A matching method, program product, electronic device and storage medium described by a TTP

Abstract

The application provides a TTP description matching method, a program product, an electronic device and a storage medium, and is applied to the technical field of network security, wherein the TTP description matching method comprises the following steps: obtaining to-be-matched data and standard description data; performing feature extraction on the to-be-matched data and the standard description data to obtain target matching data corresponding to the to-be-matched data and target description data corresponding to the standard description data, wherein the target matching data comprises a matching keyword, and the target description data comprises a description keyword; and matching the target matching data with the target description data to obtain target tactics, target technology and target sub-technology corresponding to the to-be-matched data. In the above scheme, the TTP description matching method provided by the application can improve the accuracy of matching.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a TTP description matching method, program product, electronic device, and storage medium. Background Technology

[0002] In the field of cybersecurity technology, Tactics, Techniques, and Procedures (TTP) are key concepts used to describe how attackers plan and execute their attacks. Tactics are the attacker's high-level objectives, i.e., the overall purpose or intent of the attack; Techniques are the specific means by which the attacker achieves these tactical objectives; and Procedures are the detailed operational methods by which the attacker implements specific techniques—the concrete ways in which the techniques are carried out and applied.

[0003] Currently, the frequency and complexity of cyberattacks are increasing significantly, and traditional defense methods are often insufficient to effectively counter them. Therefore, the role of Threat Intelligence (TTP) is particularly crucial; TTPs reflect attackers' behavioral patterns and technical preferences, and their behavioral and pattern recognition capabilities effectively defend against highly targeted advanced threats, improving the speed of security response. The cybersecurity industry's reliance on threat intelligence is constantly increasing, and TTP lists and frameworks from the Adversarial Tactics, Techniques, and Common Knowledge (MITRE ATT&CK) have become a standardized language. However, the accuracy of matching TTP descriptive data in existing technologies remains low. Summary of the Invention

[0004] The purpose of this application is to provide a TTP description matching method, program product, electronic device and storage medium to solve the technical problem of low accuracy in the prior art for TTP description data matching tasks.

[0005] In a first aspect, embodiments of this application provide a method for matching TTP descriptions, comprising: acquiring data to be matched and standard description data; performing feature extraction on the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords and the target description data includes description keywords; and matching the target matching data with the target description data to obtain target tactics, target technologies, and target sub-technologies corresponding to the data to be matched.

[0006] In the above scheme, after obtaining the data to be matched and the standard description data, the data to be matched and the standard description data can be transformed into structured target matching data and target description data through feature extraction; then, by matching the target matching data and the target description data, the TTP can be located, and thus the TTP description can be matched; therefore, the TTP description matching method provided in this application embodiment can improve the matching accuracy.

[0007] In an optional implementation, matching the target matching data with the target description data to obtain the target tactics, target techniques, and target sub-techniques corresponding to the data to be matched includes: performing keyword matching between the target matching data and the target description data, and calculating the similarity between the target matching data and the target description data to obtain the target tactics and the target techniques; calculating the scores of the data corresponding to the target techniques under the target tactics in the target matching data and the target description data to obtain the target sub-techniques. In the above scheme, the tactics and techniques are first preliminarily located through entity parsing to determine the target tactics and target techniques; then, the sub-techniques are precisely located through hybrid matching to determine the target sub-techniques. Compared with the existing method of matching all data, this method can improve the accuracy of matching and reduce the amount of computation involved.

[0008] In an optional implementation, the step of performing keyword matching between the target matching data and the target description data includes: matching the matching keywords in the target matching data with the descriptive keywords under each technology in the target description data to obtain the number of keyword hits corresponding to each technology. In the above scheme, the target tactics corresponding to the target matching data can be initially located through entity parsing, thereby improving the accuracy and efficiency of matching.

[0009] In an optional implementation, calculating the similarity between the target matching data and the target description data to obtain the target technology includes: calculating the similarity corresponding to each technology based on the number of keyword hits and feature weights; and determining the technology under the tactic with the highest similarity as the target tactic and the target technology. In the above scheme, the target technology corresponding to the target matching data under the target tactic can be initially located through entity parsing, thereby improving the accuracy and efficiency of matching.

[0010] In an optional implementation, calculating the score between the target matching data and the data corresponding to the target technology under the target tactic in the target description data to obtain the target tactic and the target sub-technology includes: calculating the keyword similarity corresponding to each sub-technology based on the number of keyword hits and feature weights; calculating the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactic in the target description data; calculating the weighted sum of the keyword similarity and the semantic similarity to obtain the score; and determining the sub-technology with the highest score as the target sub-technology. In the above scheme, after determining the target tactic and target technology corresponding to the target matching data, the semantic similarity can be combined to perform fine matching on the target sub-technology corresponding to the target matching data under the target tactic, thereby improving the accuracy and efficiency of matching.

