Information data analysis method, device and equipment, computer storage medium and program product

Abstract

The invention discloses an intelligence data analysis method, device and equipment, a computer storage medium and a program product. The method comprises the following steps: acquiring intelligence data; determining the correlation degree corresponding to one or more node correlation factors between any two nodes in the intelligence data; calculating the node association degree between any two nodes based on the association degree corresponding to one or more node association factors; calculating a path probability between any two nodes based on the node association degree between any two nodes, the association degree corresponding to one or more path association factors between any two nodes and the weight corresponding to the path association factors; and determining a target path based on the path probability between any two nodes, so that attack can be effectively defended based on the target path.

Description

Technical Field

[0001] The present application belongs to the field of data processing, and in particular, relates to an intelligence data analysis method, device, equipment, computer storage medium and program product. Background Art

[0002] In traditional intelligence data analysis, identifying intelligence nodes and attack chains usually relies on clear intelligence inputs. However, the cyber attack environment is highly uncertain, and attack behaviors are often accompanied by intelligence that is not fully revealed or partially missing. As a result, the attack chains identified by intelligence data analysis may be broken, making it impossible to effectively defend against attack behaviors.

[0003] In view of this, how to analyze intelligence data to make up for the broken attack chain and effectively defend against attack behaviors is an urgent problem to be solved. Summary of the invention

[0004] The embodiments of the present application provide an intelligence data analysis method, apparatus, device, computer storage medium, and program product, which can effectively make up for the broken attack chain and effectively defend against attack behaviors.

[0005] In a first aspect, an embodiment of the present application provides an intelligence data analysis method, comprising: acquiring intelligence data; determining the degree of association corresponding to one or more node association factors between any two nodes in the intelligence data; calculating the node association between any two nodes based on the degree of association corresponding to one or more of the node association factors; calculating the path probability between any two nodes based on the node association between any two nodes, the degree of association corresponding to one or more path association factors between any two nodes, and the weight corresponding to the path association factor; determining the target path based on the path probability between any two nodes.

[0006] In a second aspect, an embodiment of the present application provides an intelligence data analysis device, the device comprising: a data acquisition module for acquiring intelligence data; an association determination module for determining the degree of association corresponding to one or more node association factors between any two nodes in the intelligence data; a node calculation module for calculating the node association between any two nodes based on the degree of association corresponding to one or more of the node association factors; a path calculation module for calculating the path probability between any two nodes based on the node association between any two nodes, the degree of association corresponding to one or more path association factors between any two nodes, and the weight corresponding to the path association factor; and a path determination module for determining the target path based on the path probability between any two nodes.

[0007] In a third aspect, an embodiment of the present application provides an intelligence data analysis device, comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the intelligence data analysis method as described in the first aspect is implemented.

[0008] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, and when the computer program instructions are executed by a processor, the intelligence data analysis method as described in the first aspect is implemented.

[0009] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the intelligence data analysis method as described in the first aspect.

[0010] The embodiment of the present application provides an intelligence data analysis method. After acquiring intelligence data, the method calculates the correlation degree corresponding to the node correlation factor between any two nodes in the intelligence data, and calculates the node correlation degree between any two nodes based on the correlation degree corresponding to the node correlation factor. Based on the node correlation degree, the possible correlation between nodes in the intelligence data where the attack intelligence is unclear is effectively expressed, and a reference node correlation relationship is provided for mining paths where attacks may exist. The path probability between any two nodes is calculated based on the node correlation degree between any two nodes, the correlation degree corresponding to one or more path correlation factors between any two nodes, and the weight corresponding to the path correlation factor, and the probability of a possible attack path between the nodes is effectively inferred by combining the path correlation factors in the intelligence environment, so as to determine the target path based on the path probability between any two nodes. In this way, even if the network attack environment is uncertain, the attack intelligence is unclear, and the attack chain in the intelligence map may be broken or key nodes are missing, the method provided in the embodiment of the present application can analyze the correlation between nodes and the probability of a possible attack path, adaptively obtain the target path where attacks may exist, and effectively make up for the broken attack chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0012] Figure 1 It is a schematic diagram of an application scenario of the intelligence data analysis method provided in an embodiment of the present application;

[0013] Figure 2 It is a flow chart of the intelligence data analysis method provided by an embodiment of the first aspect of the present application;

[0014] Figure 3 is a flow chart of an intelligence data analysis method provided by another embodiment of the first aspect of the present application;

[0015] Figure 4 It is a structural schematic diagram of an intelligence data analysis device provided in an embodiment of the second aspect of the present application;

[0016] Figure 5 It is a structural diagram of a project data processing device provided in an embodiment of the third aspect of the present application. DETAILED DESCRIPTION

[0017] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are intended only to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by showing examples of the present application. It should be noted that the acquisition, storage, use, and processing of information and data in the embodiments of the present application are authorized by users or relevant agencies, in compliance with the relevant provisions of national laws and regulations.

[0018] In the traditional intelligence map construction process, intelligence nodes and attack chains usually rely on clear intelligence input, such as determined attack paths, known vulnerabilities, etc. However, the cyber attack environment is highly uncertain, and attack behaviors are often accompanied by intelligence that is not fully revealed or partially missing, which affects the integrity and accuracy of the intelligence map. Without clear intelligence input, the attack chain in the intelligence map may be broken or key nodes may be missing, thus affecting subsequent defense decisions.

[0019] In view of this, an embodiment of the present application provides an intelligence data analysis method. After acquiring intelligence data, the method calculates the correlation corresponding to the node correlation factor between any two nodes in the intelligence data, and calculates the node correlation between any two nodes based on the correlation corresponding to the node correlation factor. Based on the node correlation, the possible correlation between nodes in the intelligence data where the attack intelligence is unclear is effectively expressed, and a reference node correlation relationship is provided for mining paths where attacks may exist. Moreover, based on the node correlation between any two nodes, the correlation corresponding to one or more path correlation factors between any two nodes, and the weight corresponding to the path correlation factor, the path probability between any two nodes is calculated, and the probability that an attack path may exist between the nodes is effectively inferred by combining the path correlation factors in the intelligence environment, so as to determine the target path based on the path probability between any two nodes. In this way, even if the network attack environment is uncertain, the attack intelligence is unclear, and the attack chain in the intelligence map may be broken or key nodes are missing, the method provided in the embodiment of the present application can analyze the correlation between nodes and the probability of paths where attacks may exist, adaptively obtain the target path where attacks may exist, and effectively make up for the broken attack chain.

