TTP information extraction method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention discloses a TTP information extraction method and device, a storage medium and electronic equipment, and relates to the field of computer processing. The method comprises the following steps: performing TTP information extraction processing on initial data through a small-scale pre-training model to obtain a first information list comprising at least one piece of first TTP information; performing semantic segmentation and content summarization processing on the initial data through a large-scale pre-training model to obtain a content block list comprising at least one text content and a summarization; forming a first prompt word by the content block list, the summary and the first information list; and prompting the large-scale pre-training model to perform TTP information extraction processing on the content block list according to the first cue word to obtain at least one second TTP information. According to the method and the device, respective advantages of the small-scale pre-training model and the large-scale pre-training model are fused, high-accuracy and low-illusion TTP intelligence can be extracted from the threat report serving as initial data, and accurate TTP intelligence automatic extraction is realized.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a TTP intelligence extraction method, device, storage medium and electronic device. Background Art

[0002] As behavior-based detection technology becomes more and more important in the field of threat detection, the importance of obtaining Tactics Techniques Procedures (TTP) intelligence in threat intelligence is increasing. A major source of TTP intelligence is unstructured threat analysis reports, for example, threat analysis reports can be APT analysis reports, malware analysis reports, penetration test analysis reports, etc.

[0003] There are currently several methods for extracting TTP intelligence from unstructured threat reports:

[0004] 1. Match the description of TTP intelligence in the threat analysis report. The matching method can be keyword matching or matching based on embedding similarity. However, since this extraction method is a hard match that lacks full-text semantic understanding, there are a lot of false positives and false negatives.

[0005] 2. Extract TTP intelligence from threat reports through the trained natural language processing model. Since the natural semantic processing module has some semantic understanding of threat reports, it can identify TTP intelligence that cannot be identified in method 1. However, training a natural language processing model that can extract TTP intelligence from threat reports with expected accuracy has the problems of difficult training, long training cycle, and high training cost.

[0006] In summary, the extraction effects of current TTP intelligence extraction methods are not satisfactory. Summary of the invention

[0007] The embodiments of the present application provide a TTP intelligence extraction method, device, storage medium and electronic device, which can solve the above problems. The technical solution is as follows:

[0008] In a first aspect, an embodiment of the present application provides a TTP intelligence extraction method, the method comprising:

[0009] Perform TTP intelligence extraction processing on the initial data through a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence;

[0010] Performing semantic segmentation and content summarization processing on the initial data through a large-scale pre-trained model to obtain a content block list including at least one text content and a summary of the content block list;

[0011] Combining the content block list, the summary and the first intelligence list into a first prompt word;

[0012] Prompt the large-scale pre-trained model to perform TTP intelligence extraction processing on the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence.

[0013] In a second aspect, an embodiment of the present application provides a TTP intelligence extraction device, the device comprising:

[0014] A small model processing module, used for performing TTP intelligence extraction processing on the initial data through a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence;

[0015] A large model processing module, used to perform semantic segmentation and content summarization processing on the initial data through a large-scale pre-trained model to obtain a content block list including at least one text content and a summary of the content block list;

[0016] A prompt word generating module, used for combining the content block list, the summary and the first intelligence list into a first prompt word;

[0017] The intelligence list extraction module is used to prompt the large-scale pre-trained model to perform TTP intelligence extraction processing on the content block list according to the first prompt word, so as to obtain a second intelligence list including at least one second TTP intelligence.

[0018] In a third aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0019] In a fourth aspect, an embodiment of the present application provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0020] The beneficial effects brought about by the technical solutions provided by some embodiments of the present application include at least:

[0021] The present application combines a small-scale pre-training model and a large-scale pre-training model to extract TTP intelligence from the initial data. Specifically, at least one first TTP intelligence of the initial data is first extracted through a small-scale pre-training model, and the initial data is further processed by a large-scale pre-training model for semantic segmentation and content summarization to obtain at least one text content and a summary, and at least one first TTP intelligence, at least one text content and a summary are further combined into a first prompt word, so as to prompt the large-scale pre-training model to extract TTP intelligence of at least one text content according to the first prompt word, and obtain at least one second TTP intelligence.

[0022] Although the TTP intelligence extracted by the small-scale pre-trained model lacks generalization and accuracy, the small-scale pre-trained model that is easy to train can be used as a TT classifier with higher accuracy, outputting the first TTP intelligence, and stimulating the large-scale pre-trained model to give a more correct second TT intelligence as an answer in combination with the context of the text content, thereby effectively reducing the illusion of the large-scale pre-trained model, and at the same time, there is no need to perform difficult training on the large-scale pre-trained model. In other words, this application combines the respective advantages of the small-scale pre-trained model and the large-scale pre-trained model, and can extract high-accuracy, low-illusion TTP intelligence from the threat report as the initial data, and realize accurate automatic extraction of TTP intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 It is a scenario diagram of a TTP intelligence extraction method provided in an embodiment of the present application;

[0025] Figure 2 It is a flowchart of a TTP intelligence extraction method provided in an embodiment of the present application;

[0026] Figure 3 It is a structural schematic diagram of a TTP intelligence extraction method provided in an embodiment of the present application;

[0027] Figure 4 It is a flowchart of a TTP intelligence extraction method provided in an embodiment of the present application;

[0028] Figure 5 It is a structural schematic diagram of a TTP intelligence extraction method provided in an embodiment of the present application;

[0029] Figure 6 It is a flowchart of a TTP intelligence extraction method provided in an embodiment of the present application;

[0030] Figure 7 It is a structural schematic diagram of a TTP intelligence extraction method provided in an embodiment of the present application;

[0031] Figure 8 It is a flowchart of a TTP intelligence extraction method provided in an embodiment of the present application;

[0032] Fig. 9 It is a flowchart of a TTP intelligence extraction method provided in an embodiment of the present application;

[0033] Fig.10 It is a structural schematic diagram of a TTP intelligence extraction method provided in an embodiment of the present application;

[0034] Fig.11 It is a structural schematic diagram of a TTP intelligence extraction device provided in an embodiment of the present application;

[0035] Fig.12 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0037] In the description of the present application, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In the description of the present application, it should be noted that, unless otherwise clearly specified and limited, "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood in specific circumstances. In addition, in the description of the present application, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are an "or" relationship.

[0038] The present application is described in detail below with reference to specific embodiments.

[0039] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the features, information and data involved in this specification are all obtained with full authorization.

[0040] As behavior-based detection technology becomes more and more important in the field of threat detection, the importance of obtaining Tactics Techniques Procedures (TTP) intelligence in threat intelligence is increasing. A major source of TTP intelligence is unstructured threat analysis reports, for example, threat analysis reports can be APT analysis reports, malware analysis reports, penetration test analysis reports, etc.

[0041] Currently, there are several methods for extracting TTP intelligence from unstructured threat reports:

[0042] 1. Match the description of TTP intelligence in the threat analysis report. The matching method can be keyword matching or matching based on embedding similarity. However, since this extraction method is a hard match that lacks full-text semantic understanding, there are a lot of false positives and false negatives.

[0043] 2. By fine-tuning the small-scale pre-trained model, classify and identify TTP intelligence for each text content in the threat report. Since the small-scale pre-trained model has some semantic understanding of the text content, it can identify TTP intelligence that cannot be identified by method 1. However, this method requires continuous fine-tuning of the small-scale pre-trained model. If TTP intelligence that is significantly different from the sample data of the fine-tuned small-scale pre-trained model appears in the text content, it will cause false positives and false negatives for the TTP intelligence. In other words, the generalization ability of the small-scale pre-trained model is weak. In addition, since the small-scale pre-trained model cannot have a comprehensive understanding of the full text content of the threat report, it cannot extract more accurate kill chain information. The kill chain information is characterized by the attacker combining different TTPs to gradually implement the attack to form a complete attack path.

[0044] 3. Directly use large-scale pre-trained models to extract TTP intelligence from threat reports. Large-scale pre-trained models have strong semantic understanding capabilities and good common sense in the security field. However, the hallucinations of large-scale pre-trained models are difficult to avoid, and it is difficult to train a large-scale pre-trained model that can extract TTP intelligence with expected accuracy.

[0045] In summary, the extraction effects of current TTP intelligence extraction methods are not satisfactory.

[0046] Therefore, the present application provides a TTP intelligence extraction method to solve the above problems. Figure 1 As shown, Figure 1 It is a scenario diagram of a TTP intelligence extraction method provided in an embodiment of the present application. Figure 1 The system includes a plurality of electronic devices, which at least include an electronic device 100 for executing the TTP intelligence extraction method, and electronic devices 110, 120, and 130 for providing threat reports. It is understandable that Figure 1 The number and types of electronic devices shown in the figure are for illustration only and are not limited in any way in the embodiments of this specification.