[0011] In an optional implementation, feature extraction is performed on the standard description data to obtain target description data corresponding to the standard description data. This includes: preprocessing the standard description data; extracting features from the preprocessed standard description data based on a keyword dictionary to determine the matching keywords included in the standard description data; and converting the format of the feature-extracted standard description data to obtain the target description data. In the above scheme, by extracting features from the standard description data and converting its format, the standard description data can be transformed into structured target description data, thereby enabling subsequent TTP description matching based on the structured target description data. Matching based on structured data can improve the accuracy of the matching.

[0012] In an optional implementation, before obtaining the data to be matched and the standard description data, the method further includes: constructing a tree diagram based on the standard framework and storing the node data corresponding to each leaf node; constructing a keyword dictionary based on the node data, wherein the keyword dictionary includes keywords and corresponding numbers. In the above scheme, by storing the standard framework in a hierarchical tree structure and extracting features by constructing a keyword dictionary, information redundancy can be reduced.

[0013] Secondly, embodiments of this application provide a TTP description matching device, comprising: an acquisition module for acquiring data to be matched and standard description data; an extraction module for extracting features from the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords and the target description data includes description keywords; and a matching module for matching the target matching data with the target description data to obtain target tactics, target technologies, and target sub-technologies corresponding to the data to be matched.

[0014] In the above scheme, after obtaining the data to be matched and the standard description data, the data to be matched and the standard description data can be transformed into structured target matching data and target description data through feature extraction; then, by matching the target matching data and the target description data, the TTP can be located, and thus the TTP description can be matched; therefore, the TTP description matching method provided in this application embodiment can improve the matching accuracy.

[0015] In an optional implementation, the matching module is specifically used to: perform keyword matching between the target matching data and the target description data, and calculate the similarity between the target matching data and the target description data to obtain the target tactic and the target technology; calculate the score of the data corresponding to the target technology under the target tactic in the target matching data and the target description data to obtain the target sub-technology. In the above scheme, the tactics and technologies are first preliminarily located through entity parsing to determine the target tactics and target technologies; then, the sub-techniques are precisely located through hybrid matching to determine the target sub-technology. Compared with the existing technology that matches all data, this method can improve the accuracy of matching and reduce the amount of computation involved.

[0016] In an optional implementation, the matching module is further configured to: match the matching keywords in the target matching data with the descriptive keywords under each technology in the target description data, to obtain the number of keyword hits corresponding to each technology. In the above scheme, the target tactics corresponding to the target matching data can be initially located through entity parsing, thereby improving the accuracy and efficiency of matching.

[0017] In an optional implementation, the matching module is further configured to: calculate the similarity corresponding to each technique based on the number of keyword hits and feature weights; and determine the technique under the tactic with the highest similarity as the target tactic and the target technique. In the above scheme, the target technique corresponding to the target matching data under the target tactic can be initially located through entity parsing, thereby improving the accuracy and efficiency of matching.

[0018] In an optional implementation, the matching module is further configured to: match the matching keywords in the target matching data with the descriptive keywords under each sub-technology in the data corresponding to the target technology under the target tactic in the target description data, to obtain the number of keyword hits for each sub-technology; calculate the keyword similarity for each sub-technology based on the number of keyword hits and feature weights; calculate the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactic in the target description data; calculate the weighted sum of the keyword similarity and the semantic similarity to obtain the score; and determine the sub-technology with the highest score as the target sub-technology. In the above scheme, after determining the target tactic and target technology corresponding to the target matching data, the semantic similarity can be combined to perform fine matching on the target sub-technology corresponding to the target matching data under the target technology of the target tactic, thereby improving the accuracy and efficiency of matching.

[0019] In an optional implementation, the extraction module is specifically used for: preprocessing the standard description data; extracting features from the preprocessed standard description data based on a keyword dictionary to determine the matching keywords included in the standard description data; and converting the format of the feature-extracted standard description data to obtain the target description data. In the above scheme, by extracting features from the standard description data and converting its format, the standard description data can be transformed into structured target description data, thereby enabling subsequent TTP description matching based on the structured target description data. Matching based on structured data can improve the accuracy of the matching.