[0020] The intelligence data analysis method provided in the embodiment of the present application can be used for analyzing various intelligence data scenarios. For example: enterprise network security intelligence data analysis scenario, financial security intelligence data analysis scenario, communication security intelligence data analysis scenario, etc. The intelligence data analysis method provided in the embodiment of the present application can be applied to analysis platforms for various types of security intelligence data. The analysis platform can run on a server or any electronic device. Below, the possible application scenarios of the intelligence data analysis method provided in the embodiment of the present application are exemplified.

[0021] Figure 1 Schematic diagram of an application scenario of the intelligence data analysis method provided in the embodiment of the present application. Figure 1 As shown, the intelligence data analysis method provided in the embodiment of the present application is applied to the data analysis platform 10. Exemplarily, the data analysis platform 10 can interact with the data collection platform 20 to obtain the intelligence data collected by the data collection platform 20.

[0022] The data analysis platform 10 is used to obtain the intelligence data collected by the data collection platform 20, determine the correlation corresponding to one or more node correlation factors between any two nodes in the intelligence data, calculate the node correlation between any two nodes based on the correlation corresponding to one or more node correlation factors, calculate the path probability between any two nodes based on the node correlation between any two nodes, the correlation corresponding to one or more path correlation factors between any two nodes, and the weights corresponding to the path correlation factors, and determine the target path based on the path probability between any two nodes.

[0023] The data collection platform 20 is used to collect intelligence data of possible attack behaviors from various data sources such as one or more servers and / or one or more user devices. The data source can monitor the possible attack behaviors and generate intelligence data based on the monitoring so that the data collection platform 20 can collect the intelligence data.

[0024] Exemplarily, the data collection platform 20 can collect various intelligence data of possible attacks on the servers from the servers of financial institutions and other institutions, and provide the intelligence data to the data analysis platform 10. Optionally, the data collection platform 20 can also save the intelligence data in the intelligence database 30 for reading or storage on demand.

[0025] The data analysis platform 10 can analyze the acquired intelligence data, obtain the association between the nodes of the intelligence data and the probability of possible attack paths, adaptively obtain the target paths that may be attacked, effectively defend against attack behaviors, and protect the safe operation of the data source.

[0026] The data analysis platform 10 and the data collection platform 20 may include more than one electronic device. The electronic device may include a server, a gateway, a router, etc., and the type and quantity of the electronic device are not limited here.

[0027] It should be noted that the application scenarios described above are merely illustrative, and the intelligence data analysis method provided in the embodiments of the present application includes but is not limited to the application scenarios listed above.

[0028] The intelligence data analysis method, device, equipment, computer storage medium and program product in this application are described below.

[0029] The first aspect of the present application provides an intelligence data analysis method. Figure 2 This is a flow chart of an intelligence data analysis method provided in an embodiment of the first aspect of the present application. Figure 2 As shown, the intelligence data analysis method may include steps 210-250.

[0030] Step 210: Obtain intelligence data.

[0031] Intelligence data can be security-related data from various sources. For example, intelligence data can be expressed as network security intelligence data. Network security intelligence data can include data related to tools, users, behaviors, events, time, etc. related to network security. Another example is that intelligence data can be expressed as financial security intelligence data. Financial security intelligence data can include data related to transactions, relationships between accounts, specific time, specific events, user behaviors, etc. related to financial security. The sources of data can include system logs, user behavior logs, database logs, communication data, etc. Furthermore, the attack information in the intelligence data can be expressed as threat information, vulnerability information, attack mode information, attack time information, attack tool information, attack location information, etc.

[0032] Intelligence data can be obtained from data sources such as servers, user devices, and databases.

[0033] For example, the physical locations corresponding to different network addresses can be obtained from the geographic location database as intelligence data. In this way, the correlation between the physical locations corresponding to different network addresses can be analyzed, such as whether they are from the same country or region, thereby identifying the correlation between different network addresses and digging out possible paths of attack behavior.

[0034] For another example, the attack time corresponding to possible attack behaviors of different network addresses can be obtained from the server's system log as intelligence data. In this way, the correlation of attack times corresponding to different network addresses can be analyzed, such as analyzing whether the attack times are close, thereby identifying the correlation between different network addresses and digging out the paths where possible attack behaviors exist.

[0035] Step 220: Determine the degree of association corresponding to one or more node association factors between any two nodes in the intelligence data.

[0036] A node can be understood as an entity in intelligence data, which is used to represent the specific object involved in or involved in the attack in the intelligence data.

[0037] Any two nodes can be any two nodes in the intelligence data. Using the previous example, network address A and network address B and their corresponding physical addresses are obtained from the geographic location database, the attack time corresponding to network address A and network address B is obtained from the server system log, and the attack tool information used by network address A and network address B is obtained from the vulnerability database. Network address A and network address B can be understood as two nodes.

[0038] The node association factor is a factor used to measure the potential degree of association between nodes. The association degree corresponding to the node association factor is used to characterize the potential degree of association between nodes. The association degree can reflect the strength or possibility of the association between nodes under certain fuzziness or uncertainty.

[0039] Continuing with the previous example, the node correlation factor between two nodes with network address A and network address B may include at least one of: physical address, attack time, and attack tool.

[0040] The correlation degree corresponding to the node correlation factor is used to represent the corresponding correlation strength or correlation possibility between two nodes in the dimension of the node correlation factor. The value range of the correlation degree can be set as needed, such as between 0 and 1.

[0041] In some embodiments, the node pairs that may be adjacent in the intelligence data may be determined first to obtain one or more groups of node pairs, or the node pairs in the intelligence data may be randomly determined to obtain one or more groups of node pairs, and the correlation degree is calculated for each group of node pairs, so that each group of node pairs in this step can obtain the corresponding correlation degree. Any group of node pairs can be understood as any two nodes.