[0047] The above-mentioned electronic devices and servers include but are not limited to physical or virtual processors, mobile stations (MobileStation, MS), mobile terminal equipment (Mobile Terminal), mobile phones (Mobile Telephone), handsets and portable equipment (portable equipment), Bluetooth headsets, smart watches and other types. The electronic devices can communicate with one or more core networks via a radio access network (Radio Access Network, RAN).

[0048] For example, the electronic device 100 executing the TTP intelligence extraction method is a server, and the server is a plurality of physical servers, and the plurality of physical servers are independent in hardware. Or, the server is a plurality of virtual servers, and the plurality of virtual servers are deployed in the same hardware resource pool, and the deployment method of the virtual server includes but is not limited to: VMware, Virtual Box and Virtual PC. It is understandable that the electronic device 100 executing the TTP intelligence extraction method also has other service capabilities and functions to complete the tasks in the following embodiments. For example, the electronic device 100 also provides portal services, resource management services, and CI / CD services, etc.

[0049] Electronic devices such as electronic device 100, electronic device 110, electronic device 120, and electronic device 130 can communicate with each other through a communication link established by a communication protocol, such as the gRPC protocol. gRPC is a high-performance, general-purpose open source remote processor call (RPC) framework, which is mainly designed for mobile application development and based on the HTTP / 2 protocol standard, based on the protocol buffer (PB) serialization protocol development, and supports many development languages. In addition, the communication link can also be a wireless communication link or a wired communication link, for example: a wired communication link includes an optical fiber, a twisted pair, or a coaxial cable, and a wireless communication link includes a Bluetooth communication link, a wireless fidelity (WIreless-FIdelity, Wi-Fi) communication link, or a microwave communication link.

[0050] In an embodiment of the present application, the electronic device 100 receives multiple threat reports from electronic devices such as the electronic device 110, the electronic device 120, and the electronic device 130, and performs TTP intelligence extraction processing using the threat reports as initial data to obtain a second intelligence list including at least one second TTP intelligence. In another embodiment, the electronic device 100 may also receive an extraction request for executing a TTP intelligence extraction processing method sent from electronic devices such as the electronic device 110, the electronic device 120, and the electronic device 130, and execute the TTP intelligence extraction processing method in response to the extraction request to obtain a second intelligence list including at least one second TTP intelligence, and send the second intelligence list to the electronic device that sent the extraction request.

[0051] In one embodiment, Figure 2 As shown, it is a schematic diagram of a TTP intelligence extraction method provided by an embodiment of the present application, which can be implemented by a computer program and can be run on a TTP intelligence extraction device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0052] Specifically, the TTP intelligence extraction method includes:

[0053] S101. Perform TTP intelligence extraction processing on initial data using a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence.

[0054] The initial data can be an unstructured APT analysis report, penetration analysis report, malware analysis report, etc. APT analysis report (Advanced Persistent Threat Analysis Report) is used to describe the characteristics, behavior patterns and attackers behind advanced persistent threat APT attacks. Penetration testing (Pen Test) simulates hacker attacks to test the network, application, system or physical security of an organization, aiming to discover potential vulnerabilities and assess the risks that these vulnerabilities may cause. The Penetration Testing Report is a detailed record of the testing process and results of the Pen Test. Malware Analysis Report (Malware Analysis Report) is used to analyze and describe the behavior, infection method, propagation mechanism and impact of malware (such as viruses, Trojans, ransomware, worms, etc.) on the target system.

[0055] like Figure 3 As shown, Figure 3 1 is a schematic diagram of a TTP intelligence extraction method provided in an embodiment of the present application. In this embodiment, APT analysis reports, penetration analysis reports, and malware analysis reports are used as initial data 101 to extract TTP intelligence. It is understandable that the present application also includes other types of text content that can be used as initial data. Figure 3 The multiple analysis reports shown are for illustrative purposes only.

[0056] A small-scale pre-trained model refers to a pre-trained model with a parameter size much smaller than 1B. For example, a small-scale pre-trained model can be a basic version of a model such as BERT, RoBERTa, such as BERT-base and RoBERTa-base. Compared with larger-scale models such as BERT-large and GPT-3, small-scale pre-trained models have fewer parameters. For another example, a small-scale pre-trained model can also be a model such as DistilBERT, TinyBERT, and ELECTRA.

[0057] like Figure 3As shown, the small-scale pre-trained model 102 performs TTP intelligence extraction processing on the initial data 101 to obtain a first intelligence list 103 including at least one first TTP intelligence. For example, the first TTP intelligence may be: {Tactics: initial access, technology: phishing attack, spear-phishing attachment, implementation process: Lazarus delivers a phishing email with the subject of the German military enterprise "Rheinmetall" work requirements to the target to induce the user to enable macros}, and the first TTP intelligence may also be: {Tactics: execution, technology: command line and script interpreter PowerShell, implementation process: using PowerShell command New-MailboxExportRequest to export the specified user's email to a network shared directory}.

[0058] S102: Perform semantic segmentation and content summarization on the initial data through a large-scale pre-training model to obtain a content block list including at least one text content and a summary of the content block list.

[0059] Large-Scale Pretrained Models include more parameters than small-scale pretrained models. For example, GPT-3 and GPT-4 are large-scale pretrained models, which contain hundreds of millions of neural network parameters and capture richer language features in text content through more complex architectures than small-scale pretrained models.

[0060] The initial data is semantically segmented according to the large-scale pre-trained model, that is, the long text content is divided into smaller text content through smaller semantic units, and each small-scale text content is a content block. Each content block should be semantically self-sufficient and can represent a complete information unit. The content block list includes at least one text content.

[0061] Summarize the content block list of at least one text content based on the large-scale pre-trained model, mainly based on high-level, sequential summaries from the perspectives of technology, tactics, and implementation. This summarization process summarizes each text content as a content block from the perspective of TTP intelligence, extracts information related to tactics, technology, and implementation process in each text content, as well as the attack stage and attack purpose of the current text content in the overall attack activity.

[0062] like Figure 3 As shown, the initial data 101 is processed by semantic segmentation and content summarization through the large-scale pre-training model 104 to obtain a content block list 1051 including at least one text content and a summary 1052 for the content block list.

[0063] In one embodiment, text content irrelevant to TTP intelligence in the initial data is filtered out through a large-scale pre-trained model to obtain processed data; semantic segmentation is performed on the processed data through the large-scale pre-trained model to obtain a content block list including at least one text content; and based on the TTP perspective, the large-scale pre-trained model is instructed to perform content summarization on the content block list to obtain a summary of the content block list.

[0064] In this embodiment, the text content that is not related to TTP intelligence in the initial data is first filtered out through a large-scale pre-trained model to obtain processed data. For example, the beginning of an APT analysis report is often an introduction to the background of some hacker organizations, and the end is usually an introduction to the products of a security company. The above text content that is not related to TTP intelligence is filtered out through a large-scale pre-trained model. Then, according to the large-scale pre-trained model, the large paragraphs of text content are divided into a series of content blocks according to semantics, that is, a series of small-scale text content is obtained. Finally, a high-level, sequential summary of a series of small-scale text contents is performed based on technology, tactics and implementation perspectives to obtain a summary of the content block list.

[0065] In this embodiment, the large-scale pre-trained model is used to filter the text content in the initial data that is not related to TTP intelligence, thereby improving the efficiency of the large-scale pre-trained model in extracting TTP intelligence from multiple text contents as content blocks. And the large text content is divided into multiple small-scale text contents. This is because although the window size of the input prompt for reasoning with lower hallucinations for each large-scale pre-trained model is inconsistent, generally a smaller prompt size will obtain a lower hallucination, so dividing the initial data into multiple small-scale text contents can improve the accuracy of the large-scale pre-trained model in extracting TTP intelligence.

[0066] S103, combining the content block list, the summary and the first intelligence list into a first prompt word.

[0067] like Figure 3 As shown, the content block list 1051, the summary 1052 and the first intelligence list 103 are combined into the first prompt word 106. The first prompt word 106 is used to allow the scale pre-training model 104 to extract TTP intelligence from the content block list 1051 according to the first prompt word 106.

[0068] In this embodiment, the first prompt word 106 includes:

[0069] A. A first intelligence list 103 including a plurality of first TTP intelligences is used to stimulate the ability of the large-scale pre-trained model 104 to identify and extract TTP intelligences. This avoids the large-scale pre-trained model 104 from extracting from scratch, and allows the large-scale pre-trained model 104 to see a portion of the "unconfirmed answers to this test paper" as a reference;

[0070] B. Summarizing and summarizing 1052, so that the large-scale pre-trained model 104 can have a correct understanding of the attack stage and attack purpose of the currently processed content block in the overall attack activity;

[0071] C. Content block list 1051, used for large-scale pre-trained model 104 to identify and extract TTP intelligence therefrom.