[0020] In an optional implementation, the matching method described by the TTP further includes: a first construction module for constructing a tree diagram based on a standard framework and storing node data corresponding to each leaf node; and a second construction module for constructing a keyword dictionary based on the node data, wherein the keyword dictionary includes keywords and corresponding numbers. In the above scheme, by storing the standard framework in a hierarchical tree structure and extracting features by constructing a keyword dictionary, information redundancy can be reduced.

[0021] Thirdly, embodiments of this application provide a computer program product, including computer program instructions, which, when read and executed by a processor, perform the matching method described in the TTP as described in the first aspect.

[0022] Fourthly, embodiments of this application provide an electronic device, including: a processor, a memory, and a bus; the processor and the memory communicate with each other via the bus; the memory stores computer program instructions executable by the processor, and the processor can execute the matching method described in the TTP as described in the first aspect by calling the computer program instructions.

[0023] Fifthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions that, when executed by a computer, cause the computer to perform the matching method described in the TTP as described in the first aspect.

[0024] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, embodiments of this application are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A flowchart illustrating a TTP description matching method provided in this application embodiment;

[0027] Figure 2 A schematic diagram illustrating an example of outputting JSON format according to an embodiment of this application;

[0028] Figure 3 A standard data structure tree diagram provided for embodiments of this application;

[0029] Figure 4 A schematic diagram of a leaf node sub-technology data storage format provided in an embodiment of this application;

[0030] Figure 5 A structural block diagram of a matching device described in TTP is provided for an embodiment of this application;

[0031] Figure 6 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0032] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0033] Please refer to Figure 1 , Figure 1 A flowchart illustrating a TTP description matching method provided in this application embodiment, the TTP description matching method specifically including the following steps:

[0034] Step S101: Obtain the data to be matched and the standard description data.

[0035] Step S102: Perform feature extraction on the data to be matched and the standard description data to obtain the target matching data corresponding to the data to be matched and the target description data corresponding to the standard description data. The target matching data includes matching keywords, and the target description data includes description keywords.

[0036] Step S103: Match the target matching data with the target description data to obtain the target tactics, target technology and target sub-technology corresponding to the data to be matched.

[0037] Specifically, in step S101 above, the data to be matched refers to TTP description fragments obtained from the internet, including TTP description fragments in articles, reports, and other text data, where the TTP name corresponding to the TTP description fragment is unknown. Standard description data refers to the official standard description fragments in the MITRE ATT&CK (MITRE Adversarial Tactics, Techniques, and Common Knowledge) attack library, where the TTP name corresponding to the standard description fragment is known.

[0038] The MITRE ATT&CK attack library categorizes attacks into 14 tactics; each tactic contains 196 techniques; each technique may include zero or one or more sub-techniques, totaling 411 sub-techniques; each tactic, technique, and sub-technique includes the following information: identification (ID), name, and description. It is understood that the aforementioned standard description data may include descriptive fragments corresponding to all or some of the sub-techniques in the attack library.

[0039] It should be noted that the embodiments of this application do not specifically limit the implementation methods for obtaining the data to be matched and the standard description data, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, the data to be matched and the standard description data sent by an external device can be received; or, the data to be matched and the standard description data pre-stored locally or in the cloud can be read, etc.

[0040] It is understood that, as one implementation method, the above-mentioned data to be matched and standard description data can be obtained in the same way; as another implementation method, the above-mentioned data to be matched and standard description data can also be obtained in different ways.

[0041] In step S102 above, this application embodiment does not specifically limit the specific implementation method for obtaining the data to be matched and the standard description data. Those skilled in the art can make appropriate adjustments according to the actual situation. For example, the data to be matched and the standard description data can be input into a pre-trained machine learning model for feature extraction; or, feature extraction can be achieved by keyword matching of the data to be matched and the standard description data, etc.

[0042] In one implementation, after feature extraction from the aforementioned data to be matched and standard description data, the resulting target matching data and target description data can be structured data. In another implementation, the aforementioned target matching data may include matching keywords, and the aforementioned target description data may include descriptive keywords.

[0043] In step S103 above, this application embodiment does not specifically limit the specific implementation method for matching target matching data with target description data. Those skilled in the art can make appropriate adjustments according to the actual situation. For example, the similarity between target matching data and target description data can be calculated; or, keyword matching can be performed between target matching data and target description data; or, target matching data and target description data can be input into a pre-trained machine learning model for matching, etc.

[0044] The matching result determines the target tactics, target techniques, and target sub-techniques corresponding to the data to be matched in the target matching data. It is understandable that after determining these target tactics, target techniques, and target sub-techniques, they can be further applied to security intelligence platforms to help security analysts identify the latest attack patterns, track attacker behavior, and improve intelligence analysis efficiency.

