyword hits corresponding to each technology.

[0060] Specifically, in the above steps, the matching keywords in the target matching data are matched with the description keywords under each technology in the target description data to obtain the number of keyword hits corresponding to each technology.

[0061] As an implementation method, the target description data can be divided into blocks. In the target description data, each branch can be divided into a group based on the tree diagram, that is, a node set extending from the parent node of a certain tactical layer to its child node of the technical layer and then to the leaf node of its child technical layer. Among them, the tactical layer inherits all the field attributes of its lower technical layer; each node of the technical layer inherits all the field attributes of its extended child technical layer, including the node's own attributes. If a certain technical layer node has no child node under it, it only has its own attributes.

[0062] Based on the block with the highest number of keyword hits, it is considered that the target matching data has the highest probability of appearing in the child node of the current block. The tactical block corresponding to the child node is determined as the target tactic, and the other 13 tactical blocks are directly discarded.

[0063] In the above scheme, the target tactics corresponding to the target matching data can be initially located by means of entity resolution, thereby improving the matching accuracy and matching efficiency.

[0064] Further, based on the above embodiment, the above step of calculating the similarity between the target matching data and the target description data to obtain the target tactics and target technology may specifically include the following steps:

[0065] Step 1), calculate the similarity corresponding to each technology based on the number of keyword hits and feature weights.

[0066] Step 2), determining the technology under the tactic with the highest similarity as the target tactic and the target technology.

[0067] Specifically, in the above step 1), the similarity corresponding to each technology can be calculated based on the number of keyword hits and the feature weight. Among them, each extracted feature field can be sorted and assigned according to importance to obtain the corresponding feature weight; the above feature fields include: attack object, attack method, attack technique, attack stage, attack goal and attack impact.

[0068] It should be noted that the present application embodiment does not specifically limit the specific implementation method of calculating the similarity, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, let E∈ standard data set, e∈ to-be-processed data set, where E i =(V i1 ,V i2 ,V i3 ,V i4,V i5 )、e i =(v i1 ,v i2 ,v i3 ,v i4 ,v i5 ); Calculate the similarity between the two. There are many formulas for calculating similarity, such as Jaccard, and calculate the overall similarity The similarity score is recorded as S, and the Sigmoid function is selected as input to calculate the possibility of whether the data to be determined belongs to the current technical layer node.

[0069] In the above step 2), the obtained similarities (which may be normalized probability values) may be arranged in descending order, and the technology block corresponding to the highest similarity may be selected as the target technology, and the target matching data may be considered to belong to the technology node or its extended sub-technology node.

[0070] In the above scheme, the target technology corresponding to the target matching data under the target tactics can be preliminarily located by means of entity parsing, thereby improving the matching accuracy and matching efficiency.

[0071] Further, based on the above embodiment, the step of calculating the scores of the target matching data and the data corresponding to the target technology under the target tactics in the target description data to obtain the target sub-technology may specifically include the following steps:

[0072] Step 1) Match the matching keywords in the target matching data with the description keywords under each sub-technology in the data corresponding to the target technology under the target tactics in the target description data to obtain the number of keyword hits corresponding to each sub-technology.

[0073] Step 2), based on the number of keyword hits and feature weights, the keyword similarity corresponding to each sub-technology is calculated.

[0074] Step 3), calculate the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactics in the target description data.

[0075] Step 4), calculate the weighted sum of keyword similarity and semantic similarity to obtain a score.

[0076] Step 5), determine the sub-technology with the highest score as the target sub-technology.

[0077] Specifically, in the above step 3), the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactics in the target description data can be calculated. As an implementation method, the target matching data and the target description data can be input into the word segmenter and the RoBERTa model for word segmentation and encoding, and the average pooled output of the text is taken, and the similarity between the two is calculated to quantify the semantic similarity between the two; wherein, the similarity formula can be selected, for example, cosine similarity or Euclidean distance, etc., and the embodiment of the present application does not make specific limitations on this.

[0078] In addition, after calculating the keyword similarity corresponding to each sub-technology in step 2), the keyword similarities can be arranged in descending order, and the TOP N sub-technology can be selected to execute the above step 3).

[0079] In the above step 4), the score can be obtained by calculating the weighted sum of the keyword similarity and the semantic similarity. The weights of the keyword similarity and the semantic similarity can be set in advance.

[0080] In the above step 5), the matching pair with the highest score can be obtained, and the name and ID of the target matching data are considered to be the name and ID of the matched target description data.

[0081] In the above scheme, after determining the target tactics and target technology corresponding to the target matching data, the target sub-technology corresponding to the target matching data under the target technology under the target tactics can be finely matched in combination with semantic similarity, thereby improving the matching accuracy and efficiency.