[0072] S104: Prompt the large-scale pre-trained model to perform TTP intelligence extraction processing on the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence.

[0073] like Figure 3 As shown, according to the first prompt word 106, the large-scale pre-trained model 104 performs TTP intelligence extraction processing on the content block list 1051 to obtain a second intelligence list 107 including at least one second TTP intelligence.

[0074] The number of second TTP intelligence included in the second intelligence list and the number of first TTP intelligence included in the first intelligence list may be the same or identical. The specific content of at least one second TTP intelligence and the specific content of at least one first TTP intelligence may be partially the same or completely different.

[0075] For example, the second TTP intelligence can be: {Tactics: initial access, technology: phishing attack, spear-phishing attachment, implementation process: Lazarus delivers a phishing email with the subject of the German military enterprise "Rheinmetall" to the target, inducing the user to enable macros}. The second TTP intelligence is the same as the first TTP intelligence. The second TTP intelligence can also be: [{Tactics: persistence, technology: registry modification, service creation, implementation process: the attacker achieves persistence on the target host by modifying the Windows registry and creating a custom service, ensuring that the malicious program is automatically executed after each system restart}. The second TTP intelligence is different from the first TTP intelligence in the first intelligence list.

[0076] In one embodiment, based on the first prompt word, the large-scale pre-trained model is prompted to perform TTP intelligence extraction processing on at least one text content included in the content block list in turn to obtain at least one second TTP intelligence corresponding to each text content; based on the at least one second TTP intelligence corresponding to each text content, a second intelligence list including at least one second TTP intelligence is obtained.

[0077] In other words, the large-scale pre-trained model can extract TTP intelligence from multiple text contents in the content block list at one time, and the first prompt word includes multiple text contents in the content block list.

[0078] The large-scale pre-trained model can also extract TTP intelligence from text content alone. The number of first prompt words includes multiple, each first prompt word is composed of a text content in the first intelligence list, summary and content block list, which is used to allow the large-scale pre-trained model to identify and extract TTP intelligence from the text content included in the first prompt word.

[0079] In this embodiment, by reducing the prompt size corresponding to the first prompt word, the large-scale pre-training model can perform TTP intelligence extraction processing on at least one text content in turn, thereby reducing the hallucination phenomenon, improving the accuracy of the generated second TTP intelligence, and reducing the computational cost of the large-scale pre-training model.

[0080] In an embodiment of the present application, at least one first TTP intelligence in the initial data is first extracted by a small-scale pre-training model, and the initial data is further processed by a large-scale pre-training model for semantic segmentation and content summarization to obtain at least one text content and a summary, and at least one first TTP intelligence, at least one text content and a summary are further composed of a first prompt word, thereby prompting a large-scale pre-training model to extract TTP intelligence of at least one text content according to the first prompt word, and obtaining at least one second TTP intelligence. The small-scale pre-training model that is easy to train can be used as a TT classifier with high accuracy, output the first TTP intelligence, and stimulate the large-scale pre-training model to give a more correct second TT intelligence as an answer in combination with the text content context, thereby effectively reducing the illusion of the large-scale pre-training model, and at the same time, there is no need to train the large-scale pre-training model with high difficulty. In other words, the present application combines the respective advantages of the small-scale pre-training model and the large-scale pre-training model, and can extract TTP intelligence with high accuracy and low illusion from the threat report as the initial data, and realize accurate automatic extraction of TTP intelligence.

[0081] In one embodiment, Figure 4 As shown, it is a flow chart of a TTP intelligence extraction method provided by an embodiment of the present application, which can be implemented by a computer program and can be run on a TTP intelligence extraction device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0082] Specifically, the TTP intelligence extraction method includes:

[0083] S201. Perform TTP intelligence extraction processing on initial data using a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence.

[0084] See S101 above, which will not be repeated here.

[0085] S202: Perform semantic segmentation and content summarization on the initial data through a large-scale pre-training model to obtain a content block list including at least one text content and a summary of the content block list.

[0086] See the above S102, which will not be described again here.

[0087] S203, combining the content block list, the summary and the first intelligence list into a first prompt word.

[0088] See the above S103, which will not be described again here.

[0089] S204: Prompt the large-scale pre-trained model to extract TTP intelligence from the content block list according to the first prompt word, and obtain a second intelligence list including at least one second TTP intelligence.

[0090] See S104 above, which will not be described again here.

[0091] S205. According to the first TT information included in the second TTP information, obtain a standard interpretation corresponding to the first TT information to obtain a first interpretation list.

[0092] The second TTP intelligence consists of tactics, techniques, and implementation processes, so the second TTP intelligence includes the first TT intelligence. For example, the second TTP intelligence includes: {Tactics: initial access, techniques: phishing attacks, spear-phishing attachments, implementation process: Lazarus delivers phishing emails with the subject "Rheinmetall", a German military enterprise, to the target, inducing users to enable macros}, and the first TT intelligence included in the second TTP intelligence is: {Tactics: initial access, techniques: phishing attacks, spear-phishing attachments}.

[0093] Based on the first TT intelligence, a standard interpretation matching the first TT intelligence can be obtained from the tactical technology description library. For example, the first TT intelligence is [{tactic: execution, technology: command line and script interpreter: PowerShell}, the standard interpretation corresponding to the first TT intelligence is determined in the tactical technology description library, and the following is obtained: {tactic: execution, technology: command line and script}, interpreter: PowerShell. Interpretation: attackers may abuse PowerShell commands and scripts to carry out attacks}. The first interpretation list includes at least one first TT intelligence and the standard interpretation corresponding to each first TT intelligence.

[0094] like Figure 5 As shown, Figure 5 A structural diagram of a TTP intelligence extraction method provided in an embodiment of the present application, according to the first TT intelligence included in the second intelligence list 207, a standard interpretation matching the first TT intelligence is obtained from the TT description library 208 to obtain a first interpretation list 209.

[0095] S206, composing the second information list, the content block list, the summary and the first explanation list into a second prompt word.

[0096] like Figure 5 As shown, the second information list 207, the content block list 2051, the summary 2052 and the first explanation list

[0097] 209 constitutes the second prompt word 210. The second prompt word 210 is used to instruct the large-scale pre-training model 204 to correct the second intelligence list

[0098] 207 includes at least one second TTP intelligence.

[0099] In this embodiment, the content of the second prompt word 210 includes:

[0100] A. a second intelligence list 207 including at least one second TTP intelligence extracted by the large-scale pre-training model, as a correction target of the large-scale pre-training model 204;

[0101] B. Content block list 2051, as a target for large-scale pre-training model 204 to rethink the TTP intelligence extracted from text content, large-scale pre-training model 204 to think whether at least one text content extracted TTP intelligence included in content block list 2051 is correct;

[0102] C. Summarize and summarize 2052, so that the large-scale pre-trained model 204 can have a correct understanding of the attack stage and attack purpose of the currently processed text content in the overall attack activity;

[0103] D. A first explanation list 209 including at least one first TT intelligence and a standard explanation allows the large-scale pre-trained model 204 to obtain an accurate definition explanation of technical tactics. The definition explanation is accompanied by a description of some classic implementation processes to correct the confusing knowledge within the large-scale pre-trained model 204.

[0104] S207. Prompt the large-scale pre-trained model according to the second prompt word to correct at least one second TTP intelligence included in the second intelligence list, and obtain a third intelligence list including at least one third TTP intelligence.

[0105] like Figure 5 As shown, according to the second prompt word 210, the large-scale pre-trained model 204 is prompted to correct at least one second TTP intelligence included in the second intelligence list 207, and a third intelligence list 211 including at least one third TTP intelligence is obtained.

[0106] The number of third TTP intelligence included in the third intelligence list and the number of second TTP intelligence included in the second intelligence list may be the same or identical. The specific content of at least one third TTP intelligence and the specific content of at least one second TTP intelligence may be partially the same or completely different.

[0107] In one embodiment, at least one second TTP intelligence corresponding to the large-scale pre-trained model is prompted to be corrected, at least one third TTP intelligence corresponding to the text content is determined, and a third intelligence list including the at least one third TTP intelligence is obtained.

[0108] In other words, the large-scale pre-trained model can correct at least one second TTP intelligence corresponding to multiple text contents in the content block list at one time, and the second prompt word includes multiple text contents in the content block list.

[0109] The large-scale pre-trained model can also correct at least one second TTP intelligence corresponding to the text content separately. After correcting at least one second TTP intelligence corresponding to a certain text content, the large-scale pre-trained model continues to correct at least one second TTP intelligence corresponding to another text content. The number of second prompt words includes multiple, and each second prompt word is composed of a text content in the second intelligence list, summary, first explanation list and content block list, which is used to allow the large-scale pre-trained model to identify and extract TTP intelligence from the text content included in the second prompt word.