[0045] In the above scheme, after obtaining the data to be matched and the standard description data, the data to be matched and the standard description data can be transformed into structured target matching data and target description data through feature extraction; then, by matching the target matching data and the target description data, the TTP can be located, and thus the TTP description can be matched; therefore, the TTP description matching method provided in this application embodiment can improve the matching accuracy.

[0046] Furthermore, based on the above embodiments, step S103 may specifically include the following steps:

[0047] Step 1) Perform keyword matching between the target matching data and the target description data, and calculate the similarity between the target matching data and the target description data to obtain the target tactics and target technology.

[0048] Step 2) Calculate the scores of the target matching data and the target description data corresponding to the target techniques under the target tactics to obtain the target sub-techniques.

[0049] Specifically, in step 1) above, Entity Resolution (ER) can be used to match tactics and techniques. Entity Resolution is commonly used for structured or semi-structured data, and is widely applied in database management, data cleaning, and information fusion. As one implementation method, target tactics can be obtained by performing keyword matching between target matching data and target description data.

[0050] Understandably, after step 1) above, one tactic can be selected from 14 tactics as the target tactic, and the other 13 tactics can be discarded; one technology can be selected from 196 technologies under the target tactic as the target technology, and the other 195 technologies can be discarded. Subsequently, only the data corresponding to the target technology under the target tactic in the target description data will be further matched.

[0051] As one implementation method, target tactics and target techniques can be obtained by calculating the similarity between target matching data and target description data.

[0052] It should be noted that the embodiments of this application do not specifically limit the implementation method of keyword matching between target matching data and target description data, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, the similarity between keywords in the target matching data and keywords in the target description data can be calculated; or, the keywords in the target matching data can be compared with the keywords in the target description data; or, the target matching data and target description data can be input into a pre-trained machine learning model for keyword matching, etc.

[0053] Furthermore, this application does not specifically limit the implementation method for calculating the similarity between target matching data and target description data, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, the cosine similarity between target matching data and target description data can be calculated; or, the Euclidean distance between target matching data and target description data can be calculated; or, the target matching data and target description data can be input into a pre-trained machine learning model for similarity calculation, etc.

[0054] One implementation method is to divide the target description data into blocks. Based on a tree diagram, each branch of the target description data can be grouped into a set of nodes extending from the parent node of a tactical layer to its technical layer child nodes and then to the leaf nodes of its child technical layers. The tactical layer inherits all field attributes from its lower-level technical layers; each node in a technical layer inherits all field attributes from its extended child technical layers, including its own attributes. If a technical layer node has no lower-level child nodes, it only inherits its own attributes.

[0055] In step 2) above, this application embodiment does not specifically limit the specific implementation method for calculating the score of the target matching data and the target description data corresponding to the target technology under the target tactics. Those skilled in the art can make appropriate adjustments according to the actual situation. For example, the score can be obtained by calculating the keyword similarity between the target matching data and the target description data; or, the score can be obtained by calculating the semantic similarity between the target matching data and the target description data; or, the target matching data and the target description data can be input into a pre-trained machine learning model for score calculation, etc.

[0056] It is understandable that after step 2) above, one technology can be selected from the 411 technologies under the target technology under the target tactic as the target sub-technology; the target sub-technology is the sub-technology under the target technology under the target tactic determined in step 1) above.

[0057] In the above scheme, the tactics and technologies are first analyzed and preliminarily located to determine the target tactics and technologies; then, the sub-technologies are precisely located through hybrid analysis to determine the target sub-technologies. Compared with the existing technology that matches all data, this method can improve the accuracy of matching and reduce the amount of computation involved.

[0058] Furthermore, based on the above embodiments, the keyword matching of the target matching data and the target description data can specifically include the following steps:

[0059] Match the matching keywords in the target matching data with the descriptive keywords under each technology in the target description data to obtain the number of keyword hits for each technology.

[0060] Specifically, in the above steps, the matching keywords in the target matching data are matched with the descriptive keywords under each technology in the target description data to obtain the number of keyword hits for each technology.

[0061] One implementation method is to divide the target description data into blocks. Based on a tree diagram, each branch of the target description data can be grouped into a set of nodes extending from the parent node of a tactical layer to its technical layer child nodes and then to the leaf nodes of its child technical layers. The tactical layer inherits all field attributes from its lower-level technical layers; each node in a technical layer inherits all field attributes from its extended child technical layers, including its own attributes. If a technical layer node has no lower-level child nodes, it only inherits its own attributes.