[0042] By analyzing the correlation between multiple groups of node pairs in the intelligence data, the correlation relationship between each node in the intelligence data graph can be fully mined.

[0043] In some embodiments of the present application, the node association factor includes at least one of: attack tool, attack time, and attack location.

[0044] Attack tools are factors such as software, scripts, vulnerabilities, hardware, etc. used in attacks, such as vulnerability exploitation information and virus type information.

[0045] Attack time refers to time factors such as the moment and period of the attack.

[0046] Attack location refers to location factors such as the network location and / or physical location of the attack.

[0047] By using at least one node correlation factor among the attack tool, the attack time and the attack position, the correlation between any two nodes can be accurately analyzed.

[0048] The degree of association corresponding to the node association factor can be determined based on the factor data corresponding to the two nodes on the node association factor. There are multiple ways to determine the degree of association. For example, the proportion of the common part of the factor data corresponding to the two nodes on the node association factor can be calculated to obtain the degree of association. For another example, corresponding degrees of association can be preset for a variety of preset association situations, and according to the preset association situation to which the factor data corresponding to the two nodes on the node association factor belong, the preset degree of association corresponding to the preset association situation is taken as the degree of association between the two nodes.

[0049] For example, the physical locations of node IP A and node IP B can be obtained from the geographic location database, and the physical locations of the two nodes can be determined to be related to each other. For example, determine whether they are from the same country or region. If they are located in the same country, then because "attackers from the same country may use the same attack path", the preset correlation is high, which is 0.9, so the correlation between node IP A and node IP B is determined to be 0.9; if they are from different countries, but there have been cross-border cooperative attacks in history, then because the preset correlation for this type of correlation is 0.5, the correlation between node IP A and node IP B in physical location is determined to be 0.5; if they are located in completely different continents and there is no relevant cooperation record in history, then because the preset correlation for this type of correlation is 0.2, the correlation between node IP A and node IP B in physical location is 0.2. In this embodiment, the node association factor is the physical position. The factor data corresponding to the node association factor of the physical position belongs to different preset association situations, and the corresponding preset association degrees are different. Therefore, according to the association situation of the physical locations of the nodes IP A and IP B, the association degree of the nodes IP A and IP B in terms of physical location can be determined.

[0050] For another example, the exploitation information of vulnerabilities such as CVE-2022-1234 can be obtained from the enterprise's vulnerability database and external threat intelligence sources to determine which association situation the attack tools of node IP A and node IP B belong to. For example: determine whether the same or similar vulnerabilities are exploited. If both node IP A and node IP B exploit the vulnerability, then since the preset correlation of the association situation is high, which is 0.95, the correlation between node IP A and node IP B in attack tools is 0.95; if the vulnerabilities exploited by the two are different, but the vulnerabilities of the two belong to the same category (such as remote code execution vulnerabilities), then since the preset correlation of the association situation is in the middle, which is 0.7, the correlation between node IP A and node IP B in attack tools is 0.7; if the vulnerabilities exploited by the two are completely different, then since the preset correlation of the association situation is low, which is 0.2, the correlation between node IP A and node IPB in attack tools is 0.2. In this embodiment, the node association factor is the attack tool, which can also be understood as the vulnerability exploitation corresponding to the attack tool. The factor data corresponding to the node association factor of the attack tool belongs to different preset association conditions, and the corresponding preset association degrees are different. Therefore, according to the association conditions of the attack tools of the node IP A and the node IP B, the association degree of the node IP A and the node IP B in the attack tools can be determined.

[0051] For another example, the time when the attack occurred can be obtained from the system log to determine which type of correlation the attack time of node IP A and node IP B belongs to. For example, determine whether they are in a similar time. If the attack time is close, it means that the attack behaviors of the two may be coordinated. For example, if the attacks of the two occur in the same week, then because the preset correlation of the correlation situation is high, which is 0.85, the correlation between node IP A and node IP B in attack time is 0.85; if the time interval is long, such as one month apart, then because the preset correlation of the correlation situation is low, which is 0.4, the correlation between node IP A and node IPB in attack time is 0.4; if the time interval exceeds half a year or a year, then because the preset correlation of the correlation situation is very low, which is 0.1, the correlation between node IP A and node IP B in attack time is 0.1. In this embodiment, the node correlation factor is the attack time.

[0052] In environments such as cybersecurity and financial security, intelligence data is usually complex and uncertain, and many relationships are not black and white, but exist in a vague or uncertain state. Therefore, using the node association factor to determine the corresponding association degree based on the association situation can better measure the uncertain degree of association between two nodes.

[0053] Step 230: Calculate the node association degree between any two nodes based on the association degrees corresponding to one or more of the node association factors.

[0054] Node correlation is the correlation between nodes, which is comprehensively evaluated by using the correlation corresponding to one or more node correlation factors. By calculating the node correlation between nodes using the correlation corresponding to one or more node correlation factors, it is possible to infer the potential correlation between nodes based on incomplete intelligence information, and measure whether there is an implicit and unclear attack correlation between two nodes. The node correlation between two nodes can be quantified as a specific value. The value range of the node correlation can be set as needed, such as between 0 and 1.

[0055] In some embodiments of the present application, the calculating the node association degree between any two nodes based on the association degree corresponding to one or more of the node association factors includes:

[0056] Calculate the sum of the association degrees corresponding to the node association factors;

[0057] Calculating the number of relevance factors of the node relevance factor;

[0058] The node association degree between any two nodes is calculated based on the number of association factors and the sum.

[0059] In this embodiment, the sum can represent the cumulative effect of the strength of the relationship between two nodes under the joint action of all node association factors, and a more balanced association degree can be measured by the number of node association factors, so that the calculated association degree is more accurate. For example, the number of association factors can be further used to calculate the geometric mean of the size of the association factor set, and the sum is divided by the geometric mean, so that the final result falls within a more reasonable range, avoiding imbalanced evaluation.