[0110] In this embodiment, by reducing the prompt size corresponding to the second prompt word, the large-scale pre-trained model can correct the second TTP intelligence corresponding to the text content in turn, thereby reducing the hallucination phenomenon, improving the accuracy of the generated third TTP intelligence, and reducing the computational cost of the large-scale pre-trained model.

[0111] In an embodiment of the present application, at least one first TTP intelligence in the initial data is first extracted by a small-scale pre-training model, and the initial data is further processed by a large-scale pre-training model for semantic segmentation and content summarization to obtain at least one text content and a summary, and at least one first TTP intelligence, at least one text content and a summary are further composed of a first prompt word, thereby prompting a large-scale pre-training model to extract TTP intelligence of at least one text content according to the first prompt word, and obtaining at least one second TTP intelligence. The small-scale pre-training model that is easy to train can be used as a TT classifier with high accuracy, output the first TTP intelligence, and stimulate the large-scale pre-training model to give a more correct second TT intelligence as an answer in combination with the text content context, thereby effectively reducing the illusion of the large-scale pre-training model, and at the same time, there is no need to train the large-scale pre-training model with high difficulty. In other words, the present application combines the respective advantages of the small-scale pre-training model and the large-scale pre-training model, and can extract TTP intelligence with high accuracy and low illusion from the threat report as the initial data, and realize accurate automatic extraction of TTP intelligence.

[0112] In one embodiment, Figure 6 As shown, it is a flow chart of a TTP intelligence extraction method provided by an embodiment of the present application, which can be implemented by a computer program and can be run on a TTP intelligence extraction device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0113] Specifically, the TTP intelligence extraction method includes:

[0114] S301. Perform TTP intelligence extraction processing on initial data using a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence.

[0115] See S101 above, which will not be repeated here.

[0116] S302: Perform semantic segmentation and content summarization on the initial data through a large-scale pre-training model to obtain a content block list including at least one text content and a summary of the content block list.

[0117] See the above S102, which will not be described again here.

[0118] S303: Combine the content block list, the summary and the first intelligence list into a first prompt word.

[0119] See the above S103, which will not be described again here.

[0120] S304: Prompt the large-scale pre-trained model to extract TTP intelligence from the content block list according to the first prompt word, and obtain a second intelligence list including at least one second TTP intelligence.

[0121] See the above S104, which will not be repeated here.

[0122] S305. According to the first TT information included in the second TTP information, obtain a standard interpretation corresponding to the first TT information to obtain a first interpretation list.

[0123] See the above S205, which will not be repeated here.

[0124] S306, composing the second information list, the content block list, the summary and the first explanation list into a second prompt word.

[0125] See the above S206, which will not be described again here.

[0126] S307. Prompt the large-scale pre-trained model according to the second prompt word to correct at least one second TTP intelligence included in the second intelligence list, and obtain a third intelligence list including at least one third TTP intelligence.

[0127] See above S207, which will not be described again here.

[0128] S308, combining the third information list and the summary into a third prompt word.

[0129] like Figure 7 As shown, Figure 7 3 is a schematic diagram of a TTP intelligence extraction method provided by an embodiment of the present application. In this embodiment, the third intelligence list 310 and the summary 3052 form a third prompt word 311. The third prompt word 311 is used to instruct the large-scale pre-trained model 304 to perform deduplication and sorting processing on multiple third TTP intelligence included in the third intelligence list 310 to form kill chain information. Kill chain information Kill Chain is a model used in the field of network security to describe a series of attack steps of an attacker from the beginning to the end.

[0130] In this embodiment, the content of the third prompt word 311 includes:

[0131] A. A third intelligence list 310 including at least one third TPP intelligence is used as a target for deduplication and sorting processing by a large-scale pre-trained model.

[0132] B. Summary 3052. Summary 3052 is obtained by summarizing the content block list 3051 by the large-scale pre-trained model 304. It is used to enable the large-scale pre-trained model 304 to have a correct understanding of the attack stage and attack purpose of the currently processed text content in the overall attack activity, so as to sort at least one third TTP intelligence included in the third intelligence list 310.

[0133] S309. Prompt the large-scale pre-trained model to deduplicate and sort the third intelligence list according to the third prompt word to obtain a target intelligence list including at least one third TTP intelligence and kill chain information consisting of at least one third TTP intelligence in the target intelligence list.

[0134] The number of third TTP intelligence included in the target intelligence list is less than or equal to the number of third TTP intelligence included in the third intelligence list, and the arrangement order of at least one third TTP intelligence included in the target intelligence list is not exactly the same as the arrangement order of at least one third TTP intelligence included in the third intelligence list.

[0135] For example, the third intelligence list 310 includes third TTP intelligence a, third TTP intelligence b, third TTP intelligence c and third TTP intelligence d. The third intelligence list is deduplicated and sorted to obtain the target intelligence list 3121. The target intelligence list 3121 includes third TTP intelligence d, third TTP intelligence b, and third TTP intelligence c.

[0136] Further, the large-scale pre-trained model 304 is instructed to form at least one third TTP intelligence into a complete kill chain based on the order of at least one third TTP intelligence in the target intelligence list 3121. The kill chain information includes a kill chain, which is a process that describes an attacker's attack from the beginning to the completion, and is divided into multiple stages.

[0137] For example, according to the time point when each third TTP intelligence in the target intelligence list 3121 occurs, it is possible to determine how the attack is gradually escalated. And the correlation between the third TTP intelligence and other third TTP intelligence is analyzed, such as whether the techniques in certain third TTP intelligence often appear together, which may indicate that they are part of a specific attack strategy.

[0138] In this embodiment, by performing deduplication and sorting processing on the third intelligence list including at least one third TPP intelligence, it is more convenient for users to view and understand the at least one third TTP intelligence included in the target intelligence list. And obtaining kill chain information based on the sorted at least one third TPP intelligence can help users better understand the attack process, formulate corresponding defense strategies, and improve the success rate of blocking attacks.

[0139] In an embodiment of the present application, at least one first TTP intelligence in the initial data is first extracted by a small-scale pre-training model, and the initial data is further processed by a large-scale pre-training model for semantic segmentation and content summarization to obtain at least one text content and a summary, and at least one first TTP intelligence, at least one text content and a summary are further composed of a first prompt word, thereby prompting a large-scale pre-training model to extract TTP intelligence of at least one text content according to the first prompt word, and obtaining at least one second TTP intelligence. The small-scale pre-training model that is easy to train can be used as a TT classifier with high accuracy, output the first TTP intelligence, and stimulate the large-scale pre-training model to give a more correct second TT intelligence as an answer in combination with the text content context, thereby effectively reducing the illusion of the large-scale pre-training model, and at the same time, there is no need to train the large-scale pre-training model with high difficulty. In other words, the present application combines the respective advantages of the small-scale pre-training model and the large-scale pre-training model, and can extract TTP intelligence with high accuracy and low illusion from the threat report as the initial data, and realize accurate automatic extraction of TTP intelligence.

[0140] In one embodiment, Figure 8 As shown, it is a schematic diagram of a TTP intelligence extraction method provided by an embodiment of the present application, which can be implemented by a computer program and can be run on a TTP intelligence extraction device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0141] Specifically, the TTP intelligence extraction method includes:

[0142] S401: semantically segment and annotate sample data to obtain at least one sample text content annotated with second TT information.

[0143] The sample data can be an unstructured APT analysis report, penetration analysis report, malware analysis report, etc. The sample data is semantically segmented and annotated, that is, a large section of text content is segmented into a series of content chunks according to semantics, that is, a series of small-scale sample texts are obtained. The second TT intelligence is further annotated according to the content of each text. For example, the segmented sample text is annotated with the second TT intelligence: {tactics: initial access, technology: phishing attack, spear phishing attachment}.

[0144] Use the existing sample texts with TT intelligence as labels to fine-tune the small-scale pre-trained model, so that the small-scale pre-trained model has a certain TTP intelligence extraction capability.

[0145] And in this embodiment, sample texts with TT intelligence as labels are used to train the small-scale pre-trained model instead of sample texts with TTP intelligence as labels. This is because: 1. TT intelligence as a label is concise and available. TT intelligence mainly focuses on high-level tactics and techniques. These labels are relatively simple and easy to mark and obtain; 2. The generalization ability of the small-scale pre-trained model is improved. Through fine-tuning with a small amount of sample texts with TT intelligence as labels, the small-scale pre-trained model can quickly learn high-level attack features; 3. By learning high-level TT intelligence, the small-scale pre-trained model can transfer this knowledge to more specific TTP intelligence recognition tasks, thereby improving the training efficiency of the small-scale pre-trained model.

[0146] S402: Train the small-scale pre-training model to be trained according to the sample text content to obtain a small-scale pre-training model.