[0062] Based on the highest number of keyword hits, the block with the highest probability of the target matching data appearing in the child node of the current block is considered to be the target tactic, and the tactical block corresponding to the child node is determined as the target tactic, while the other 13 tactical blocks are directly discarded.

[0063] In the above scheme, the target tactics corresponding to the target matching data can be initially located by entity parsing, thereby improving the accuracy and efficiency of matching.

[0064] Furthermore, based on the above embodiments, the steps of calculating the similarity between target matching data and target description data to obtain target tactics and target techniques may specifically include the following steps:

[0065] Step 1) Calculate the similarity of each technique based on the number of keyword hits and feature weights.

[0066] Step 2) Identify the technology under the tactic with the highest similarity as the target tactic and the target technology.

[0067] Specifically, in step 1) above, the similarity for each technique can be calculated based on the number of keyword hits and feature weights. Each extracted feature field can be sorted by importance and assigned a value to obtain the corresponding feature weight. These feature fields include: attack object, attack method, attack technique, attack stage, attack goal, and attack impact.

[0068] It should be noted that the embodiments of this application do not specifically limit the specific implementation method of calculating similarity described above, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, let E∈standard dataset and e∈dataset to be processed, where E i =(V i1 V i2 V i3 V i4V i5 e i =(v i1 ,v i2 ,v i3 ,v i4 ,v i5 ); Calculate the similarity between two items. There are various formulas for calculating similarity, such as Jaccard's formula, which calculates the overall similarity. Let the similarity score be S, and select the Sigmoid function as input to calculate the probability that the data to be determined belongs to the current technology layer node.

[0069] In step 2) above, the obtained similarities (which can be normalized probability values) can be sorted in descending order, and the technical block corresponding to the highest similarity can be selected as the target technology. The target matching data is considered to belong to the technical node or its extended sub-technical node.

[0070] In the above scheme, the target technology corresponding to the target matching data under the target tactic can be initially located by entity parsing, thereby improving the accuracy and efficiency of matching.

[0071] Furthermore, based on the above embodiments, the step of calculating the score of the target technology corresponding to the target tactic in the target matching data and the target description data to obtain the target sub-technology may specifically include the following steps:

[0072] Step 1) Match the matching keywords in the target matching data with the description keywords under each sub-technology in the target description data corresponding to the target technology under the target tactics, and obtain the number of keyword hits for each sub-technology.

[0073] Step 2) Calculate the keyword similarity for each sub-technology based on the number of keyword hits and feature weights.

[0074] Step 3) Calculate the semantic similarity between the target matching data and the target technology corresponding to the target tactics in the target description data.

[0075] Step 4) Calculate the weighted sum of keyword similarity and semantic similarity to obtain the score.

[0076] Step 5) Identify the sub-technique with the highest score as the target sub-technique.

[0077] Specifically, in step 3) above, the semantic similarity between the target matching data and the target description data corresponding to the target technology under the target tactics can be calculated. As one implementation, the target matching data and target description data can be input into a word segmenter and a RoBERTa model for word segmentation and encoding. The average pooling output of the text is then taken, and the similarity between the two is calculated to quantify their semantic similarity. The similarity formula can be, for example, cosine similarity or Euclidean distance, and this embodiment does not specifically limit it.

[0078] In addition, after calculating the keyword similarity for each sub-technology in step 2), the keyword similarity can be sorted in descending order, and the top N sub-technology can be selected to perform step 3 above.

[0079] In step 4) above, a score can be obtained by calculating the weighted sum of keyword similarity and semantic similarity. The weights for keyword similarity and semantic similarity can be preset.

[0080] In step 5) above, the highest-scoring matching pair can be obtained, and the name and ID of the target matching data are considered to be the name and ID of the matched target description data.

[0081] In the above scheme, after determining the target tactics and target technologies corresponding to the target matching data, semantic similarity can be used to perform fine matching of the target sub-techniques corresponding to the target matching data under the target tactics and target technologies, thereby improving the accuracy and efficiency of matching.

[0082] Furthermore, based on the above embodiments, the step of feature extraction of the standard description data in step S102 may specifically include the following steps:

[0083] Step 1) Preprocess the standard description data.

[0084] Step 2) Perform feature extraction on the preprocessed standard description data based on the keyword dictionary to determine the matching keywords included in the standard description data.

[0085] Step 3) Convert the format of the standard description data after feature extraction to obtain the target description data.

[0086] Specifically, in step 1) above, this application embodiment does not impose specific limitations on the specific implementation of the preprocessing method, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, stop words (e.g., "the", "is", "may", etc.) can be removed first; then word segmentation can be performed, and the TTP description field can be segmented according to spaces or punctuation marks; finally, standardization processing can be performed to process abbreviations and unify terminology, ensuring that ambiguous expressions are converted into a unified form.

