Cooperative linkage response method and system based on threat intelligence

Abstract

The invention discloses a collaborative linkage response method and system based on threat intelligence, and relates to the technical field of linkage response, and the method comprises the steps: collecting alarm data of safety equipment and multi-source threat intelligence data; preprocessing the alarm data and the multi-source threat intelligence data; storing the processed data into a database, and establishing a threat intelligence database, an expert knowledge base and a safety parameter database; performing association analysis on the processed security data in combination with an expert knowledge base and a threat intelligence library to obtain threat intelligence; generating a security linkage strategy by combining the threat intelligence with the data of the security parameter database; and operating the related information security system and the target equipment based on the security linkage strategy. According to the method, association analysis and association rule mining are carried out on mass security data in a linkage system, then a security linkage strategy is generated, one-key issuing of the execution strategy is carried out, rapid linkage response is carried out on cooperative attacks through linkage processing of multiple security devices, and safe and stable operation of a power network is ensured.

Description

Technical Field

[0001] The present invention relates to the field of linkage response technology, and specifically to a collaborative linkage response method and system based on threat intelligence. Background Art

[0002] Network security protection focuses on the protection of physical security equipment. It has the characteristics of a large number of equipment, many types, different protocols, and a single protection method. It cannot fully meet the construction needs of a full-scenario network security protection system. When facing network security incidents, the various devices cannot be linked and protected in a timely and effective manner, and cannot coordinate the various devices to respond to security incidents in a timely manner, resulting in isolated security protection between different networks and regions. It is impossible to find the connection between security incidents occurring in different networks and regions, and it is impossible to coordinate security equipment to respond and defend against complex attacks. Therefore, how to combine multi-source heterogeneous security equipment to achieve coordinated linkage response has become an urgent problem to be solved. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is: how to solve the problem that multi-source heterogeneous security devices in the current network security protection system cannot achieve coordinated linkage response. Specifically, in view of the isolated protection and information islands caused by the large number of devices, diverse protocols, and single protection means between different devices, a coordinated linkage response method based on threat intelligence is proposed. By collecting and pre-processing multi-source security device alarm data and threat intelligence data, combining expert knowledge base and threat intelligence library for correlation analysis, a security linkage strategy is generated, thereby achieving rapid response and coordinated defense between different security devices. This method can perform linkage analysis and response to security incidents across networks and regions, thereby improving the overall security protection capabilities, and timely discovering and effectively responding to complex network security threats.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: a collaborative linkage response method based on threat intelligence, which comprises the following steps:

[0006] Collect alarm data from security devices and multi-source threat intelligence data; pre-process the alarm data and multi-source threat intelligence data; store the processed data in a database and establish a threat intelligence library, an expert knowledge base, and a security parameter database; perform correlation analysis on the processed security data in combination with the expert knowledge base and the threat intelligence library to obtain threat intelligence; generate a security linkage strategy by combining the threat intelligence with the data in the security parameter database; and operate on relevant information security systems and target devices based on the security linkage strategy.

[0007] As a preferred solution of the collaborative linkage response method based on threat intelligence described in the present invention, the multi-source threat intelligence data includes network-wide associated samples, unit-associated samples, custom intelligence and open source intelligence.

[0008] The open source intelligence described comes from the open source intelligence repository.

[0009] As a preferred solution of the collaborative linkage response method based on threat intelligence described in the present invention, the threat intelligence library includes multiple threat intelligence features of attack organizations, attack targets, attack purposes, attack events, code features, IOCs, intelligence descriptions, technologies and correlation relationships.

[0010] The expert knowledge base includes a corresponding linkage strategy set and association rules.

[0011] The security parameter database includes basic parameter information of network security devices and real-time status parameters of the network and security devices.

[0012] As a preferred solution of the collaborative linkage response method based on threat intelligence described in the present invention, wherein: the combination of the expert knowledge base and the threat intelligence library to perform correlation analysis on the processed security data to obtain threat intelligence specifically includes inputting security data, clustering the security data using the adaptive multi-distance metric K-means algorithm, and analyzing the security data of the same cluster.

[0013] Determine whether the alarm data can match the association rules in the existing expert knowledge base. If it can match, a super alarm is generated. If it cannot match, the FP-Growth algorithm is used to mine association rules.