[0082] Further, based on the above embodiment, the step of extracting features from the standard description data in the above step S102 may specifically include the following steps:

[0083] Step 1), preprocess the standard description data.

[0084] Step 2) performs feature extraction on the preprocessed standard description data based on the keyword dictionary to determine matching keywords included in the standard description data.

[0085] Step 3), convert the format of the standard description data after feature extraction to obtain target description data.

[0086] Specifically, in the above step 1), the embodiment of the present application does not specifically limit the specific implementation method of preprocessing, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, stop words (such as "the", "is", "may", etc.) can be removed first; then word segmentation is performed, and the TTP description field is segmented according to spaces or punctuation marks; finally, standardization is performed to process abbreviations and unified terms to ensure that ambiguous expressions are converted into a unified form.

[0087] In the above step 2), feature extraction can be performed on the preprocessed standard description data based on the keyword dictionary to determine the matching keywords included in the standard description data. As an implementation method, each word in the preprocessed standard description data can be matched with the keywords in the keyword dictionary, and the matched keywords can obtain their feature labels and numbers.

[0088] As an implementation manner, the feature tag may include attack object, attack method, attack technique, attack stage, attack goal, attack impact, etc.

[0089] In the above step 3), the standard description data after feature extraction can be converted to obtain target description data. As an implementation method, the standard description data after feature extraction can be converted into the input format of RoBERTa; the converted data is then processed by the RoBERTa model, and the predicted label of each keyword is output and converted into a structured json format for subsequent entity resolution. Please refer to Figure 2 , Figure 2 A schematic diagram of outputting json format provided in an embodiment of the present application.

[0090] In the above scheme, by extracting features from the standard description data and converting the format of the standard description data, the standard description data can be converted into structured target description data, so that subsequent TTP description matching can be performed based on the structured target description data. Matching based on structured data can improve the matching accuracy.

[0091] Further, based on the above embodiment, the step of extracting features from the data to be matched in step S102 is similar to the step of extracting features from the standard description data, and will not be repeated here. According to the official description standard, the length of the acquired data to be matched can be set to no more than 5 sentences.

[0092] Further, based on the above embodiment, before the above step S101, the TTP description matching method provided in the embodiment of the present application may further include the following steps:

[0093] Step 1) constructs a tree diagram based on a standard framework and stores the node data corresponding to each leaf node.

[0094] Step 2), constructing a keyword dictionary based on the node data, wherein the keyword dictionary includes keywords and numbers corresponding to the keywords.

[0095] Specifically, in the above step 1), a tree diagram can be constructed based on the MITRE ATT&CK standard framework, and the node data corresponding to each leaf node can be stored. Among them, the MITRE ATT&CK attack library divides attacks into 14 tactics; each tactic contains several techniques, a total of 196 items; each technique may include zero, one or more sub-techniques, a total of 411 items. Each tactic, technique, and sub-technique includes information {ID, name, description}.

[0096] As an implementation method, the data can be divided into three levels and numbered according to the standard framework. The first level is the tactical level, the second level is the technical level, and the third level is the sub-technical level; each level sorts and numbers the technology according to the current category. Please refer to Figure 3 and Figure 4 , Figure 3 A standard data tree structure diagram provided in an embodiment of the present application, Figure 4 A schematic diagram of a leaf node sub-technical data storage format provided in an embodiment of the present application.

[0097] In the above step 2), a keyword dictionary may be constructed based on the above node data. As an implementation method, a keyword dictionary of the official description part may be constructed by manually screening keywords.

[0098] The keyword dictionary may include keywords and numbers corresponding to the keywords. As an implementation, the format of the keyword dictionary may be: one keyword (word or phrase) per line, each keyword has an independent number, and the keyword and the corresponding number may be separated by a space; in addition, it may be ensured that there is no blank line between each line of keywords.

[0099] In the above scheme, information redundancy can be reduced by storing the standard framework in a hierarchical tree structure and extracting features by constructing a keyword dictionary.

[0100] Please refer to Figure 5 , Figure 5A structural block diagram of a TTP description matching device provided in an embodiment of the present application, the TTP description matching device 500 includes: an acquisition module 501, used to obtain data to be matched and standard description data; an extraction module 502, used to perform feature extraction on the data to be matched and the standard description data, and obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords, and the target description data includes description keywords; a matching module 503, used to match the target matching data with the target description data, and obtain target tactics, target technologies, and target sub-technologies corresponding to the data to be matched.

