Threat intelligence classification method, program product, electronic equipment and storage medium

Abstract

The invention provides a threat intelligence classification method, a program product, electronic equipment and a storage medium, which are applied to the technical field of network security, and the method comprises the following steps: obtaining to-be-classified threat intelligence data; the to-be-classified threat intelligence data is input into a pre-trained threat intelligence classification model, a classification result output by the threat intelligence classification model is obtained, the threat intelligence classification model comprises a multi-layer classifier, and the classification result comprises a tactical category, a technical category and a sub-technical category corresponding to the to-be-classified threat intelligence data; and determining a target TTP name corresponding to the to-be-classified threat intelligence according to a classification result. The threat intelligence classification model is utilized to classify the to-be-classified threat intelligence data, the model comprises multiple layers of classifiers, and tactics, technologies and sub-technologies corresponding to the to-be-classified threat intelligence can be classified layer by layer, so that the classification accuracy of the to-be-classified threat intelligence data can be improved, and the classification efficiency of the to-be-classified threat intelligence data is improved. And thus, the accuracy of detecting the network security threats is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a threat intelligence classification method, program product, electronic device and storage medium. Background Art

[0002] Currently, the complexity and frequency of cyber attacks are growing at an alarming rate, and traditional defense mechanisms are unable to fully cope with them. Attackers are increasingly using advanced persistent threats (APTs) and zero-day vulnerabilities to achieve precise and covert attack targets. At the same time, attack activities are highly diverse and distributed, covering a wide range of types from ransomware to supply chain attacks. These attacks often evade detection through fuzzy or deformed means, such as dynamically adjusting attack methods or using similar but semantically complex descriptions at different attack stages, which increases the difficulty of threat intelligence analysis. However, the accuracy of detecting network security threats in existing technologies is low. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a method for solving the technical problem of low accuracy in detecting network security threats in the prior art.

[0004] In a first aspect, an embodiment of the present application provides a method for classifying threat intelligence, comprising: obtaining threat intelligence data to be classified; inputting the threat intelligence data to be classified into a pre-trained threat intelligence classification model to obtain a classification result output by the threat intelligence classification model, wherein the threat intelligence classification model includes a multi-layer classifier, and the classification result includes tactical categories, technical categories, and sub-technical categories corresponding to the threat intelligence data to be classified; and determining a target TTP name corresponding to the threat intelligence to be classified based on the classification result.

[0005] In the above scheme, a pre-trained threat intelligence classification model can be used to classify the classified threat intelligence data, wherein the above threat intelligence classification model includes a multi-layer classifier, which can classify the tactics, techniques and sub-techniques corresponding to the classified threat intelligence layer by layer, thereby reducing interference between categories and gradually refining the classification results, thereby improving the accuracy of classifying the classified threat intelligence data, and thus improving the accuracy of detecting network security threats.

[0006] In an optional implementation, the threat intelligence classification model includes a tactical classifier, a technical classifier, and a sub-technical classifier; the inputting of the threat intelligence data to be classified into a pre-trained threat intelligence classification model to obtain the classification result output by the threat intelligence classification model includes: inputting the threat intelligence data to be classified into the tactical classifier to obtain the tactical condition probability output by the tactical classifier; inputting the tactical condition probability into the technical classifier to obtain the technical condition probability output by the technical classifier; inputting the technical condition probability into the sub-technical classifier to obtain the sub-technical condition probability output by the sub-technical classifier; calculating the joint probability according to the tactical condition probability, the technical condition probability, and the sub-technical condition probability to obtain the classification result. In the above scheme, the threat intelligence classification model may include three layers of classifiers, namely, a tactical classifier, a technical classifier, and a sub-technical classifier; wherein the tactical classifier is used to determine the tactical category of the threat intelligence data to be classified, the technical classifier is used to determine the technical category of the threat intelligence data to be classified, and the sub-technical classifier is used to determine the sub-technical category of the threat intelligence data to be classified. By calculating the conditional probability layer by layer, the complexity of each classifier is effectively reduced, and complex hierarchical multi-classification problems can be efficiently handled, thereby improving the classification accuracy and the interpretability of the model.