[0014] Determine whether the association rules meet the confidence requirements. If so, generate new association rules and store them in the expert knowledge base, update the existing rule base, and generate super alarms based on the association rules. If not, delete the corresponding association rules.

[0015] Get attack characteristics based on super alarms.

[0016] The attack signature is matched with the attack signature in the existing threat intelligence library to determine whether it is an existing attack organization. If so, the corresponding threat intelligence is obtained. If not, new threat intelligence is generated and the existing threat intelligence library is updated.

[0017] As a preferred solution of the collaborative linkage response method based on threat intelligence described in the present invention, the judgment of whether the alarm data can match the association rules in the existing expert knowledge base includes inputting a data set and a clustering value.

[0018] Define the distance metric candidate set.

[0019] Select an adaptive distance metric. In each iteration, for each data point, calculate multiple distance metrics between the initial cluster center and the original cluster center, and use a heuristic method to evaluate which distance metric best reflects the distribution characteristics of the data under the current cluster center.

[0020] According to the distance between the data point and the cluster center, find the minimum distance and assign the data point to the corresponding cluster.

[0021] After the data set is clustered, the cluster center is updated and the objective function value of the entire data set is calculated.

[0022] Convergence check: check whether the cluster center converges or reaches the maximum number of iterations. The algorithm ends after convergence.

[0023] As a preferred solution of the collaborative linkage response method based on threat intelligence described in the present invention, the method of judging whether the alarm data can match the association rules in the existing expert knowledge base also includes scanning the data set once to obtain a set of items with frequent items as 1, counting the support of each item, deleting items with support lower than the minimum support, and sorting them in descending order of support.

[0024] Construct the item header table and FP tree, perform a second scan on the frequent sets obtained from the first scan, and generate corresponding data nodes based on the support. Filter the sample branches based on whether they contain frequent items of the data. For branches containing frequent items, retain them. Otherwise, prune them, scan again, and regenerate the item header and FP tree.

[0025] Taking the last head pointer of the item table header as the traversal starting point, randomly traverse all data items in the table header to determine whether the data in the traversed data item is a frequent item of the data. If an item meets the conditions of being a frequent item of the data, its mining result is retained. Otherwise, the result is discarded and the traversal is continued until the mining of all items is completed.

[0026] For the retained data frequent item sets, the support and confidence of the data are calculated, and the frequent items with less than the minimum support and the minimum confidence are used as the association rules of the data.

[0027] The evaluation of association rules is interpreted as knowledge and stored.

[0028] As a preferred solution of the collaborative linkage response method based on threat intelligence described in the present invention, the security linkage strategy includes a collection strategy, a monitoring strategy and a defense strategy.

[0029] The collection strategy includes setting matching rules, conditions and collection parameters to filter out data that meets the conditions.

[0030] The monitoring strategy is used to monitor the collected data in real time.

[0031] The defense strategy is used to take corresponding defense measures to protect the security of the system and network according to the monitored security threats and risks.

[0032] Another object of the present invention is to provide a coordinated linkage response system based on threat intelligence, which can automatically identify the threat source and attack path of security events by acquiring, analyzing and sharing various threat intelligence in real time, dynamically adjust the protection strategy, and realize coordinated linkage and intelligent response among various security devices. The system can effectively solve the problems of isolated devices, delayed response, lack of information sharing, etc. in the existing network security protection system.

[0033] To solve the above technical problems, the present invention provides the following technical solutions: a collaborative linkage response system based on threat intelligence, including a data acquisition module, a data processing module, a data storage module, a correlation analysis module, a strategy generation module, and a linkage response module.

[0034] The data collection module is used to collect security data and multi-source threat intelligence data.

[0035] The data processing module is used to pre-process the collected data.

[0036] The data storage module is used to store the processed data into the database and establish a threat intelligence database, expert knowledge base and security parameter database.

[0037] The correlation analysis module is used to combine the expert knowledge base and the threat intelligence library to perform correlation analysis on the processed security data to obtain threat intelligence.

[0038] The strategy generation module is used to generate a security linkage strategy by combining the super alarm with the data in the security parameter database.