[0147] The small-scale pre-trained model to be trained is evaluated through indicators such as accuracy and recall, and its performance in the TTP intelligence extraction task is measured. If the effect is not ideal, it can be iterated by increasing the number of training times, optimizing the parameters of the small-scale pre-trained model to be trained, increasing the amount of sample data, etc., until the training effect reaches the expected small-scale pre-trained model.

[0148] S403: Perform TTP intelligence extraction processing on the initial data through a small-scale pre-training model to obtain a first intelligence list including at least one first TTP intelligence.

[0149] See S101 above, which will not be repeated here.

[0150] S404: Perform semantic segmentation and content summarization on the initial data through a large-scale pre-training model to obtain a content block list including at least one text content and a summary of the content block list.

[0151] See the above S102, which will not be described again here.

[0152] S405: Combining the content block list, the summary and the first intelligence list into a first prompt word.

[0153] See the above S103, which will not be described again here.

[0154] S406: Prompt the large-scale pre-trained model to extract TTP intelligence from the content block list according to the first prompt word, and obtain a second intelligence list including at least one second TTP intelligence.

[0155] See the above S104, which will not be repeated here.

[0156] S407. According to at least one second TTP intelligence included in the second intelligence list, semantic segmentation and labeling processing are performed on the initial data to obtain labeled data as sample data for training a small-scale pre-training model.

[0157] Based on a preset cycle, multiple second intelligence lists are exported, and semantic segmentation and labeling processing is performed on the initial data corresponding to the second intelligence list according to at least one second TTP intelligence included in each second intelligence list, to obtain labeled data as sample data for training a small-scale pre-training model. The labeled data is labeled with TT intelligence as a label.

[0158] As the coverage of the initial data for extracting at least one second TTP intelligence becomes wider and wider, the accuracy of TTP intelligence extraction by the small-scale pre-trained model can be improved, and a more accurate first intelligence list can be extracted as the first prompt word, thereby making the quality of the first prompt word received by the large-scale language model higher and higher, and ultimately making the results of the self-TTP intelligence extracted by the TTP intelligence extraction method proposed in the embodiment of the present application more and more accurate.

[0159] In an embodiment of the present application, at least one first TTP intelligence in the initial data is first extracted by a small-scale pre-training model, and the initial data is further processed by a large-scale pre-training model for semantic segmentation and content summarization to obtain at least one text content and a summary, and at least one first TTP intelligence, at least one text content and a summary are further composed of a first prompt word, thereby prompting a large-scale pre-training model to extract TTP intelligence of at least one text content according to the first prompt word, and obtaining at least one second TTP intelligence. The small-scale pre-training model that is easy to train can be used as a TT classifier with high accuracy, output the first TTP intelligence, and stimulate the large-scale pre-training model to give a more correct second TT intelligence as an answer in combination with the text content context, thereby effectively reducing the illusion of the large-scale pre-training model, and at the same time, there is no need to train the large-scale pre-training model with high difficulty. In other words, the present application combines the respective advantages of the small-scale pre-training model and the large-scale pre-training model, and can extract TTP intelligence with high accuracy and low illusion from the threat report as the initial data, and realize accurate automatic extraction of TTP intelligence.

[0160] In one embodiment, Fig. 9 As shown, it is a flow chart of a TTP intelligence extraction method provided by an embodiment of the present application, which can be implemented by a computer program and can be run on a TTP intelligence extraction device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0161] Specifically, the TTP intelligence extraction method includes:

[0162] S501. Perform TTP intelligence extraction processing on initial data using a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence.

[0163] See S101 above, which will not be repeated here.

[0164] S502: Perform semantic segmentation and content summarization on the initial data through a large-scale pre-training model to obtain a content block list including at least one text content and a summary of the content block list.

[0165] See the above S102, which will not be described again here.

[0166] S503: According to the first intelligence list, at least one fourth TTP intelligence whose similarity with the first TTP intelligence meets a preset condition is matched in a historical TTP intelligence database to obtain a fourth intelligence list including the at least one fourth TTP intelligence.

[0167] The historical TTP intelligence library is a data set that includes multiple fourth TTP intelligence, each of which should include detailed annotations of tactics, techniques, and implementation procedures, and the multiple fourth TTP intelligence included in the historical TTP intelligence library can come from historically acquired unstructured APT analysis reports, penetration analysis reports, malware analysis reports, etc. For example, the fourth TTP intelligence includes: {Tactics: Execution, Technology: Command Line and Script Interpreter. PowerShell, Attack Process: Query the virtual directory configured for the Web service through the PowerShell command Get-WebServicesVirtualDirectory}.

[0168] To find at least one fourth TTP intelligence similar to each first TTP intelligence in the historical TTP intelligence library, it is necessary to calculate the similarity between the first TTP and the plurality of fourth TTP intelligence included in the historical TTP intelligence library. Common similarity calculation methods include: Jaccard similarity calculation, Cosine similarity calculation, edit distance (Levenshtein distance) calculation, etc. In this application, there is no restriction on the selected similarity calculation method.

[0169] After selecting a suitable similarity metric, the first TTP intelligence is compared with each fourth TTP intelligence in the historical TTP intelligence library, a similarity score is calculated, and the fourth TTP intelligence having a similarity score greater than or equal to a similarity threshold is determined as at least one fourth TTP intelligence whose similarity with the first TTP intelligence meets a preset condition. Based on the above steps, at least one fourth TTP intelligence corresponding to each first TTP intelligence is obtained, thereby obtaining a fourth intelligence list including at least one fourth TTP intelligence.

[0170] It is understandable that, in this embodiment, the preset condition is that the similarity score between the first TTP intelligence is greater than or equal to the similarity threshold. In other embodiments, the preset condition may also be other content.

[0171] like Fig.10 According to the first intelligence list 503, at least one fourth TTP intelligence whose similarity with the first TTP intelligence 503 meets the preset condition is matched in the historical TTP intelligence library 508, and a fourth intelligence list 509 including at least one fourth TTP intelligence is obtained.

[0172] In one embodiment, multiple fourth TTP intelligence included in the historical TTP intelligence library are vectorized to obtain vector data corresponding to the multiple fourth TTP intelligence; the first TTP intelligence included in the first intelligence list is vectorized to obtain vector data corresponding to the first TTP intelligence; the similarity between the vector data corresponding to the first TTP intelligence and the vector data corresponding to the multiple fourth TTP intelligence is calculated, and at least one fourth TTP intelligence whose similarity with the first TTP intelligence meets a preset condition is determined to obtain a fourth intelligence list including multiple fourth TTP intelligence.

[0173] The means for vectorizing the fourth TTP intelligence and the first TTP intelligence include but are not limited to: performing an embedding operation through an embedding model (such as BGE) to obtain an embedding vector, and then using methods including but not limited to cosine similarity to compare the vector data corresponding to the fourth TTP intelligence and the vector data corresponding to the first TTP intelligence for similarity, and retaining at least one fourth TTP intelligence whose similarity meets the preset conditions as the fourth TTP intelligence corresponding to the first TTP intelligence.

[0174] In another embodiment, the implementation process included in the fourth TTP intelligence is vectorized, and the implementation process included in the first TTP intelligence is vectorized. However, by comparing the similarity between the vector data corresponding to the implementation process included in the first TTP intelligence and the vector data corresponding to the implementation process included in the fourth TTP intelligence, at least one fourth TTP intelligence whose similarity meets the preset conditions is determined as the fourth TTP intelligence corresponding to the first TTP intelligence.

[0175] In this embodiment, by only comparing the similarities between the implementation processes respectively included in the first TTP intelligence and the second TTP intelligence, at least one fourth TTP intelligence whose similarity meets the preset conditions is determined as the fourth TTP intelligence corresponding to the first TTP intelligence. This can effectively improve the matching efficiency and avoid the problem of excessive calculation caused by directly comparing the similarity of the first TTP intelligence and the second TTP intelligence.

[0176] S504: Determine at least one third TT intelligence involved in at least one first TTP intelligence and at least one fourth TTP intelligence, obtain a standard interpretation corresponding to the third TT intelligence, and obtain a second interpretation list.

[0177] The second interpretation list includes at least one third TT information and a standard interpretation corresponding to each third TT information.

[0178] The first TTP intelligence and the fourth TTP intelligence are composed of tactics, technology and implementation process, so the first TTP intelligence and the fourth TTP both include the third TT intelligence. For example, the first TTP intelligence includes: {Tactics: initial access, technology: phishing attack, spear phishing attachment, implementation process: Lazarus delivers phishing emails with the subject of the German military enterprise "Rheinmetall" work requirements to the target, inducing users to enable macros}, and the third TT intelligence included in the first TTP intelligence is: {Tactics: initial access, technology: phishing attack, spear phishing attachment}.