[0060] Exemplarily, the calculation formula of node association is as follows:

[0061]

[0062] Among them, k refers to the kth node association factor, F k (v i ,v j ) is the node v i and v j The correlation degree corresponding to the kth node correlation factor between them. The node correlation factor can be the attack tool, attack time, attack location, etc. Represents node v i and v j The sum of the correlation degrees corresponding to the correlation factors of all nodes between them. i and vj The sum of the correlations between the attack tool, attack time, and attack location between two nodes. i ) and F(v j ) are nodes v i and v j The association factor set represents the number of node association factors. For example: node v i and v j The node association factors are attack tool, attack time, and attack location. The number of node association factors of the two is 3 respectively, so the denominator is calculated as 3 times 3.

[0063] Continuing with the previous example, assume that in the acquired intelligence data, the IP addresses of node IP A and node IP B are from the same country, node IP A and node IP B exploit the same vulnerability, and the attack time of node IP A and node IP B is less than three days apart. Therefore, since the two IP addresses are from the same country, the possibility of attacks from the same country is higher, so the correlation corresponding to the attack location is F(IP A, IP B) = 0.9; node IP A and node IP B both exploit the vulnerability CVE-2022-1234. According to the similarity of vulnerability exploitation, the correlation corresponding to the attack tool is 0.95; the attack time of node IP A and node IP B is less than three days apart, and the attack time is close, so the correlation corresponding to the attack time is 0.85. Therefore, the sum of the correlations corresponding to all node correlation factors of node IP A and node IP B is 0.9+0.95+0.85=2.7. Therefore, the denominator, v i and v j The geometric mean of the number of factors corresponding to the node association factors of the two nodes is

[0064] Therefore, according to the calculation formula of node association, we can get:

[0065] The node association degree between node IP A and node IP B = 2.7 / 3 = 0.9.

[0066] It can be seen from the above examples that when the intelligence data is unclear, such as when there is no clear relationship between nodes or the data is incomplete, the node association between node IP A and node IP B can be inferred according to the method provided in this embodiment. Through the node association, possible attack paths in the intelligence data can be further analyzed.

[0067] Step 240: Calculate the path probability between any two nodes based on the node association degree between any two nodes, the association degree corresponding to one or more path association factors between any two nodes, and the weight corresponding to the path association factor.

[0068] The path correlation factor is a factor used to measure the probability that an attack path may exist between nodes. It is understandable that the greater the correlation between two nodes, the higher the probability that an attack path may exist. In an embodiment of the present application, by way of example and not limitation, the path correlation factor can be regarded as a large set of all possible correlation factors between two nodes, and the included correlation factors are relatively comprehensive, so that the various possible correlations between nodes can be fully considered, thereby effectively evaluating the probability that an attack path may exist. The node correlation factor is different from the path correlation factor in that the node correlation factor is a factor used to accurately evaluate the degree of correlation between two nodes. Therefore, by way of example and not limitation, the node correlation factor can be regarded as a small set of the most likely correlation factors between two nodes, and the included correlation factors are relatively accurate. At least one path correlation factor is different from the node correlation factor.

[0069] Exemplarily, the path correlation factor may include at least one of: attack behavior context, attack time, and historical attack behavior pattern.

[0070] Attack behavior context is the environmental information of two nodes around one or a series of attack events, which can also be understood as intelligence environment context. For example, the attack behaviors of two nodes are carried out through VPN.

[0071] Attack time refers to the time, period, etc. when the attack occurs. For example, the attack time of two nodes is only two days apart.

[0072] The historical attack behavior pattern is a pattern with certain regularity in the historical attack behaviors that have occurred between two nodes. For example, two nodes have had similar attack behaviors in history.

[0073] The weight corresponding to a path correlation factor is a quantitative indicator of the degree of influence of the path correlation factor on the correlation of the entire path. The weights corresponding to different path correlation factors can be the same or different, and the specific value is determined according to the degree of influence. The sum of the weights corresponding to multiple path correlation factors can be 1.

[0074] A path refers to the connection relationship from one node to another. For example, the path between node A and node X is AX, the path from node X to node C is XC, and nodes A to C form an attack chain AXC that contains multiple paths.

[0075] By determining the path probability and discovering the potential attack path, we can effectively make up for the broken attack chain in the intelligence map, making the attack chain in the intelligence map more comprehensive and complete, and effectively defending against attacks.

[0076] Path probability is the degree of association between nodes, which is a comprehensive evaluation of the node association between two nodes, the degree of association corresponding to one or more path association factors between two nodes, and the weights corresponding to the path association factors. Unlike node association, path probability pays more attention to the intelligence environment, and combines the influence of different path association factors in the intelligence environment to infer the probability of possible attack paths.

[0077] In some embodiments of the present application, the calculating the path probability between any two nodes based on the node association degree between any two nodes, the association degree corresponding to one or more path association factors between any two nodes, and the weight corresponding to the path association factor includes:

[0078] Calculating the path comprehensive correlation degree of any two nodes based on the correlation degree corresponding to one or more path correlation factors between any two nodes and the weight corresponding to the path correlation factor;

[0079] The node association degree between any two nodes is multiplied by the path comprehensive association degree between any two nodes to obtain the path probability between any two nodes.

[0080] Exemplarily, the path probability calculation formula between two nodes is as follows:

[0081] P(path(v i ,v j ))=correlation(v i ,v j )·f(context, time, historical attack)

[0082] Among them, the correlation (v i ,v j ) is v i ,v j The node correlation between two nodes, f(context, time, historical attack) is the function used to calculate the comprehensive correlation of the path.

[0083] Optionally, based on the correlation corresponding to one or more path correlation factors between any two nodes and the weights corresponding to the path correlation factors, the path comprehensive correlation between any two nodes is calculated, which may be calculated by weighted summation.

[0084] Exemplarily, the calculation formula of the comprehensive path correlation is as follows:

[0085] f(context, time, historical data) = α·C(context) + β·T(time) + γ·H(historical attacks)

[0086] Among them, C (context) represents the correlation corresponding to the context of attack behavior, T (time) represents the correlation corresponding to the attack time (e.g., the proximity of the attack time), H (historical attack) represents the correlation corresponding to the historical attack pattern, α, β, γ are the weights corresponding to each path correlation factor, where α+β+γ=1.