[0087] In step 2) above, feature extraction can be performed on the preprocessed standard description data based on a keyword dictionary to determine the matching keywords included in the standard description data. As one implementation, each word in the preprocessed standard description data can be matched with keywords in the keyword dictionary, and the feature labels and numbers of the matched keywords can be obtained.

[0088] In one implementation, the feature tags may include attack object, attack method, attack technique, attack stage, attack goal, and attack impact.

[0089] In step 3) above, the standard descriptive data after feature extraction can be format-converted to obtain the target descriptive data. As one implementation method, the standard descriptive data after feature extraction can be converted into the RoBERTa input format; then, the converted data is processed by the RoBERTa model to output the predicted label for each keyword and convert it into structured JSON format for subsequent entity parsing. Please refer to... Figure 2 , Figure 2 This is a schematic diagram illustrating an example of outputting JSON format according to an embodiment of this application.

[0090] In the above scheme, by extracting features from the standard description data and converting its format, the standard description data can be transformed into structured target description data. This structured target description data can then be used for subsequent TTP description matching. Matching based on structured data improves matching accuracy.

[0091] Furthermore, based on the above embodiments, the step of extracting features from the data to be matched in step S102 is similar to the step of extracting features from the standard description data, and will not be repeated here. Specifically, according to the official description standard, the length of the acquired data to be matched can be set to no more than 5 sentences.

[0092] Furthermore, based on the above embodiments, prior to step S101, the TTP description matching method provided in this application embodiment may further include the following steps:

[0093] Step 1) Construct a tree diagram based on the standard framework and store the node data corresponding to each leaf node.

[0094] Step 2) Construct a keyword dictionary based on node data. The keyword dictionary includes keywords and their corresponding numbers.

[0095] Specifically, in step 1) above, a tree diagram can be constructed based on the MITRE ATT&CK standard framework, and the node data corresponding to each leaf node can be stored. The MITRE ATT&CK attack library divides attacks into 14 tactics; each tactic contains several techniques, totaling 196 techniques; each technique may contain zero or one or more sub-techniques, totaling 411 techniques. Each tactic, technique, and sub-technique includes information {ID, name, description}.

[0096] One implementation method is to divide the data into three levels and number them according to a standard framework: the first level is the tactical level, the second level is the technical level, and the third level is the sub-technical level; each level sorts and numbers the technologies according to their current category. Please refer to... Figure 3 and Figure 4 , Figure 3 This application provides a standard data structure tree diagram as an embodiment. Figure 4 This is a schematic diagram of a leaf node sub-technology data storage format provided in an embodiment of this application.

[0097] In step 2) above, a keyword dictionary can be constructed based on the node data. As one implementation method, a keyword dictionary for the official description section can be constructed by manually selecting keywords.

[0098] The keyword dictionary can include keywords and their corresponding numbers. As one implementation, the keyword dictionary can be formatted as follows: one keyword (word or phrase) per line, each keyword has a unique number, and the keyword and its corresponding number can be separated by a space; furthermore, it can be ensured that there are no blank lines between keywords in each line.

[0099] In the above scheme, information redundancy can be reduced by storing the standard framework in a hierarchical tree structure and by extracting features by constructing a keyword dictionary.

[0100] Please refer to Figure 5 , Figure 5This application provides a structural block diagram of a TTP description matching device 500, which includes: an acquisition module 501 for acquiring data to be matched and standard description data; an extraction module 502 for extracting features from the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords and the target description data includes description keywords; and a matching module 503 for matching the target matching data with the target description data to obtain target tactics, target technologies, and target sub-technologies corresponding to the data to be matched.

[0101] In the above scheme, after obtaining the data to be matched and the standard description data, the data to be matched and the standard description data can be transformed into structured target matching data and target description data through feature extraction; then, by matching the target matching data and the target description data, the TTP can be located, and thus the TTP description can be matched; therefore, the TTP description matching method provided in this application embodiment can improve the matching accuracy.

[0102] Furthermore, based on the above embodiments, the matching module 503 is specifically used to: perform keyword matching between the target matching data and the target description data, and calculate the similarity between the target matching data and the target description data to obtain the target tactic and the target technology; calculate the score of the data corresponding to the target technology under the target tactic in the target matching data and the target description data to obtain the target sub-technology.

[0103] In the above scheme, the tactics and technologies are first analyzed and preliminarily located to determine the target tactics and technologies; then, the sub-technologies are precisely located through hybrid analysis to determine the target sub-technologies. Compared with the existing technology that matches all data, this method can improve the accuracy of matching and reduce the amount of computation involved.