[0179] Based on the third TT intelligence, a standard interpretation matching the third TT intelligence can be obtained from the tactical technology TT description library. For example, the third TT intelligence is [{tactic: execution, technology: command line and script interpreter: PowerShell}, and the standard interpretation corresponding to the third TT intelligence is determined in the tactical technology description library to obtain: {tactic: execution, technology: command line and script}, interpreter: PowerShell. Interpretation: attackers may abuse PowerShell commands and scripts to carry out attacks}.

[0180] like Fig.10 As shown, based on the first intelligence list 503 including at least one third TT intelligence, and the fourth intelligence list 509 including at least one third TT intelligence, a standard interpretation matching the third TT intelligence is obtained from the TT description library 510 to obtain a second interpretation list 511.

[0181] S505, the content block list, the summary, the first information list, the fourth information list and the second explanation list are combined into a first prompt word.

[0182] like Fig.10As shown, the content block list 5051, the summary 5052, the first intelligence list 503, the fourth intelligence list 509 and the second explanation list 511 are combined into the first prompt word 506. The first prompt word 506 is used to allow the scale pre-training model 504 to extract TTP intelligence from the content block list 5051 according to the first prompt word 506.

[0183] In this embodiment, the content of the first prompt word 506 includes:

[0184] A. The first intelligence list 503 extracted by the small-scale pre-training model is used to stimulate the ability of the large-scale pre-training model 504 to identify and extract TTP intelligence. Avoid letting the large-scale pre-training model 504 extract from scratch, so that the large-scale pre-training model 504 can see a part of the "unconfirmed answers to this test paper" as a reference;

[0185] B. An intelligence list 509 including a plurality of fourth TTP intelligence similar to the first intelligence list 503, so that the large-scale pre-trained model 504 can refer to "accurate answers to historical real test papers";

[0186] C. A second explanation list 511 including multiple third TT analyses allows the large-scale pre-trained model 504 to obtain accurate definition explanations of technical tactics. These definition explanations are also accompanied by descriptions of some classic implementation processes to avoid using confusing knowledge within the large-scale pre-trained model 504.

[0187] D. Summarize and summarize 5052, so that the large-scale pre-trained model 504 can have a correct understanding of the attack stage and attack purpose of the current processing content block in the overall attack activity.

[0188] E. Content block list 5051, used for large-scale pre-trained model 504 to identify and extract TTP intelligence therefrom.

[0189] S506: Prompt the large-scale pre-trained model to extract TTP intelligence from the content block list according to the first prompt word, and obtain a second intelligence list including at least one second TTP intelligence.

[0190] See the above S104, which will not be repeated here.

[0191] In an embodiment of the present application, at least one first TTP intelligence in the initial data is first extracted by a small-scale pre-training model, and the initial data is further processed by a large-scale pre-training model for semantic segmentation and content summarization to obtain at least one text content and a summary, and at least one first TTP intelligence, at least one text content and a summary are further composed of a first prompt word, thereby prompting a large-scale pre-training model to extract TTP intelligence of at least one text content according to the first prompt word, and obtaining at least one second TTP intelligence. The small-scale pre-training model that is easy to train can be used as a TT classifier with high accuracy, output the first TTP intelligence, and stimulate the large-scale pre-training model to give a more correct second TT intelligence as an answer in combination with the text content context, thereby effectively reducing the illusion of the large-scale pre-training model, and at the same time, there is no need to train the large-scale pre-training model with high difficulty. In other words, the present application combines the respective advantages of the small-scale pre-training model and the large-scale pre-training model, and can extract TTP intelligence with high accuracy and low illusion from the threat report as the initial data, and realize accurate automatic extraction of TTP intelligence.

[0192] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0193] See also Fig.11 , which shows a schematic diagram of the structure of a TTP intelligence extraction device provided by an exemplary embodiment of the present application. The TTP intelligence extraction device can be implemented as all or part of the device through software, hardware or a combination of both. The TTP intelligence extraction device includes a small model processing module 601, a large model processing module 602, a prompt word generation module 603, and an intelligence list extraction module 604.

[0194] A small model processing module 601 is used to perform TTP intelligence extraction processing on the initial data through a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence;

[0195] A large model processing module 602 is used to perform semantic segmentation and content summarization processing on the initial data through a large-scale pre-trained model to obtain a content block list including at least one text content and a summary of the content block list;

[0196] A prompt word generating module 603, configured to combine the content block list, the summary and the first intelligence list into a first prompt word;

[0197] The intelligence list extraction module 604 is used to prompt the large-scale pre-trained model to perform TTP intelligence extraction processing on the content block list according to the first prompt word, so as to obtain a second intelligence list including at least one second TTP intelligence.

[0198] In one embodiment, the TTP intelligence extraction device further includes:

[0199] A first interpretation module is used to obtain a standard interpretation corresponding to the first tactical technique (TT) intelligence included in the second TTP intelligence, and obtain a first interpretation list; wherein the first interpretation list includes at least one of the first TT intelligence and a standard interpretation corresponding to each of the first TT intelligence;

[0200] A second prompting module, configured to combine the second intelligence list, the content block list, the summary and the first explanation list into a second prompting word;

[0201] The intelligence correction module is used to prompt the large-scale pre-trained model to correct at least one second TTP intelligence included in the second intelligence list according to the second prompt word, so as to obtain a third intelligence list including at least one third TTP intelligence.

[0202] In one embodiment, the TTP intelligence extraction device further includes:

[0203] A third prompting module, used for combining the third intelligence list and the summary into a third prompting word;

[0204] A de-duplication and sorting module is used to prompt the large-scale pre-trained model to deduplicate and sort the third intelligence list according to the third prompt word, so as to obtain a target intelligence list including at least one third TTP intelligence and kill chain information composed of at least one third TTP intelligence in the target intelligence list; wherein the number of third TTP intelligence included in the target intelligence list is less than or equal to the number of third TTP intelligence included in the third intelligence list.

[0205] In one embodiment, the TTP intelligence extraction device further includes:

[0206] The first training module is used to perform semantic segmentation and labeling processing on the sample data to obtain at least one sample text content labeled with the second TT intelligence;

[0207] The second training module is used to train the small-scale pre-training model to be trained according to the sample text content to obtain the small-scale pre-training model.

[0208] In one embodiment, the prompt word generation module 603 includes:

[0209] A first generating unit is configured to match at least one fourth TTP intelligence whose similarity with the first TTP intelligence satisfies a preset condition in a historical TTP intelligence library according to the first intelligence list, so as to obtain a fourth intelligence list including at least one fourth TTP intelligence;

[0210] The second generating unit is used to determine at least one third TT intelligence involved in at least one of the first TTP intelligence and at least one of the fourth TTP intelligence, obtain a standard interpretation corresponding to the third TT intelligence, and obtain a second interpretation list; wherein the second interpretation list includes at least one of the third TT intelligence and a standard interpretation corresponding to each of the third TT intelligence;

[0211] The third generating unit is used to combine the content block list, the summary, the first intelligence list, the fourth intelligence list and the second explanation list into a first prompt word.

[0212] In one embodiment, the first generating unit includes:

[0213] A first vectorization processing subunit is used to perform vectorization processing on a plurality of fourth TTP intelligences included in the historical TTP intelligence library to obtain vector data corresponding to the plurality of fourth TTP intelligences respectively;

[0214] A second vectorization processing subunit is used to perform vectorization processing on the first TTP intelligence included in the first intelligence list to obtain vector data corresponding to the first TTP intelligence;

[0215] The similarity calculation subunit is used to calculate the similarity between the vector data corresponding to the first TTP intelligence and the vector data corresponding to the multiple fourth TTP intelligences, determine at least one fourth TTP intelligence whose similarity with the first TTP intelligence meets the preset conditions, and obtain a fourth intelligence list including multiple fourth TTP intelligences.

[0216] In one embodiment, the large model processing module 602 includes:

[0217] A filtering unit, used to filter text content irrelevant to TTP intelligence in the initial data through a large-scale pre-trained model to obtain processed data;

[0218] A segmentation unit, configured to perform semantic segmentation processing on the processed data by using the large-scale pre-trained model to obtain a content block list including at least one text content;

[0219] The summarizing unit is used to instruct the large-scale pre-trained model to perform content summarization processing on the content block list based on the TTP angle to obtain a summary of the content block list.

[0220] In one embodiment, the intelligence list extraction module 604 includes:

[0221] A separate processing unit, configured to prompt the large-scale pre-trained model to sequentially perform TTP intelligence extraction processing on at least one text content included in the content block list according to the first prompt word, so as to obtain at least one second TTP intelligence corresponding to each of the text contents;

[0222] The information extraction unit is used to obtain a second information list including at least one second TTP information according to the at least one second TTP information corresponding to each of the text contents.