[0039] The linkage response module is used to accept security linkage strategies to operate relevant information security systems and target devices.

[0040] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the collaborative linkage response method based on threat intelligence as described above are implemented.

[0041] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a collaborative linkage response method based on threat intelligence as described above.

[0042] Beneficial effects of the present invention: The present invention automatically generates security linkage strategies and issues them with one click by performing correlation analysis on massive security data and mining correlation rules, which can quickly realize the linkage response of multiple security devices and ensure that the power network can make timely and accurate protective responses when facing complex coordinated attacks. By combining the adaptive algorithm with the FP-Growth algorithm, the efficiency of data processing and threat identification is effectively improved, while avoiding the lag and errors of manual intervention, ensuring a rapid linkage response to cross-network and cross-regional security incidents, and ensuring the safe and stable operation of the power network. This method greatly improves the automation and intelligence level of security protection and enhances the system's ability to respond to diversified attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0044] Figure 1 An overall flow chart of a collaborative linkage response method based on threat intelligence provided for the first embodiment of the present invention.

[0045] Figure 2 In a collaborative linkage response method based on threat intelligence provided in the first embodiment of the present invention, an expert knowledge base and a threat intelligence library are combined to perform correlation analysis on processed security data to obtain a threat intelligence flow chart.

[0046] Figure 3 A flowchart of clustering security data using an adaptive multi-distance metric K-means algorithm in a collaborative linkage response method based on threat intelligence provided in the first embodiment of the present invention.

[0047] Figure 4 A flowchart of association rule mining using the FP-Growth algorithm in a collaborative linkage response method based on threat intelligence provided in the first embodiment of the present invention.

[0048] Figure 5 An overall framework diagram of a threat intelligence-based collaborative response system provided for the second embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0050] Example 1, reference Figure 1 to Figure 4 , is an embodiment of the present invention, and provides a collaborative linkage response method based on threat intelligence, characterized in that:

[0051] S1: Collect alarm data from security devices and multi-source threat intelligence data.

[0052] Multi-source threat intelligence data includes samples associated with the entire network, samples associated with the unit, custom intelligence and open source intelligence.

[0053] Open source intelligence comes from open source intelligence repositories.

[0054] Specifically, the multi-source threat intelligence data includes samples associated with the entire network, samples associated with the unit, custom intelligence and open source intelligence. The open source intelligence comes from open source intelligence libraries such as Weibo Online (ThreatBook), Qi'anxin Threat Intelligence Center, 360 Threat Intelligence Center, etc.

[0055] It should be understood that the security devices include but are not limited to security gateways, firewalls, intrusion prevention systems (IPS), intrusion detection systems (IDS), etc.

[0056] S2: Preprocess the alarm data and multi-source threat intelligence data.

[0057] Specifically, data preprocessing includes data cleaning, data analysis, data normalization, data feature extraction, data association completion, data labeling, etc. Among them, the features of threat intelligence are extracted to facilitate the subsequent establishment of a threat intelligence library. The main features extracted are: attack organization, attack target, attack purpose, attack event, code features, IOC (URL, Hash, Domain, IP, Email), intelligence description, technology and its associations, etc.

[0058] S3: Store the processed data into the database and establish a threat intelligence database, expert knowledge base and security parameter database.

[0059] The threat intelligence library includes a variety of threat intelligence features such as attack organizations, attack targets, attack purposes, attack events, code features, IOCs, intelligence descriptions, technologies, and related relationships.

[0060] The expert knowledge base includes the corresponding linkage strategy set and association rules.

[0061] The security parameter database includes basic parameter information of network security devices and real-time status parameters of the network and security devices.

[0062] Specifically, since threat intelligence has the characteristics of multi-source heterogeneity, HDFS, HBase and MongoDB are used as data storage platforms. Among them, the threat intelligence library includes multiple threat intelligence features such as attack organizations, attack targets, attack purposes, attack events, code features, IOC (URL, Hash, Domain, IP, Email), intelligence descriptions, technologies and their associations; the expert knowledge base includes the corresponding linkage strategy sets and association rules; the security parameter database includes the basic parameter information of network security equipment, real-time status parameters of network and security equipment, etc.