[0104] Furthermore, based on the above embodiments, the matching module 503 is also used to: match the matching keywords in the target matching data with the description keywords under each technology in the target description data to obtain the number of keyword hits corresponding to each technology.

[0105] In the above scheme, the target tactics corresponding to the target matching data can be initially located by entity parsing, thereby improving the accuracy and efficiency of matching.

[0106] Furthermore, based on the above embodiments, the matching module 503 is also used to: calculate the similarity corresponding to each technology based on the number of keyword hits and feature weights; and determine the technology under the tactic with the highest similarity as the target tactic and the target technology.

[0107] In the above scheme, the target technology corresponding to the target matching data under the target tactic can be initially located by entity parsing, thereby improving the accuracy and efficiency of matching.

[0108] Furthermore, based on the above embodiments, the matching module 503 is further configured to: match the matching keywords in the target matching data with the description keywords under each sub-technology in the data corresponding to the target technology under the target tactic in the target description data, to obtain the number of keyword hits corresponding to each sub-technology; calculate the keyword similarity corresponding to each sub-technology based on the number of keyword hits and feature weights; calculate the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactic in the target description data; calculate the weighted sum of the keyword similarity and the semantic similarity to obtain the score; and determine the sub-technology with the highest score as the target sub-technology.

[0109] In the above scheme, after determining the target tactics and target technologies corresponding to the target matching data, semantic similarity can be used to perform fine matching of the target sub-techniques corresponding to the target matching data under the target tactics and target technologies, thereby improving the accuracy and efficiency of matching.

[0110] Furthermore, based on the above embodiments, the extraction module 502 is specifically used for: preprocessing the standard description data; extracting features from the preprocessed standard description data based on a keyword dictionary to determine the matching keywords included in the standard description data; and converting the format of the feature-extracted standard description data to obtain the target description data.

[0111] In the above scheme, by extracting features from the standard description data and converting its format, the standard description data can be transformed into structured target description data. This structured target description data can then be used for subsequent TTP description matching. Matching based on structured data improves matching accuracy.

[0112] Furthermore, based on the above embodiments, the matching device 200 described by TTP further includes: a first construction module, used to construct a tree diagram based on a standard framework and store node data corresponding to each leaf node; and a second construction module, used to construct a keyword dictionary based on the node data, wherein the keyword dictionary includes keywords and corresponding numbers.

[0113] In the above scheme, information redundancy can be reduced by storing the standard framework in a hierarchical tree structure and by extracting features by constructing a keyword dictionary.

[0114] Please refer to Figure 6 , Figure 6 This application provides a structural block diagram of an electronic device 600, which includes at least one processor 601, at least one communication interface 602, at least one memory 603, and at least one communication bus 604. The communication bus 604 enables direct communication between these components, the communication interface 602 facilitates signaling or data communication with other node devices, and the memory 603 stores machine-readable instructions executable by the processor 601. When the electronic device 600 is running, the processor 601 communicates with the memory 603 via the communication bus 604. When the machine-readable instructions are invoked by the processor 601, the matching method described in the TTP above is executed.

[0115] For example, the processor 601 in this embodiment of the application can read a computer program from the memory 603 via the communication bus 604 and execute the computer program to implement the following method: acquiring data to be matched and standard description data; performing feature extraction on the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords and the target description data includes description keywords; matching the target matching data with the target description data to obtain target tactics, target technology and target sub-technology corresponding to the data to be matched.

[0116] The processor 601 comprises one or more, and can be an integrated circuit chip with signal processing capabilities. The processor 601 can be a general-purpose processor, including a Central Processing Unit (CPU), a Microcontroller Unit (MCU), a Network Processor (NP), or other conventional processors; it can also be a special-purpose processor, including a Neural-network Processing Unit (NPU), a Graphics Processing Unit (GPU), a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Furthermore, when there are multiple processors 601, some can be general-purpose processors, and others can be special-purpose processors.

[0117] The memory 603 includes one or more, which may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0118] Understandable. Figure 6 The structure shown is for illustrative purposes only; the electronic device 600 may also include components that are more advanced than those shown. Figure 6 The more or fewer components shown, or having the same Figure 6 The different configurations shown. Figure 6The components shown can be implemented using hardware, software, or a combination thereof. In the embodiments of this application, electronic device 600 can be, but is not limited to, physical devices such as desktop computers, laptops, smartphones, smart wearable devices, and in-vehicle devices, or virtual devices such as virtual machines. Furthermore, electronic device 600 is not necessarily a single device; it can be a combination of multiple devices, such as a server cluster, etc.