[0087] It can be seen that the calculation of path probability can be regarded as a comprehensive scorer, which gives the final path probability by weighted summing the path association factors of multiple dimensions and combining them with the node association degree.

[0088] In this embodiment, a weighted calculation is performed based on the correlation degree corresponding to the path correlation factor and the corresponding weight to obtain the path comprehensive correlation degree, and then based on the multiplication of the node correlation degree and the path comprehensive correlation degree, the path probability can be calculated more accurately.

[0089] Continuing with the previous example, assume that the following intelligence data is collected:

[0090] Node IP A launched the attack on May 1, 2024, and the attack was carried out through the enterprise VPN; node IP B launched the attack on May 3, 2024, and the target of the attack was the database server of the same enterprise, and it had also been attacked through the enterprise VPN in the past.

[0091] In the intelligence data, there is no confirmed attack chain between node IP A and node IP B, and the attack chain is broken. In order to make up for the broken attack chain in the intelligence graph, the embodiment of the present application calculates the path probability between node IP A and node IP B through the following calculation process to predict the potential attack path.

[0092] Specifically, based on the above intelligence data, the comprehensive path correlation is calculated as follows:

[0093] The correlation degree corresponding to the attack behavior context is C(context) = 0.8 (both attacks were conducted through VPN), and the weight corresponding to the attack behavior context is α = 0.4;

[0094] The correlation degree corresponding to the attack time is T(time) = 0.9 (the attack time is only two days apart), and the weight corresponding to the attack time is β = 0.3;

[0095] The correlation degree corresponding to the historical attack pattern is H(historical attack) = 0.85 (the attacker IP B has had similar behavior before), and the weight corresponding to the historical attack pattern is γ = 0.3;

[0096] Based on this, the comprehensive path correlation between node IP A and node IP B

[0097] =0.32+0.27+0.255=0.845.

[0098] Assuming that the node association degree is 0.9, the path probability P = 0.9 × 0.845 = 0.7605, which means that the path probability between node IP A and node IP B is 0.7605.

[0099] It can be seen that although there is no clear attack path between node IP A and node IP B, the calculated path probability of 0.7605 can determine that the two nodes have a high node association and path probability, thereby inferring that there may be an attack path between the two nodes.

[0100] It can be seen from the above examples that although the actual intelligence environment is complex and changeable, the embodiments of the present application fully consider various influencing factors and make the calculation of path probability more accurate and reliable by weighted calculation of the comprehensive path correlation of the multi-dimensional intelligence environment.

[0101] Step 250: Determine a target path based on the path probability between any two nodes.

[0102] The target path is the path connecting two nodes whose path probability meets certain conditions. Since the node association degree of each group of node pairs is different and the association degree corresponding to the path association factor is different, the path probability calculated according to the method provided in the embodiment of the present application is also different. It can be understood that the greater the path probability of the node pair, the greater the possibility of attack, otherwise the smaller.

[0103] Optionally, the path probability between two nodes can be compared with a preset minimum path probability threshold. When it is greater than or equal to the preset minimum path probability threshold, it can be considered that there is an ambiguous path between the two nodes. Thus, the path formed by connecting the two nodes is used as the target path. Otherwise, it is not considered that there is an ambiguous path between the two nodes and the two nodes are not connected.

[0104] In some embodiments of the present application, the method further includes:

[0105] Acquire new intelligence data;

[0106] Based on the new intelligence data, the path probability of the target path is updated and / or a new target path is added.

[0107] For example, the processing of steps 210 to 250 may be performed for new intelligence data to recalculate the path probability of the target path and / or add a new target path.

[0108] In this embodiment, after the potential attack path is generated, the path probability of the target path can be dynamically updated according to the new intelligence data, and the potential attack path can be gradually converted into a determined attack path, so that the attack chain in the intelligence map gradually becomes clearer and the attack can be effectively defended.

[0109] It can be seen that even if the network attack environment is uncertain, the attack intelligence is unclear, and the attack chain in the intelligence map may be broken or key nodes are missing, the method provided in the embodiment of the present application can analyze the relationship between the nodes and the path probability of possible attack paths, adaptively obtain the target path where the attack may exist, and effectively make up for the broken attack chain.

[0110] Figure 3 A flowchart of an intelligence data processing method provided by another embodiment of the first aspect of the present application. Figure 3 As shown, after step 250, step 360 may also be included.

[0111] Step 360: Based on the target path, construct an intelligence map corresponding to the intelligence data, in which the target path has a corresponding first preset mark, and the first preset mark is used to characterize a potential attack path.

[0112] For example, the target path may be added to an existing intelligence map, and a first preset mark may be added to the target path in the intelligence map.

[0113] Intelligence graph is a graphical representation of intelligence data, depicting entities and their relationships through nodes and edges. The edge between two adjacent nodes can be understood as a path, and multiple paths with connectivity form an attack chain.

[0114] The first preset mark is used to characterize a potential attack path, that is, the target path is in a fuzzy state of a non-clear attack path. Exemplarily, the first preset mark can be expressed as "speculated path" or "to be confirmed".

[0115] It should be understood that the target path is a guess based on uncertain intelligence data and is uncertain. Therefore, in the intelligence map, by marking the target path, it is possible to distinguish between potential attack paths and existing clear attack paths, so as to make a more accurate judgment on whether an attack has occurred.

[0116] In some embodiments, in combination with the above embodiments, the intelligence map can also be repaired using new intelligence data. Figure 3 As shown, in some embodiments of the present application, the method further includes: step 370.

[0117] Step 370: Based on the new intelligence data, update the path probability of the target path in the intelligence map and / or add a new target path.

[0118] For example, when a potential attack path is inserted into an intelligence map, it is marked as a "speculated path". When new intelligence data arrives, the path probability of the target path can be dynamically updated in the intelligence map. In this way, the potential attack path can be gradually converted into a confirmed attack path, making the attack chain in the intelligence map gradually clearer and effectively defending against attacks.

[0119] In some embodiments of the present application, Figure 3 As shown, the method further includes step 380.