[0063] S4: Combine the expert knowledge base and threat intelligence library to perform correlation analysis on the processed security data to obtain threat intelligence.

[0064] Figure 2 In the embodiment of the present application, the threat intelligence flow chart is obtained by combining the expert knowledge base and the threat intelligence base to perform correlation analysis on the processed security data. In summary, the method mainly includes:

[0065] Combining the expert knowledge base and the threat intelligence library to perform correlation analysis on the processed security data to obtain threat intelligence specifically includes inputting security data, clustering the security data using the adaptive multi-distance metric K-means algorithm, and analyzing the security data of the same cluster.

[0066] It should be understood that clustering alarms in security data can effectively reduce the number of alarms and improve the quality of alarms. Aggregated alarms not only contain relevant information of the original alarms, but also contain aggregated statistical information (such as the number of aggregated original alarms). In this way, the quality of the transmitted security information will not be reduced, and it is also helpful to grasp the overall situation of the attack.

[0067] Specifically, the K-means algorithm usually uses the Euclidean distance as the distance metric between samples. However, in some cases, the Euclidean distance may not be applicable, such as when the data has a nonlinear relationship or there are outliers. In order to deal with these problems, other distance metrics, such as Manhattan distance, cosine similarity, etc., can be used to more accurately measure the similarity between samples. Therefore, this application improves the existing K-means algorithm and proposes an adaptive multi-distance metric K-means algorithm (Adaptive Multi-Distance K-means, AMDK-means). This algorithm can dynamically select a suitable distance metric according to the characteristics of the data to improve the accuracy and robustness of clustering, which will be described in detail later.

[0068] Determine whether the alarm data can match the association rules in the existing expert knowledge base. If it can match, a super alarm is generated. If it cannot match, the FP-Growth algorithm is used to mine association rules.

[0069] Determine whether the association rules meet the confidence requirements. If so, generate new association rules and store them in the expert knowledge base, update the existing rule base, and generate super alarms based on the association rules. If not, delete the corresponding association rules.

[0070] It should be understood that super alerts are of higher quality than ordinary alerts, and the complete attack chain can be obtained through super alerts.

[0071] Get attack characteristics based on super alarms.

[0072] The attack signature is matched with the attack signature in the existing threat intelligence library to determine whether it is an existing attack organization. If so, the corresponding threat intelligence is obtained. If not, new threat intelligence is generated and the existing threat intelligence library is updated.

[0073] Figure 3 The flowchart of clustering security data using the adaptive multi-distance metric K-means algorithm in the embodiment of the present application is as follows. In summary, the method mainly includes:

[0074] Input data set X = {x1,x2,x3,...,x n} and the number of clusters K, the initial cluster center is C = c1, c2, c3, ..., c k}.

[0075] Define the distance metric candidate set.

[0076] Specifically, the candidate set includes Euclidean distance, Manhattan distance, cosine similarity, etc. (cosine similarity usually needs to be converted into distance).

[0077] Choose an adaptive distance metric, in each iteration, for each data point x i {i=1,2,...,n), calculate its difference with the initial cluster center c l {l=1,2,...,k) between various distance metrics d(x i ,c l ), and uses a heuristic method to evaluate which distance metric best reflects the distribution characteristics of the data under the current cluster center.

[0078] Specifically, the distance metric value comes from a distance metric candidate set, and may be Euclidean distance, Manhattan distance, cosine similarity, and the like.

[0079] For example, taking the Euclidean distance as an example, the calculation formula is as follows:

[0080]

[0081] In the formula, x ij is the i-th data point in the j-th dimension, c ij is the lth cluster center of the jth dimension, and m is the number of dimensions of the data points.

[0082] Taking Manhattan distance as an example, the calculation formula is as follows:

[0083]

[0084] Specifically, this can be achieved by calculating the variance, median absolute deviation (MAD) or other statistics of the distance metric values ​​within the cluster, and selecting the distance metric with the smallest variance or the smallest MAD as the optimal distance metric for the cluster center.

[0085] According to the distance between the data point and the cluster center, find the minimum distance d min And attribute the data point to the corresponding cluster, d min The calculation formula is as follows:

[0086] d min =min{d(x i ,c1),d(x i ,c2),...,d(x i ,c l )}

[0087] After the data set is clustered, the cluster center is updated and the objective function value E of the entire data set is calculated.