[0101] In the above scheme, after obtaining the data to be matched and the standard description data, the data to be matched and the standard description data can be converted into structured target matching data and target description data through feature extraction; then, by matching the target matching data and the target description data, the TTP can be located, and then the TTP description can be matched; therefore, the TTP description matching method provided in the embodiment of the present application can improve the matching accuracy.

[0102] Further, based on the above embodiment, the matching module 503 is specifically used to: perform keyword matching on the target matching data and the target description data, and calculate the similarity between the target matching data and the target description data to obtain the target tactics and the target technology; calculate the scores of the target matching data and the data corresponding to the target technology under the target tactics in the target description data to obtain the target sub-technology.

[0103] In the above scheme, firstly, the tactics and technologies are initially located by entity analysis to determine the target tactics and target technologies; then, the sub-technologies are precisely located by hybridization to determine the target sub-technologies. Compared with the existing method of matching all data, this method can improve the matching accuracy and reduce the matching calculation amount.

[0104] Further, based on the above embodiment, the matching module 503 is also used to: match the matching keywords in the target matching data with the description keywords under each technology in the target description data to obtain the number of keyword hits corresponding to each technology.

[0105] In the above scheme, the target tactics corresponding to the target matching data can be initially located by means of entity resolution, thereby improving the matching accuracy and matching efficiency.

[0106] Furthermore, based on the above embodiment, the matching module 503 is also used to: calculate the similarity corresponding to each technology based on the number of keyword hits and feature weights; and determine the technology under the tactic with the highest similarity as the target tactic and the target technology.

[0107] In the above scheme, the target technology corresponding to the target matching data under the target tactics can be preliminarily located by means of entity parsing, thereby improving the matching accuracy and matching efficiency.

[0108] Furthermore, based on the above embodiments, the matching module 503 is also used to: match the matching keywords in the target matching data with the descriptive keywords under each sub-technology in the data corresponding to the target technology under the target tactics in the target description data to obtain the number of keyword hits corresponding to each sub-technology; calculate the keyword similarity corresponding to each sub-technology based on the number of keyword hits and feature weights; calculate the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactics in the target description data; calculate the weighted sum of the keyword similarity and the semantic similarity to obtain the score; and determine the sub-technology with the highest score as the target sub-technology.

[0109] In the above scheme, after determining the target tactics and target technology corresponding to the target matching data, the target sub-technology corresponding to the target matching data under the target technology under the target tactics can be finely matched in combination with semantic similarity, thereby improving the matching accuracy and efficiency.

[0110] Further, based on the above embodiment, the extraction module 502 is specifically used for: preprocessing the standard description data; performing feature extraction on the preprocessed standard description data based on a keyword dictionary to determine the matching keywords included in the standard description data; and performing format conversion on the standard description data after feature extraction to obtain the target description data.

[0111] In the above scheme, by extracting features from the standard description data and converting the format of the standard description data, the standard description data can be converted into structured target description data, so that subsequent TTP description matching can be performed based on the structured target description data. Matching based on structured data can improve the matching accuracy.

[0112] Furthermore, based on the above embodiments, the matching device 200 described by the TTP also includes: a first construction module, used to construct a tree diagram based on a standard framework and store node data corresponding to each leaf node; a second construction module, used to construct a keyword dictionary based on the node data, wherein the keyword dictionary includes keywords and numbers corresponding to the keywords.

[0113] In the above scheme, information redundancy can be reduced by storing the standard framework in a hierarchical tree structure and extracting features by constructing a keyword dictionary.

[0114] Please refer to Figure 6 , Figure 6 The structural block diagram of an electronic device provided in an embodiment of the present application, the electronic device 600 includes: at least one processor 601, at least one communication interface 602, at least one memory 603 and at least one communication bus 604. Among them, the communication bus 604 is used to realize the direct connection and communication of these components, the communication interface 602 is used to communicate signaling or data with other node devices, and the memory 603 stores machine-readable instructions executable by the processor 601. When the electronic device 600 is running, the processor 601 communicates with the memory 603 through the communication bus 604, and the matching method described in the above TTP is executed when the machine-readable instructions are called by the processor 601.

[0115] For example, the processor 601 of the embodiment of the present application reads a computer program from the memory 603 through the communication bus 604 and executes the computer program to implement the following method: obtain the data to be matched and the standard description data; perform feature extraction on the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords and the target description data includes description keywords; match the target matching data with the target description data to obtain the target tactics, target technology and target sub-technology corresponding to the data to be matched.

[0116] Among them, the processor 601 includes one or more, which can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 601 can be a general-purpose processor, including a central processing unit (CPU), a micro control unit (MCU), a network processor (NP) or other conventional processors; it can also be a dedicated processor, including a neural network processor (NPU), a graphics processor (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. In addition, when there are multiple processors 601, some of them can be general-purpose processors and the other part can be dedicated processors.