[0119] This application also provides a computer program product, including a computer program stored on a computer-readable storage medium. The computer program includes computer program instructions. When the computer program instructions are executed by a computer, the computer can perform the steps of the matching method described in the TTP embodiments above, for example including: Step S101: Obtaining data to be matched and standard description data. Step S102: Performing feature extraction on the data to be matched and the standard description data to obtain target matching data corresponding to the data to be matched and target description data corresponding to the standard description data, wherein the target matching data includes matching keywords and the target description data includes description keywords. Step S103: Matching the target matching data with the target description data to obtain the target tactics, target technologies, and target sub-technologies corresponding to the data to be matched.

[0120] This application also provides a computer-readable storage medium that stores computer program instructions. When the computer program instructions are executed by a computer, the computer performs the matching method described in the TTP described in the foregoing method embodiments.

[0121] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0122] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0123] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0124] It should be noted that if the function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0125] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0126] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A matching method for TTP descriptions, characterized in that, include: Obtain the data to be matched and the standard description data, wherein the data to be matched is a TTP description fragment with an unknown TTP name; Feature extraction is performed on the data to be matched and the standard description data to obtain the target matching data corresponding to the data to be matched and the target description data corresponding to the standard description data. The target matching data includes matching keywords, the target description data includes description keywords, and the target matching data and the target description data are structured data. The target matching data is matched with the target description data to obtain the target tactics, target technology, and target sub-technology corresponding to the data to be matched; The step of matching the target matching data with the target description data to obtain the target tactics, target technology, and target sub-technology corresponding to the data to be matched includes: Calculate the score between the target matching data and the target description data corresponding to the target technology under the target tactic to obtain the target sub-technology; The step of calculating the score of the target matching data and the target description data corresponding to the target technology under the target tactic to obtain the target sub-technology includes: The matching keywords in the target matching data are matched with the description keywords under each sub-technology in the data corresponding to the target technology under the target tactic in the target description data to obtain the number of keyword hits for each sub-technology. Calculate the keyword similarity for each sub-technology based on the number of keyword hits and feature weights; Calculate the semantic similarity between the target matching data and the data corresponding to the target technology under the target tactic in the target description data; The score is obtained by calculating the weighted sum of the keyword similarity and the semantic similarity. The sub-technology with the highest score is identified as the target sub-technology.

2. The matching method for TTP descriptions according to claim 1, characterized in that, The step of matching the target matching data with the target description data to obtain the target tactics, target technology, and target sub-technology corresponding to the data to be matched further includes: The target matching data and the target description data are matched by keywords, and the similarity between the target matching data and the target description data is calculated to obtain the target tactics and the target technology.

3. The matching method for TTP descriptions according to claim 2, characterized in that, The step of performing keyword matching between the target matching data and the target description data includes: The matching keywords in the target matching data are matched with the description keywords under each technology in the target description data to obtain the number of keyword hits for each technology.

4. The matching method for TTP descriptions according to claim 3, characterized in that, The step of calculating the similarity between the target matching data and the target description data to obtain the target tactics and the target technology includes: The similarity for each technique is calculated based on the number of keyword hits and feature weights. The techniques under the tactics with the highest similarity are identified as the target tactics and the target techniques.

5. The matching method for TTP descriptions according to claim 1, characterized in that, Feature extraction is performed on the standard description data to obtain the target description data corresponding to the standard description data, including: The standard description data is preprocessed; Feature extraction is performed on the preprocessed standard description data based on the keyword dictionary to determine the matching keywords included in the standard description data; The standard description data after feature extraction is converted into a new format to obtain the target description data.

6. The matching method for TTP descriptions according to any one of claims 1-5, characterized in that, Before obtaining the data to be matched and the standard description data, the method further includes: A tree diagram is constructed based on a standard framework, and the node data corresponding to each leaf node is stored. A keyword dictionary is constructed based on the node data, wherein the keyword dictionary includes keywords and corresponding numbers for the keywords.

7. A computer program product, characterized in that, It includes computer program instructions, which, when read and executed by a processor, perform the matching method described in the TTP as claimed in any one of claims 1-6.

8. An electronic device, characterized in that, include: Processor, memory, and bus; The processor and the memory communicate with each other via the bus; The memory stores computer program instructions that can be executed by the processor, which can invoke the computer program instructions to perform the matching method described in the TTP as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a computer, cause the computer to perform the matching method described in any one of claims 1-6 of the TTP.

Images