[0120] Step 380: When the path probability of the target path meets the path conversion condition, the first preset mark of the target path is converted into a second preset mark; or, when the path probability of the target path meets the deletion condition, the target path is deleted from the intelligence map.

[0121] The second preset mark is a mark used to characterize the determined attack path. Exemplarily, the second preset mark can be expressed as "determined attack path", "real attack path" and the like.

[0122] The path conversion condition may be a pre-set condition that should be satisfied to convert a potential attack path into a determined attack path. Optionally, the path conversion condition may be expressed as a preset path probability threshold. When the path probability of the target path is greater than or equal to the preset path probability threshold, a path confirmation request may be output. After receiving the path confirmation request, if the security personnel determines that the path can be converted, they input a confirmation conversion instruction. At this time, the system receives a confirmation conversion instruction for the path confirmation request and determines that the path conversion condition is satisfied.

[0123] It is understandable that after the arrival of new intelligence data, the node correlation of some nodes and the correlation of path correlation factors may increase or decrease. As a result, the path probability of the target path may change. Based on the new intelligence data, the target path may be gradually confirmed or denied.

[0124] For example, when the path probability of the target path gradually increases until it exceeds the preset path probability threshold, the system will output a path confirmation request for the target path. If the security personnel believe that the target path can be converted into a confirmed attack path, a confirmation conversion instruction is input for the path confirmation request. In this way, when the system receives the confirmation conversion instruction, it converts the corresponding target path into a valid confirmed attack path, updates the mark of the target path, and converts the mark from the first preset mark to the second preset mark. At this time, the target path is converted from a potential attack path to a confirmed attack path.

[0125] For another example, when the path probability of the target path is lower than the minimum path probability threshold, the target path can be considered to be blurred to the extent of disappearance. In this case, the target path can be deleted from the intelligence map.

[0126] In some embodiments of the present application, when the path probability of the target path satisfies the path conversion condition, converting the first preset mark of the target path into the second preset mark includes:

[0127] When the path probability of the target path is greater than or equal to a preset path probability threshold, outputting a path confirmation request;

[0128] In case of receiving a confirmation conversion instruction for the path confirmation request, the first preset mark of the target path is converted into a second preset mark.

[0129] Exemplarily, assume that the path probability of a target path A->X is greater than or equal to a preset path probability threshold. At this point, the system can output a path confirmation request of "The path probability of A->X is greater than or equal to the preset path probability threshold, please confirm whether to convert the path of A->X to a determined attack path". If the security personnel believe that A->X can be converted to a determined attack path based on the path confirmation request, then enter a confirmation conversion instruction. At this point, the system converts A->X to a determined attack path. If there is also a determined attack path X->Z in the intelligence map, a determined attack chain of A->X->Z can be formed in the intelligence map. If the security personnel believe that A->X cannot be converted to a determined attack path based on the path confirmation request, then enter a denial conversion instruction. At this point, the system maintains the first preset mark of A->X, or, if the denial conversion instruction also carries a deletion instruction, then A->X is deleted from the intelligence map.

[0130] It can be seen that according to this embodiment, a clear target path is determined in time, and a target path with too low path probability is deleted, thereby maintaining the timeliness and accuracy of the intelligence map.

[0131] For example, the path probability of potential attack paths can be dynamically updated according to new intelligence data, new target paths can be added, and target paths with too low path probabilities can be deleted. Moreover, once the first preset mark of any target path is converted to the second preset mark, the potential attack path is converted to a determined attack path.

[0132] In some embodiments of the present application, Figure 3 As shown, the method further includes step 390.

[0133] Step 390: Determine the attack chain formed based on the target path in the intelligence graph, and generate a defense strategy corresponding to the attack chain.

[0134] A defense strategy can be understood as a strategy for preventing attacks from an attack chain. The specific implementation method of generating a defense strategy is not limited. For example, some possible attack methods and corresponding rules of the corresponding defense methods on the attack chain can be set, and the defense strategy corresponding to the attack method on the attack chain can be generated by rule matching. For another example, a pre-trained defense strategy generation model can be used to predict the defense strategy corresponding to the attack method on the attack chain.

[0135] There is no limit to the timing of generating a defense strategy corresponding to an attack chain. In some embodiments, after the target path is added to the intelligence map and before it is converted to a determined attack path, a corresponding defense strategy can be generated based on the attack chain formed by the target path, so as to defend as early as possible. In other embodiments, after the target path is added to the intelligence map and converted to a determined attack path, the attack chain formed by the target path is determined, and a defense strategy corresponding to the attack chain is generated, so as to defend accurately.

[0136] For example, if the target path between node IP A and node IP X is added to the intelligence graph, the attack chain including IP A to node IP X can be further determined, and recommendations can be generated to prevent further intrusion of attacker IP A. At the same time, tool X can be deeply analyzed to prevent its lateral movement in the internal network.

[0137] In some embodiments, after the potential attack path is confirmed, it is converted into a determined attack path, which is automatically integrated into the attack chain and a corresponding defense strategy is generated to effectively resist the attack.

[0138] In some embodiments of the present application, the method further includes: multiplying the path probabilities corresponding to the attack paths in the attack chain to obtain the attack chain probability corresponding to the attack chain.

[0139] It should be noted that each attack path in the attack chain may include a potential attack path and / or a confirmed attack path.

[0140] It is understandable that based on the fuzziness or certainty of the path in the attack chain, the attack chain can also present two possibilities: fuzziness or certainty. Therefore, the attack chain in the intelligence map can also be marked as a first preset mark to represent a potential attack chain, or marked as a second preset mark to represent a certain attack chain.

[0141] For example, it is assumed that after processing the intelligence data, a potential attack path from attacker IP A to tool X and a potential attack path from tool X to target system C are obtained, forming a potential attack chain in which attacker IP A attacks target system C through tool X, wherein the path probability of the target path from attacker IP A to tool X is 0.9, and the path probability from tool X to target system C is 0.7, then the attack chain probability of the attack chain (A→X→C) is 0.63.