[0223] In one embodiment, the correction intelligence module includes:

[0224] The correction intelligence unit is used to prompt the at least one second TTP intelligence corresponding to the large-scale pre-trained model to be corrected according to the second prompt word, determine at least one third TTP intelligence corresponding to the text content, and obtain a third intelligence list including at least one third TTP intelligence.

[0225] In one embodiment, the TTP intelligence extraction device further includes:

[0226] The third training module is used to perform semantic segmentation and labeling processing on the initial data according to at least one second TTP intelligence included in the second intelligence list, and obtain labeled data as sample data for training the small-scale pre-training model.

[0227] In an embodiment of the present application, at least one first TTP intelligence in the initial data is first extracted by a small-scale pre-training model, and the initial data is further processed by a large-scale pre-training model for semantic segmentation and content summarization to obtain at least one text content and a summary, and at least one first TTP intelligence, at least one text content and a summary are further composed of a first prompt word, thereby prompting a large-scale pre-training model to extract TTP intelligence of at least one text content according to the first prompt word, and obtaining at least one second TTP intelligence. The small-scale pre-training model that is easy to train can be used as a TT classifier with high accuracy, output the first TTP intelligence, and stimulate the large-scale pre-training model to give a more correct second TT intelligence as an answer in combination with the text content context, thereby effectively reducing the illusion of the large-scale pre-training model, and at the same time, there is no need to train the large-scale pre-training model with high difficulty. In other words, the present application combines the respective advantages of the small-scale pre-training model and the large-scale pre-training model, and can extract TTP intelligence with high accuracy and low illusion from the threat report as the initial data, and realize accurate automatic extraction of TTP intelligence.

[0228] It should be noted that the TTP intelligence extraction device provided in the above embodiment only uses the division of the above functional modules as an example when executing the TTP intelligence extraction method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the TTP intelligence extraction device provided in the above embodiment and the TTP intelligence extraction method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0229] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0230] The present application also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figure 1 - Fig.10 The TTP intelligence extraction method of the embodiment shown in the figure can be found in the specific execution process. Figure 1 - Fig.10 The specific description of the illustrated embodiment will not be repeated here.

[0231] The present application also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1 - Fig.10 The TTP intelligence extraction method of the embodiment shown in the figure can be specifically executed by referring to Figure 1 - Fig.10 The specific description of the illustrated embodiment will not be repeated here.

[0232] See also Fig.12 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device 700 may include: at least one processor 701 , at least one network interface 704 , a user interface 703 , a memory 705 , and at least one communication bus 702 .

[0233] The communication bus 702 is used to realize the connection and communication between these components.

[0234] The user interface 703 may include a display screen (Display) and a camera (Camera), and the optional user interface 703 may also include a standard wired interface and a wireless interface.

[0235] The network interface 704 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0236] Among them, the processor 701 may include one or more processing cores. The processor 701 uses various interfaces and lines to connect various parts within the entire server 700, and executes various functions and processes data of the server 700 by running or executing instructions, programs, code sets or instruction sets stored in the memory 705, and calling data stored in the memory 705. Optionally, the processor 701 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 701 can integrate one or more combinations of processors (Central Processing Unit, CPU), image processors (Graphics Processing Unit, GPU) and modems. Among them, the CPU mainly processes operating systems, user interfaces, and applications; the GPU is responsible for rendering and drawing the content that needs to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 701, and it can be implemented separately through a chip.

[0237] Among them, the memory 705 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 705 includes a non-transitory computer-readable storage medium. The memory 705 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 705 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area may store data involved in the above-mentioned method embodiments, etc. The memory 705 may optionally be at least one storage device located away from the aforementioned processor 701. As Fig.12 As shown, the memory 705 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a TTP intelligence extraction application.

[0238] exist Fig.12In the electronic device 700 shown, the user interface 703 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 701 can be used to call the TTP intelligence extraction application stored in the memory 705, and specifically perform the following operations:

[0239] Perform TTP intelligence extraction processing on the initial data through a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence;

[0240] Performing semantic segmentation and content summarization processing on the initial data through a large-scale pre-trained model to obtain a content block list including at least one text content and a summary of the content block list;

[0241] Combining the content block list, the summary and the first intelligence list into a first prompt word;

[0242] Prompt the large-scale pre-trained model to perform TTP intelligence extraction processing on the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence.

[0243] In one embodiment, after the processor 701 executes the step of prompting the large-scale pre-trained model to extract TTP intelligence from the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence, it further executes:

[0244] According to the first tactics and techniques (TT) intelligence included in the second TTP intelligence, a standard interpretation corresponding to the first TT intelligence is obtained to obtain a first interpretation list; wherein the first interpretation list includes at least one of the first TT intelligence and a standard interpretation corresponding to each of the first TT intelligence;

[0245] Combining the second intelligence list, the content block list, the summary and the first explanation list into a second prompt word;

[0246] The large-scale pre-trained model is prompted according to the second prompt word to correct at least one second TTP intelligence included in the second intelligence list, so as to obtain a third intelligence list including at least one third TTP intelligence.

[0247] In one embodiment, after the processor 701 executes the step of prompting the large-scale pre-trained model to correct the at least one second TTP intelligence included in the second intelligence list according to the second prompt word to obtain a third intelligence list including at least one third TTP intelligence, it further executes:

[0248] Combining the third intelligence list and the summary into a third prompt word;

[0249] Prompting the large-scale pre-trained model according to the third prompt word to deduplicate and sort the third intelligence list to obtain a target intelligence list including at least one third TTP intelligence and kill chain information composed of at least one third TTP intelligence in the target intelligence list; wherein the number of third TTP intelligence included in the target intelligence list is less than or equal to the number of third TTP intelligence included in the third intelligence list.

[0250] In one embodiment, before the processor 701 performs the TTP intelligence extraction process on the initial data using the small-scale pre-trained model to obtain the first intelligence list including at least one first TTP intelligence, it further performs:

[0251] Performing semantic segmentation and annotation processing on the sample data to obtain at least one sample text content annotated with the second TT information;

[0252] The small-scale pre-training model to be trained is trained according to the sample text content to obtain the small-scale pre-training model.

[0253] In one embodiment, the processor 701 performs the step of combining the content block list and the first intelligence list into a first prompt word, specifically performing:

[0254] According to the first intelligence list, at least one fourth TTP intelligence whose similarity with the first TTP intelligence meets a preset condition is matched in a historical TTP intelligence library to obtain a fourth intelligence list including at least one fourth TTP intelligence;

[0255] Determine at least one third TT intelligence involved in at least one of the first TTP intelligence and at least one of the fourth TTP intelligence, obtain a standard interpretation corresponding to the third TT intelligence, and obtain a second interpretation list; wherein the second interpretation list includes at least one of the third TT intelligence and a standard interpretation corresponding to each of the third TT intelligence;

[0256] The content block list, the summary, the first intelligence list, the fourth intelligence list and the second explanation list are combined into a first prompt word.

[0257] In one embodiment, the processor 701 performs the matching of at least one fourth TTP intelligence whose similarity with the first TTP intelligence satisfies a preset condition in a historical TTP intelligence library according to the first intelligence list to obtain a fourth intelligence list including multiple fourth TTP intelligences, specifically performing:

[0258] Vectorize the plurality of fourth TTP intelligence included in the historical TTP intelligence database to obtain vector data corresponding to the plurality of fourth TTP intelligence respectively;

[0259] Performing vectorization processing on the first TTP intelligence included in the first intelligence list to obtain vector data corresponding to the first TTP intelligence;

[0260] Calculate the similarity between the vector data corresponding to the first TTP intelligence and the vector data corresponding to the plurality of fourth TTP intelligences, determine at least one fourth TTP intelligence whose similarity with the first TTP intelligence meets a preset condition, and obtain a fourth intelligence list including the plurality of fourth TTP intelligences.

[0261] In one embodiment, the processor 701 performs semantic segmentation and content summarization processing on the initial data through the large-scale pre-trained model to obtain a content block list including at least one text content and a summary of the content block list, specifically performing:

[0262] Filtering text content irrelevant to TTP intelligence in the initial data through a large-scale pre-trained model to obtain processed data;

[0263] Performing semantic segmentation processing on the processed data by using the large-scale pre-trained model to obtain a content block list including at least one text content;

[0264] Based on the TTP angle, the large-scale pre-trained model is instructed to perform content summarization processing on the content block list to obtain a summary of the content block list.

[0265] In one embodiment, the processor 701 executes the method of prompting the large-scale pre-trained model to perform TTP intelligence extraction processing on the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence, specifically performing:

[0266] According to the first prompt word, prompt the large-scale pre-trained model to perform TTP intelligence extraction processing on at least one text content included in the content block list in sequence to obtain at least one second TTP intelligence corresponding to each text content;

[0267] According to the at least one second TTP intelligence corresponding to each of the text contents, a second intelligence list including the at least one second TTP intelligence is obtained.