[0088]

[0089] In the formula, | c l| is the number of data points in the lth cluster.

[0090] Convergence check: check whether the cluster center converges (that is, the change of the cluster center is less than a certain threshold) or the maximum number of iterations is reached. The algorithm ends after convergence.

[0091] Judging whether the alarm data can match the association rules in the existing expert knowledge base includes inputting the data set and clustering numerical values.

[0092] Define the distance metric candidate set.

[0093] Select an adaptive distance metric. In each iteration, for each data point, calculate multiple distance metrics between the initial cluster center and the original cluster center, and use a heuristic method to evaluate which distance metric best reflects the distribution characteristics of the data under the current cluster center.

[0094] According to the distance between the data point and the cluster center, find the minimum distance and assign the data point to the corresponding cluster.

[0095] After the data set is clustered, the cluster center is updated and the objective function value of the entire data set is calculated.

[0096] Convergence check: check whether the cluster center converges or reaches the maximum number of iterations. The algorithm ends after convergence.

[0097] Judging whether the alarm data can match the association rules in the existing expert knowledge base also includes scanning the data set, obtaining the item set with frequent items as 1, counting the support of each item, deleting items with support lower than the minimum support, and sorting them in descending order of support.

[0098] Figure 4 This is a flowchart of association rule mining using the FP-Growth algorithm in the embodiment of this application. In general, the FP-growth algorithm is more efficient than the traditional Apriori algorithm. During the entire algorithm execution process, it only needs to traverse the data set twice to complete the frequent pattern discovery. The basic process of discovering frequent item sets is as follows:

[0099] (1) Construct FP tree.

[0100] (2) Mining frequent itemsets from FP-tree.

[0101] The following is an introduction to the specific process of the FP-Growth algorithm:

[0102] S410: Scan the data set once to obtain the item set with frequent item 1, count the support of each item (the frequency of item occurrence), delete items with support lower than the minimum support (the minimum number of item occurrences), and sort them in descending order of support.

[0103] It should be understood that the calculation formulas for the minimum support and the minimum confidence are as follows.

[0104] Minimum support:

[0105] Minimum confidence:

[0106] Among them, num ( total ) Indicates the data reference set, num ( XY ) Represents an outlier reference object, num ( X ) Represents the average distance from sample point X to the reference sample, l n , l c Represent the similarity of n and c data attribute types respectively.

[0107] Construct the header table and FP (Frequent Pattern Tree), scan the frequent sets obtained from the first scan for the second time, and generate corresponding data nodes according to the support. Filter the sample branches according to whether they contain frequent items of the data. For branches containing such frequent items, they are retained; otherwise, they are pruned, scanned again, and the item header and FP tree are regenerated.

[0108] Specifically, each header table entry contains the name of the item, the support count, and a pointer to the first node of the item in the FP-tree.

[0109] Taking the last head pointer of the item table header as the traversal starting point, all data items in the table header are randomly traversed to determine whether the data in the traversed data item is a frequent item of the data. If an item meets the conditions of being a frequent item of the data, its mining result is retained; otherwise, the result is discarded and the traversal is continued until the mining of all items is completed.

[0110] For the retained data frequent item sets, the support and confidence of the data are calculated, and the frequent items with less than the minimum support and the minimum confidence are used as the association rules of the data.

[0111] The evaluation of association rules is interpreted as knowledge and stored.

[0112] The above is the entire process of data mining based on the FP-growth algorithm. The data output that meets the minimum support and the minimum confidence is considered to be a valid association rule. At this point, the data mining process is completed.

[0113] It should be understood that it is known that usually a piece of security data can only correspond to a single malicious event such as intrusion or attack, and a considerable part of these attacks are a step in the complete attack chain. Through correlation analysis, the intrinsic connection between data can be discovered, the attack path can be mined, and then the response strategy can be formulated after obtaining the complete attack path. The purpose is to enable users to take action accurately and efficiently to avoid or reduce the losses caused by network attacks.

[0114] S5: Combine threat intelligence with data from the security parameter database to generate a security linkage strategy.