[0142] As a result, an attack chain including (A→X→C) is formed in the intelligence map. Due to the low probability of the attack chain, this attack chain is still marked as "pending confirmation", prompting the system and security personnel that the attack chain is a vague attack chain that may contain attacks.

[0143] Through this embodiment, the attack possibility of a fuzzy attack chain can be accurately represented, providing a reference for system and security personnel.

[0144] The following is an example of a scenario implementation to illustrate the process of intelligence data analysis.

[0145] Suppose that the intelligence data obtained shows that the enterprise network has suffered a complex multi-stage attack, and the attacker has invaded the internal network through phishing emails and remote code execution vulnerabilities (CVE-2022-9999). However, due to the incompleteness of the intelligence source, the system only captured part of the attacker's IP address and attack tools, and the attack path was broken. For example, it is known that the attacker IP A has launched a preliminary attack and moved laterally through some known tools, but the attacker's complete path and specific attack methods are still not fully revealed. That is, the attacker IP A, the lateral movement tool X, and the target system C are known, but the attack path is incomplete, and it is impossible to directly infer whether the attacker has attacked the target system C through tool X.

[0146] Based on the above intelligence data, we first calculate the path probability of the fuzzy target path between attacker IP A and lateral movement tool X, and lateral movement tool X and target system C in the intelligence data. Assuming that the historical attack behavior pattern shows that attacker IP A often uses tool X in similar scenarios, the historical attack behavior pattern has a high correlation. Based on this, we calculate the path probability of the target path (A, X) = 0.9. Assuming the correlation between tool X and target system C, based on the existing attack path fragments, we calculate the path probability of the target path (X, C) = 0.7.

[0147] After calculating the path probability of the target path (A, X) and the path probability of the target path (X, C), the attack chain probability of the attack chain (A→X→C) can be further calculated based on the path probabilities of the target path (A, X) and the target path (X, C). The attack chain probability of the attack chain (A→X→C) = 0.63.

[0148] After this, if new intelligence data arrives, confirming that the attacker used tool X to attack target system C. Based on this credible intelligence data, the potential attack paths (A, X) and (X, C) can be further converted into definite attack paths, and the attack chain (A→X→C) can be converted into a definite attack chain. If new intelligence data arrives, although the above target paths and attack chains are not converted into definite attack paths and definite attack chains, the path probabilities and attack chain probabilities can still be dynamically updated, thereby removing the target path, increasing or decreasing the path probability, and maintaining the simplicity and accuracy of the intelligence graph.

[0149] After the potential attack path is converted into a clear attack path, it can be automatically integrated to form a clear attack chain and generate corresponding defense strategies. For example, the model recommends blocking further intrusion of attacker IP A, while performing in-depth analysis on tool X to prevent its lateral movement in the internal network.

[0150] A second aspect of the present application provides an intelligence data analysis device. Figure 4 A schematic diagram of the structure of an intelligence data analysis device provided in an embodiment of the second aspect of the present application. Figure 4 As shown, the intelligence data analysis device 400 may include:

[0151] The data acquisition module 410 is used to acquire intelligence data.

[0152] The association determination module 420 is used to determine the association degree corresponding to one or more node association factors between any two nodes in the intelligence data.

[0153] The node calculation module 430 is used to calculate the node association degree between any two nodes based on the association degree corresponding to one or more of the node association factors.

[0154] The path calculation module 440 is used to calculate the path probability between any two nodes based on the node association between any two nodes, the association corresponding to one or more path association factors between any two nodes, and the weight corresponding to the path association factor.

[0155] The path determination module 450 is used to determine a target path based on the path probability between any two nodes.

[0156] Optionally, the device further comprises:

[0157] An intelligence map processing module is used to construct an intelligence map corresponding to the intelligence data based on the target path, in which the target path has a corresponding first preset mark, and the first preset mark is used to characterize a potential attack path.

[0158] Optionally, the node computing module includes:

[0159] A sum calculation submodule, used to calculate the sum of the association degrees corresponding to the node association factors;

[0160] A quantity calculation submodule, used to calculate the quantity of correlation factors of the node correlation factors;

[0161] The node association calculation submodule is used to calculate the node association degree between any two nodes based on the number of association factors and the sum.

[0162] Optionally, the path calculation module includes:

[0163] A path association calculation submodule, used to calculate the path comprehensive association degree between any two nodes based on the association degree corresponding to one or more path association factors between any two nodes and the weight corresponding to the path association factors;

[0164] The path probability calculation submodule is used to multiply the node association degree between any two nodes by the path comprehensive association degree between any two nodes to obtain the path probability between any two nodes.

[0165] Optionally, the device further comprises:

[0166] Intelligence update module, used to obtain new intelligence data;

[0167] A path updating module is used to update the path probability of the target path and / or add a new target path based on the new intelligence data.

[0168] Optionally, the device further comprises:

[0169] A conversion module is used to convert a first preset mark of the target path into a second preset mark when the path probability of the target path meets the path conversion condition, and the second preset mark is used to characterize the determined attack path; or when the path probability of the target path meets the deletion condition, delete the target path from the intelligence map.

[0170] Optionally, the conversion module is used to output a path confirmation request when the path probability of the target path is greater than or equal to a preset path probability threshold, and to convert the first preset mark of the target path into a second preset mark upon receiving a confirmation conversion instruction for the path confirmation request.

[0171] Optionally, the device further comprises:

[0172] The defense generation module is used to determine the attack chain formed based on the target path in the intelligence graph and generate a defense strategy corresponding to the attack chain.

[0173] Optionally, the device further comprises:

[0174] The attack chain probability calculation module is used to multiply the path probabilities corresponding to the attack paths in the attack chain to obtain the attack chain probability corresponding to the attack chain.

[0175] The third aspect of the present application also provides an intelligence data analysis device. Figure 5 This is a schematic diagram of the structure of a project data analysis device provided in one embodiment of the present application. Figure 5 As shown, the project data analysis device 500 includes a memory 501 , a processor 502 , and a computer program stored in the memory 501 and executable on the processor 502 .

[0176] In some examples, the processor 502 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0177] The memory 501 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 501 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these.

[0178] The memory 501 may include a read-only memory (ROM), a random access memory (RAM), a disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the project data processing method in the embodiment of the present application.