[0117] The memory 603 includes one or more, which may be, but not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.

[0118] Understandably, Figure 6 The structure shown is for illustration only. The electronic device 600 may also include Figure 6 More or fewer components as shown, or with Figure 6 Different configurations shown. Figure 6Each component shown in can be implemented by hardware, software or a combination thereof. In the embodiment of the present application, the electronic device 600 can be, but not limited to, a physical device such as a desktop computer, a laptop computer, a smart phone, a smart wearable device, a vehicle-mounted device, etc., and can also be a virtual device such as a virtual machine. In addition, the electronic device 600 is not necessarily a single device, but can also be a combination of multiple devices, such as a server cluster, etc.

[0119] The embodiment of the present application also provides a computer program product, including a computer program stored on a computer-readable storage medium, the computer program including computer program instructions, when the computer program instructions are executed by the computer, the computer can execute the steps of the matching method described in the TTP in the above embodiment, for example including: Step S101: Obtain the data to be matched and the standard description data. Step S102: Perform feature extraction on the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords and the target description data includes description keywords. Step S103: Match the target matching data with the target description data to obtain the target tactics, target technology and target sub-technology corresponding to the data to be matched.

[0120] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer program instructions. When the computer program instructions are executed by a computer, the computer executes the matching method described by the TTP described in the aforementioned method embodiment.

[0121] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0122] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0123] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0124] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM) random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0125] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0126] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A matching method for TTP description, characterized in that: include: Obtain the data to be matched and the standard description data; Performing feature extraction on the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords and the target description data includes description keywords; The target matching data is matched with the target description data to obtain the target tactics, target technology and target sub-technology corresponding to the data to be matched.

2. The TTP description matching method according to claim 1, characterized in that: The matching of the target matching data with the target description data to obtain target tactics, target technology and target sub-technology corresponding to the to-be-matched data includes: Perform keyword matching on the target matching data and the target description data, and calculate the similarity between the target matching data and the target description data to obtain the target tactics and the target technology; The scores of the target matching data and the data corresponding to the target technology under the target tactics in the target description data are calculated to obtain the target sub-technology.

3. The TTP description matching method according to claim 2, characterized in that: The keyword matching the target matching data with the target description data includes: The matching keywords in the target matching data are matched with the description keywords under each technology in the target description data to obtain the number of keyword hits corresponding to each technology.

4. The matching method for TTP description according to claim 3, characterized in that: The calculating the similarity between the target matching data and the target description data to obtain the target tactics and the target technology includes: Calculate the similarity corresponding to each technology based on the number of keyword hits and feature weights; The technology under the tactic with the highest similarity is determined as the target tactic and the target technology.

5. The TTP description matching method according to claim 2, characterized in that: The calculating the score of the target matching data and the data corresponding to the target technology under the target tactics in the target description data to obtain the target sub-technology includes: Matching the matching keywords in the target matching data with the description keywords under each sub-technology in the data corresponding to the target technology under the target tactics in the target description data to obtain the number of keyword hits corresponding to each sub-technology; Calculate the keyword similarity corresponding to each sub-technology based on the number of keyword hits and feature weights; Calculating the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactics in the target description data; Calculating a weighted sum of the keyword similarity and the semantic similarity to obtain the score; The sub-technology with the highest score is determined as the target sub-technology.

6. The TTP description matching method according to claim 1, characterized in that: Performing feature extraction on the standard description data to obtain target description data corresponding to the standard description data includes: Preprocessing the standard description data; Performing feature extraction on the preprocessed standard description data based on the keyword dictionary to determine the matching keywords included in the standard description data; The standard description data after feature extraction is format converted to obtain the target description data.

7. The TTP description matching method according to any one of claims 1 to 6, characterized in that: Before obtaining the data to be matched and the standard description data, the method further includes: Build a tree diagram based on the standard framework and store the node data corresponding to each leaf node; A keyword dictionary is constructed based on the node data, wherein the keyword dictionary includes keywords and numbers corresponding to the keywords.

8. A computer program product, characterized in that The method comprises computer program instructions, and when the computer program instructions are read and executed by a processor, the matching method described by the TTP according to any one of claims 1 to 7 is executed.

9. An electronic device, characterized in that: include: processor, memory, and bus; The processor and the memory communicate with each other via the bus; The memory stores computer program instructions executable by the processor, and the processor calls the computer program instructions to execute the matching method described by the TTP according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a computer, the computer is enabled to perform the matching method described by the TTP according to any one of claims 1 to 7.

Images