[0007] In an optional embodiment, before determining the target TTP name corresponding to the threat intelligence to be classified according to the classification result, the method further includes: constructing a TTP name mapping table, wherein the TTP name mapping table includes a mapping relationship between each initial TTP name and a sub-technical category under a technical category under a tactical category; determining the target TTP name corresponding to the threat intelligence to be classified according to the classification result includes: querying the TTP name mapping table for the initial TTP name corresponding to the classification result as the target TTP name. In the above scheme, before determining the target TTP name corresponding to the threat intelligence to be classified, a TTP name mapping table can be constructed in advance, so that the initial TTP name corresponding to the classification result output by the model can be quickly and accurately found from the above TTP name mapping table by looking up the table.

[0008] In an optional implementation, the acquisition of threat intelligence data to be classified includes: acquiring original threat intelligence data; preprocessing the original threat intelligence data to obtain intermediate threat intelligence data; and determining the threat intelligence data to be classified based on the intermediate threat intelligence data. In the above scheme, after the original threat intelligence data is acquired, the original threat intelligence data can be preprocessed first, so as to facilitate the subsequent further determination of the threat intelligence data to be classified, and classification using the threat intelligence classification model.

[0009] In an optional implementation, the determining the threat intelligence data to be classified based on the intermediate threat intelligence data includes: inputting the intermediate threat intelligence data into a pre-trained language model to obtain the threat intelligence data to be classified output by the language model. In the above scheme, by inputting the intermediate threat intelligence data into the language model, the intermediate threat intelligence data can be encoded into a high-dimensional embedding and the corresponding semantic features can be extracted, so as to facilitate the subsequent classification using the threat intelligence classification model.

[0010] In an optional embodiment, the threat intelligence classification method further includes: optimizing the parameters of a support vector machine using the following steps to obtain the threat intelligence classification model: obtaining sample data, wherein the sample data includes sample description data and an initial TTP name corresponding to each sample description data; optimizing the parameters of the support vector machine using the sample data to obtain the threat intelligence classification model. In the above scheme, the sample data can be used to optimize the parameters of the support vector machine to obtain threat intelligence classification data. Since the above threat intelligence classification model includes a multi-layer classifier, the tactics, techniques, and sub-techniques corresponding to the threat intelligence to be classified can be classified layer by layer, thereby reducing interference between categories and being able to gradually refine the classification results, thereby improving the accuracy of classifying the threat intelligence data to be classified, and thereby improving the accuracy of detecting network security threats.

[0011] In an optional implementation, the sample description data includes first description data and second description data, the initial TTP name corresponding to the first description data is known, and the initial TTP name corresponding to the second description data is unknown; the acquisition of sample data includes: acquiring the sample description data and the initial TTP name corresponding to the first description data; calculating the similarity between the first description data and the second description data, and determining the initial TTP name corresponding to the second description data based on the similarity. In the above scheme, for the second description data whose initial TTP name is unknown, the similarity between it and the first description data can be calculated to match it with a suitable initial TTP name, thereby expanding the amount of data in the sample data, thereby improving the accuracy of classifying the threat intelligence data to be classified.

[0012] In a second aspect, an embodiment of the present application provides a threat intelligence classification device, comprising: an acquisition module, used to acquire threat intelligence data to be classified; an input module, used to input the threat intelligence data to be classified into a pre-trained threat intelligence classification model to obtain a classification result output by the threat intelligence classification model, wherein the threat intelligence classification model includes a multi-layer classifier, and the classification result includes tactical categories, technical categories, and sub-technical categories corresponding to the threat intelligence data to be classified; a determination module, used to determine the target TTP name corresponding to the threat intelligence to be classified according to the classification result.

[0013] In the above scheme, a pre-trained threat intelligence classification model can be used to classify the classified threat intelligence data, wherein the above threat intelligence classification model includes a multi-layer classifier, which can classify the tactics, techniques and sub-techniques corresponding to the classified threat intelligence layer by layer, thereby reducing interference between categories and gradually refining the classification results, thereby improving the accuracy of classifying the classified threat intelligence data, and thus improving the accuracy of detecting network security threats.