[0115] Security linkage strategies include collection strategies, monitoring strategies, and defense strategies.

[0116] The collection strategy includes setting matching rules, conditions, and collection parameters to filter out data that meets the conditions.

[0117] The monitoring strategy is used to monitor the collected data in real time.

[0118] Defense strategies are used to take appropriate defense measures to protect the security of systems and networks based on detected security threats and risks.

[0119] Specifically, the collection strategy is the basic part of the security linkage strategy, which is mainly responsible for collecting various security-related data and information. The collection strategy includes a series of matching rules, conditions and collection parameters to filter out data that meets the conditions.

[0120] Monitoring strategy: Monitoring strategy is a key part of the security linkage strategy, which is responsible for real-time monitoring of the collected data. Monitoring strategy includes multiple aspects, such as intrusion detection, vulnerability scanning, abnormal behavior analysis, etc. By adopting various monitoring technologies and tools, comprehensive monitoring of network traffic, system status, etc. can be achieved, and abnormal situations and potential security threats can be discovered in a timely manner.

[0121] Defense strategy: Defense strategy is the ultimate goal of security linkage strategy. It is responsible for taking corresponding defense measures to protect the security of systems and networks based on the monitored security threats and risks. Defense strategies usually include multiple aspects, such as access control, encryption technology, firewall settings, intrusion prevention systems, etc. By adopting these defense technologies and measures, the security protection capabilities of systems and networks can be effectively improved, and the risks and losses of security threats can be reduced. In addition, defense strategies also need to be continuously updated and optimized according to the changes and evolution of security threats to adapt to new security challenges and threats. In this way, it is possible to ensure that the system and network always maintain a high level of security protection.

[0122] S6: Operate the relevant information security system and target device based on the security linkage strategy.

[0123] Optionally, these operations may include adjusting collection parameters, generating alarm information, updating security device policies, etc., to achieve the purpose of isolating network attacks and coordinated response.

[0124] Example 2, reference Figure 5 , which is an embodiment of the present invention, provides a system for a collaborative linkage response method based on threat intelligence, characterized in that it includes a data acquisition module 100, a data processing module 200, a data storage module 300, an association analysis module 400, a strategy generation module 500, and a linkage response module 600.

[0125] The data collection module 100 is used to collect security data and multi-source threat intelligence data.

[0126] The data processing module 200 is used to pre-process the collected data.

[0127] The data storage module 300 is used to store the processed data into a database and establish a threat intelligence database, an expert knowledge base and a security parameter database.

[0128] The correlation analysis module 400 is used to combine the expert knowledge base and the threat intelligence base to perform correlation analysis on the processed security data to obtain threat intelligence.

[0129] The strategy generation module 500 is used to generate a security linkage strategy by combining the super alarm with the data in the security parameter database.

[0130] The linkage response module 600 is used to accept the security linkage strategy to operate the relevant information security system and target device.

[0131] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0132] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0133] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0134] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0135] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A collaborative response method based on threat intelligence, characterized in that: include: Collect alarm data from security devices and multi-source threat intelligence data; Pre-process alarm data and multi-source threat intelligence data; Store the processed data into the database and establish a threat intelligence database, expert knowledge base and security parameter database; Combine the expert knowledge base and threat intelligence base to conduct correlation analysis on the processed security data to obtain threat intelligence; Combine threat intelligence with data from the security parameter database to generate security linkage strategies; Operate relevant information security systems and target devices based on security linkage strategies.

2. A collaborative response method based on threat intelligence as claimed in claim 1, characterized in that: The multi-source threat intelligence data includes samples associated with the entire network, samples associated with the unit, custom intelligence and open source intelligence; The open source intelligence described comes from the open source intelligence repository.

3. A collaborative response method based on threat intelligence as claimed in claim 2, characterized in that: The threat intelligence library includes multiple threat intelligence features such as attack organizations, attack targets, attack purposes, attack events, code features, IOCs, intelligence descriptions, technologies, and related relationships; The expert knowledge base includes a corresponding linkage strategy set and association rules; The security parameter database includes basic parameter information of network security devices and real-time status parameters of the network and security devices.