[0179] The processor 502 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 501, so as to implement the project data processing method in the above embodiment.

[0180] In some examples, the project data processing device 500 may further include a communication interface 503 and a bus 504. Figure 5 As shown, the memory 501, the processor 502, and the communication interface 503 are connected via a bus 504 and communicate with each other.

[0181] The communication interface 503 is mainly used to realize the communication between the modules, devices, units and / or equipment in the embodiment of the present application. The communication interface 503 can also be used to access input devices and / or output devices.

[0182] The bus 504 includes hardware, software, or both, and couples the components of the project data processing device 500 to each other. By way of example and not limitation, the bus 504 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of the above. Where appropriate, the bus 504 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0183] In a fourth aspect, the present application provides a computer-readable storage medium, on which a computer program instruction is stored, and when the computer program instruction is executed by a processor, the project data processing method in the above-mentioned embodiment can be implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Among them, the above-mentioned computer-readable storage medium may include a non-transitory computer-readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc., which is not limited here.

[0184] The present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the project data processing method in the above-mentioned embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0185] It should be clear that each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. For device embodiments, equipment embodiments, and computer-readable storage medium embodiments, the relevant parts can refer to the description part of the method embodiment. The present application is not limited to the specific steps and structures described above and shown in the figures. Those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application. In addition, for the sake of brevity, a detailed description of known method technologies is omitted here.

[0186] The above reference is according to the method of the embodiment of the present application, the flow chart of the device (system) and the computer program product and / or the block diagram described various aspects of the present application.It should be understood that each square box in the flow chart and / or the block diagram and the combination of each square box in the flow chart and / or the block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more square boxes of the flow chart and / or the block diagram.Such a processor can be but is not limited to a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It can also be understood that each square box in the block diagram and / or the flow chart and the combination of the square boxes in the block diagram and / or the flow chart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0187] Those skilled in the art should understand that the above embodiments are exemplary rather than restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on the study of the drawings, the specification and the claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other devices or steps; the quantifier "one" does not exclude multiple; the terms "first" and "second" are used to indicate names rather than to indicate any specific order. Any figure marks in the claims should not be understood as limiting the scope of protection. The functions of multiple parts appearing in the claims can be implemented by a single hardware or software module. The appearance of certain technical features in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A method for analyzing intelligence data, characterized in that: include: Obtain intelligence data; Determine a correlation degree corresponding to one or more node correlation factors between any two nodes in the intelligence data; Calculating the node association degree between any two nodes based on the association degrees corresponding to one or more of the node association factors; Calculating the path probability between the any two nodes based on the node association degree between the any two nodes, the association degree corresponding to one or more path association factors between the any two nodes, and the weight corresponding to the path association factor; Based on the path probability between any two nodes, a target path is determined.

2. The method according to claim 1, characterized in that The method further comprises: Based on the target path, an intelligence map corresponding to the intelligence data is constructed, in which the target path has a corresponding first preset mark, and the first preset mark is used to characterize a potential attack path.

3. The method according to claim 1, characterized in that The calculating the node association degree between any two nodes based on the association degree corresponding to one or more of the node association factors includes: Calculate the sum of the association degrees corresponding to the node association factors; Calculating the number of relevance factors of the node relevance factor; The node association degree between any two nodes is calculated based on the number of association factors and the sum.

4. The method according to claim 1, characterized in that: The node association factor includes: at least one of an attack tool, an attack time, and an attack location; The path correlation factor includes at least one of: attack behavior context, attack time, and historical attack behavior pattern.

5. The method according to claim 1, characterized in that The calculating the path probability between any two nodes based on the node association degree between any two nodes, the association degree corresponding to one or more path association factors between any two nodes, and the weight corresponding to the path association factor comprises: Calculating the path comprehensive correlation degree of any two nodes based on the correlation degree corresponding to one or more path correlation factors between any two nodes and the weight corresponding to the path correlation factor; The node association degree between any two nodes is multiplied by the path comprehensive association degree between any two nodes to obtain the path probability between any two nodes.

6. The method according to claim 1 or 2, characterized in that: The method further comprises: Acquire new intelligence data; Based on the new intelligence data, the path probability of the target path is updated and / or a new target path is added.

7. The method according to claim 2, characterized in that The method further comprises: When the path probability of the target path meets the path conversion condition, converting the first preset mark of the target path into a second preset mark, where the second preset mark is used to characterize the determined attack path; or, When the path probability of the target path meets the deletion condition, the target path is deleted from the intelligence map.

8. The method according to claim 7, characterized in that When the path probability of the target path satisfies the path conversion condition, converting the first preset mark of the target path into the second preset mark comprises: When the path probability of the target path is greater than or equal to a preset path probability threshold, outputting a path confirmation request; In case of receiving a confirmation conversion instruction for the path confirmation request, the first preset mark of the target path is converted into a second preset mark.

9. The method according to claim 2, characterized in that: The method further comprises: Determine an attack chain formed based on the target path in the intelligence graph; A defense strategy corresponding to the attack chain is generated.

10. The method according to claim 9, characterized in that The method further comprises: The path probabilities corresponding to the attack paths in the attack chain are multiplied to obtain the attack chain probability corresponding to the attack chain.

11. An intelligence data analysis device, characterized in that: The device comprises: A data acquisition module, used to acquire intelligence data; An association determination module, used to determine the association degree corresponding to one or more node association factors between any two nodes in the intelligence data; A node calculation module, used for calculating the node association degree between any two nodes based on the association degree corresponding to one or more of the node association factors; A path calculation module, configured to calculate a path probability between any two nodes based on a node association degree between any two nodes, an association degree corresponding to one or more path association factors between any two nodes, and a weight corresponding to the path association factor; The path determination module is used to determine the target path based on the path probability between any two nodes.

12. An intelligence data analysis device, characterized in that: include: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the intelligence data analysis method as described in any one of claims 1-10 is implemented.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the intelligence data analysis method according to any one of claims 1 to 10 is implemented.

14. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the intelligence data analysis method according to any one of claims 1 to 10.

Images