[0268] In one embodiment, the processor 701 executes the prompting of the large-scale pre-trained model according to the second prompt word to correct at least one second TTP intelligence included in the second intelligence list to obtain a third intelligence list including at least one third TTP intelligence, specifically executing:

[0269] According to the second prompt word, at least one second TTP intelligence corresponding to the large-scale pre-trained model is prompted to be corrected, at least one third TTP intelligence corresponding to the text content is determined, and a third intelligence list including at least one third TTP intelligence is obtained.

[0270] In one embodiment, after the processor 701 executes the step of prompting the large-scale pre-trained model to extract TTP intelligence from the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence, it further executes:

[0271] According to at least one second TTP intelligence included in the second intelligence list, the initial data is semantically segmented and labeled to obtain labeled data as sample data for training the small-scale pre-training model.

[0272] In an embodiment of the present application, at least one first TTP intelligence in the initial data is first extracted by a small-scale pre-training model, and the initial data is further processed by a large-scale pre-training model for semantic segmentation and content summarization to obtain at least one text content and a summary, and at least one first TTP intelligence, at least one text content and a summary are further composed of a first prompt word, thereby prompting a large-scale pre-training model to extract TTP intelligence of at least one text content according to the first prompt word, and obtaining at least one second TTP intelligence. The small-scale pre-training model that is easy to train can be used as a TT classifier with high accuracy, output the first TTP intelligence, and stimulate the large-scale pre-training model to give a more correct second TT intelligence as an answer in combination with the text content context, thereby effectively reducing the illusion of the large-scale pre-training model, and at the same time, there is no need to train the large-scale pre-training model with high difficulty. In other words, the present application combines the respective advantages of the small-scale pre-training model and the large-scale pre-training model, and can extract TTP intelligence with high accuracy and low illusion from the threat report as the initial data, and realize accurate automatic extraction of TTP intelligence.

[0273] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0274] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0275] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A Tactics Techniques Procedures (TTP) intelligence extraction method, characterized in that: The method comprises: Perform TTP intelligence extraction processing on the initial data through a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence; Performing semantic segmentation and content summarization processing on the initial data through a large-scale pre-trained model to obtain a content block list including at least one text content and a summary of the content block list; Combining the content block list, the summary and the first intelligence list into a first prompt word; Prompt the large-scale pre-trained model to perform TTP intelligence extraction processing on the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence.

2. The TTP intelligence extraction method according to claim 1, characterized in that: After prompting the large-scale pre-trained model to extract TTP intelligence from the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence, the method further includes: According to the first tactics and techniques (TT) intelligence included in the second TTP intelligence, a standard interpretation corresponding to the first TT intelligence is obtained to obtain a first interpretation list; wherein the first interpretation list includes at least one of the first TT intelligence and a standard interpretation corresponding to each of the first TT intelligence; Combining the second intelligence list, the content block list, the summary and the first explanation list into a second prompt word; The large-scale pre-trained model is prompted according to the second prompt word to correct at least one second TTP intelligence included in the second intelligence list, so as to obtain a third intelligence list including at least one third TTP intelligence.

3. The TTP intelligence extraction method according to claim 2, characterized in that: After the method prompts the large-scale pre-trained model to correct at least one second TTP intelligence included in the second intelligence list according to the second prompt word to obtain a third intelligence list including at least one third TTP intelligence, the method further includes: Combining the third intelligence list and the summary into a third prompt word; Prompting the large-scale pre-trained model according to the third prompt word to deduplicate and sort the third intelligence list to obtain a target intelligence list including at least one third TTP intelligence and kill chain information composed of at least one third TTP intelligence in the target intelligence list; wherein the number of third TTP intelligence included in the target intelligence list is less than or equal to the number of third TTP intelligence included in the third intelligence list.

4. The TTP intelligence extraction method according to claim 1, characterized in that: Before the TTP intelligence extraction process is performed on the initial data by using the small-scale pre-training model to obtain a first intelligence list including at least one first TTP intelligence, the method further includes: Performing semantic segmentation and annotation processing on the sample data to obtain at least one sample text content annotated with the second TT information; The small-scale pre-training model to be trained is trained according to the sample text content to obtain the small-scale pre-training model.

5. The TTP intelligence extraction method according to claim 1, characterized in that: The step of combining the content block list and the first intelligence list into a first prompt word includes: According to the first intelligence list, at least one fourth TTP intelligence whose similarity with the first TTP intelligence meets a preset condition is matched in a historical TTP intelligence library to obtain a fourth intelligence list including at least one fourth TTP intelligence; Determine at least one third TT intelligence involved in at least one of the first TTP intelligence and at least one of the fourth TTP intelligence, obtain a standard interpretation corresponding to the third TT intelligence, and obtain a second interpretation list; wherein the second interpretation list includes at least one of the third TT intelligence and a standard interpretation corresponding to each of the third TT intelligence; The content block list, the summary, the first intelligence list, the fourth intelligence list and the second explanation list are combined into a first prompt word.

6. The TTP intelligence extraction method according to claim 5, characterized in that: The method of matching at least one fourth TTP intelligence whose similarity with the first TTP intelligence satisfies a preset condition in a historical TTP intelligence database according to the first intelligence list, and obtaining a fourth intelligence list including a plurality of fourth TTP intelligences, comprises: Vectorize the plurality of fourth TTP intelligence included in the historical TTP intelligence database to obtain vector data corresponding to the plurality of fourth TTP intelligence respectively; Performing vectorization processing on the first TTP intelligence included in the first intelligence list to obtain vector data corresponding to the first TTP intelligence; Calculate the similarity between the vector data corresponding to the first TTP intelligence and the vector data corresponding to the plurality of fourth TTP intelligences, determine at least one fourth TTP intelligence whose similarity with the first TTP intelligence meets a preset condition, and obtain a fourth intelligence list including the plurality of fourth TTP intelligences.

7. The TTP intelligence extraction method according to claim 1, characterized in that: The semantic segmentation and content summarization processing of the initial data by using a large-scale pre-trained model to obtain a content block list including at least one text content and a summary of the content block list includes: Filtering text content irrelevant to TTP intelligence in the initial data through a large-scale pre-trained model to obtain processed data; Performing semantic segmentation processing on the processed data by using the large-scale pre-trained model to obtain a content block list including at least one text content; Based on the TTP angle, the large-scale pre-trained model is instructed to perform content summarization processing on the content block list to obtain a summary of the content block list.

8. The TTP intelligence extraction method according to claim 1, characterized in that: The step of prompting the large-scale pre-trained model to extract TTP intelligence from the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence includes: According to the first prompt word, prompt the large-scale pre-trained model to perform TTP intelligence extraction processing on at least one text content included in the content block list in sequence to obtain at least one second TTP intelligence corresponding to each text content; According to the at least one second TTP intelligence corresponding to each of the text contents, a second intelligence list including the at least one second TTP intelligence is obtained.

9. The TTP intelligence extraction method according to claim 2, characterized in that: The method of prompting the large-scale pre-trained model to correct at least one second TTP intelligence included in the second intelligence list according to the second prompt word to obtain a third intelligence list including at least one third TTP intelligence includes: According to the second prompt word, the large-scale pre-trained model is prompted to correct at least one second TTP intelligence corresponding to the text content in turn, determine at least one third TTP intelligence corresponding to the text content, and obtain a third intelligence list including at least one third TTP intelligence.

10. The TTP intelligence extraction method according to claim 4, characterized in that: After prompting the large-scale pre-trained model to extract TTP intelligence from the content block list according to the first prompt word to obtain a second intelligence list including at least one second TTP intelligence, the method further includes: According to at least one second TTP intelligence included in the second intelligence list, the initial data is semantically segmented and labeled to obtain labeled data as sample data for training the small-scale pre-training model.

11. A TTP intelligence extraction device, characterized in that: The TTP intelligence extraction device comprises: A small model processing module, used for performing TTP intelligence extraction processing on the initial data through a small-scale pre-trained model to obtain a first intelligence list including at least one first TTP intelligence; A large model processing module, used to perform semantic segmentation and content summarization processing on the initial data through a large-scale pre-trained model to obtain a content block list including at least one text content and a summary of the content block list; A prompt word generating module, used for combining the content block list, the summary and the first intelligence list into a first prompt word; The intelligence list extraction module is used to prompt the large-scale pre-trained model to perform TTP intelligence extraction processing on the content block list according to the first prompt word, so as to obtain a second intelligence list including at least one second TTP intelligence.

12. A computer storage medium, characterized in that: The computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 10.

13. An electronic device, characterized in that: include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 10.

Images