4. A collaborative response method based on threat intelligence as claimed in claim 3, characterized in that: The combining of the expert knowledge base and the threat intelligence base to perform correlation analysis on the processed security data to obtain threat intelligence specifically includes: inputting security data, clustering the security data using an adaptive multi-distance metric K-means algorithm, and analyzing security data of the same cluster; Determine whether the alarm data can match the association rules in the existing expert knowledge base. If it can match, a super alarm is generated. If it cannot match, the FP-Growth algorithm is used to mine association rules. Determine whether the association rules meet the confidence requirements. If so, generate new association rules and store them in the expert knowledge base, update the existing rule base, and generate super alarms based on the association rules. If not, delete the corresponding association rules. Get attack characteristics based on super alarms; The attack signature is matched with the attack signature in the existing threat intelligence library to determine whether it is an existing attack organization. If so, the corresponding threat intelligence is obtained. If not, new threat intelligence is generated and the existing threat intelligence library is updated.

5. A collaborative response method based on threat intelligence as claimed in claim 4, characterized in that: The step of judging whether the alarm data can match the association rules in the existing expert knowledge base includes inputting a data set and a clustering number value; Define a distance metric candidate set; Select an adaptive distance metric. In each iteration, for each data point, calculate multiple distance metrics from the initial cluster center, and use a heuristic method to evaluate which distance metric best reflects the distribution characteristics of the data under the current cluster center; According to the distance between the data point and the cluster center, find the minimum distance and assign the data point to the corresponding cluster; After completing the clustering of the data set, the cluster center is updated and the objective function value of the entire data set is calculated; Convergence check: check whether the cluster center converges or reaches the maximum number of iterations. The algorithm ends after convergence.

6. A collaborative response method based on threat intelligence as claimed in claim 5, characterized in that: The determining whether the alarm data can match the association rules in the existing expert knowledge base also includes scanning the data set once to obtain a set of items with frequent items being 1, counting the support of each item, deleting items with support lower than the minimum support, and sorting them in descending order of support; Construct the item header table and FP tree, perform a second scan on the frequent set obtained from the first scan, and generate corresponding data nodes according to the support, filter the sample branches according to whether they contain frequent items of the data, retain the branches containing frequent items, otherwise prune them, scan again, and regenerate the item header and FP tree; Taking the last head pointer of the item table header as the traversal starting point, randomly traverse all data items in the table header to determine whether the data in the traversed data item is a frequent item of the data. If an item meets the conditions of being a frequent item of the data, its mining result is retained. Otherwise, the result is discarded and the traversal is continued until the mining of all items is completed. For the retained data frequent item sets, calculate the support and confidence of the data, and take the frequent items with less than the minimum support and the minimum confidence as the association rules of the data; The evaluation of association rules is interpreted as knowledge and stored.

7. A collaborative linkage response method based on threat intelligence as claimed in claim 6, characterized in that: The security linkage strategy includes collection strategy, monitoring strategy and defense strategy; The collection strategy includes setting matching rules, conditions and collection parameters to filter out data that meets the conditions; The monitoring strategy is used to monitor the collected data in real time; The defense strategy is used to take corresponding defense measures to protect the security of the system and network according to the monitored security threats and risks.

8. A system using a collaborative linkage response method based on threat intelligence as described in any one of claims 1 to 7, characterized in that: It comprises a data collection module (100), a data processing module (200), a data storage module (300), a correlation analysis module (400), a strategy generation module (500), and a linkage response module (600); The data collection module (100) is used to collect security data and multi-source threat intelligence data; The data processing module (200) is used to pre-process the collected data; The data storage module (300) is used to store the processed data into a database and establish a threat intelligence database, an expert knowledge base and a security parameter database; The correlation analysis module (400) is used to combine the expert knowledge base and the threat intelligence base to perform correlation analysis on the processed security data to obtain threat intelligence; The strategy generation module (500) is used to generate a safety linkage strategy by combining the super alarm with the data of the safety parameter database; The linkage response module (600) is used to accept the security linkage strategy to operate the relevant information security system and target device.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of a collaborative linkage response method based on threat intelligence as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a collaborative linkage response method based on threat intelligence as described in any one of claims 1 to 7 are implemented.

Images