[0014] In an optional implementation, the threat intelligence classification model includes a tactical classifier, a technical classifier, and a sub-technical classifier; the input module is specifically used to: input the threat intelligence data to be classified into the tactical classifier to obtain the tactical conditional probability output by the tactical classifier; input the tactical conditional probability into the technical classifier to obtain the technical conditional probability output by the technical classifier; input the technical conditional probability into the sub-technical classifier to obtain the sub-technical conditional probability output by the sub-technical classifier; calculate the joint probability according to the tactical conditional probability, the technical conditional probability, and the sub-technical conditional probability to obtain the classification result. In the above scheme, the threat intelligence classification model may include three layers of classifiers, namely, a tactical classifier, a technical classifier, and a sub-technical classifier; wherein the tactical classifier is used to determine the tactical category of the threat intelligence data to be classified, the technical classifier is used to determine the technical category of the threat intelligence data to be classified, and the sub-technical classifier is used to determine the sub-technical category of the threat intelligence data to be classified. By calculating the conditional probability layer by layer, the complexity of each classifier is effectively reduced, and complex hierarchical multi-classification problems can be efficiently processed, thereby improving the accuracy of classification and the interpretability of the model.

[0015] In an optional embodiment, the classification device of the threat intelligence further includes: a construction module for constructing a TTP name mapping table, wherein the TTP name mapping table includes a mapping relationship between each initial TTP name and a sub-technical category under a technical category under a tactical category; the determination module is specifically used to query the initial TTP name corresponding to the classification result in the TTP name mapping table as the target TTP name. In the above scheme, before determining the target TTP name corresponding to the threat intelligence to be classified, a TTP name mapping table can be constructed in advance, so that the initial TTP name corresponding to the classification result output by the model can be quickly and accurately found from the above TTP name mapping table by looking up the table.

[0016] In an optional implementation, the acquisition module is specifically used to: acquire original threat intelligence data; preprocess the original threat intelligence data to obtain intermediate threat intelligence data; and determine the threat intelligence data to be classified based on the intermediate threat intelligence data. In the above scheme, after acquiring the original threat intelligence data, the original threat intelligence data can be preprocessed first, so as to facilitate the subsequent further determination of the threat intelligence data to be classified, and classification using the threat intelligence classification model.

[0017] In an optional implementation, the acquisition module is also used to: input the intermediate threat intelligence data into a pre-trained language model to obtain the threat intelligence data to be classified output by the language model. In the above scheme, by inputting the intermediate threat intelligence data into the language model, the intermediate threat intelligence data can be encoded into a high-dimensional embedding and the corresponding semantic features can be extracted, so as to facilitate the subsequent classification using the threat intelligence classification model.

[0018] In an optional embodiment, the threat intelligence classification device further includes: a training module for optimizing the parameters of a support vector machine using the following steps to obtain the threat intelligence classification model: obtaining sample data, wherein the sample data includes sample description data and an initial TTP name corresponding to each sample description data; optimizing the parameters of the support vector machine using the sample data to obtain the threat intelligence classification model. In the above scheme, the sample data can be used to optimize the parameters of the support vector machine to obtain threat intelligence classification data. Since the above threat intelligence classification model includes a multi-layer classifier, the tactics, techniques, and sub-techniques corresponding to the classified threat intelligence can be classified layer by layer, thereby reducing interference between categories and being able to gradually refine the classification results, thereby improving the accuracy of classifying the classified threat intelligence data, and thereby improving the accuracy of detecting network security threats.

[0019] In an optional embodiment, the sample description data includes first description data and second description data, the initial TTP name corresponding to the first description data is known, and the initial TTP name corresponding to the second description data is unknown; the training module is specifically used to: obtain the sample description data and the initial TTP name corresponding to the first description data; calculate the similarity between the first description data and the second description data, and determine the initial TTP name corresponding to the second description data based on the similarity. In the above scheme, for the second description data whose initial TTP name is unknown, the similarity between it and the first description data can be calculated to match it with a suitable initial TTP name, thereby expanding the amount of data in the sample data, thereby improving the accuracy of classifying the threat intelligence data to be classified.

[0020] In a third aspect, an embodiment of the present application provides a computer program product, including computer program instructions, which, when read and executed by a processor, execute the threat intelligence classification method as described in the first aspect.

[0021] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus; the processor and the memory communicate with each other through the bus; the memory stores computer program instructions that can be executed by the processor, and the processor calls the computer program instructions to execute the threat intelligence classification method described in the first aspect.

[0022] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer program instructions. When the computer program instructions are executed by a computer, the computer executes the threat intelligence classification method as described in the first aspect.

[0023] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the following specifically cites the embodiments of the present application and describes them in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flowchart of a method for classifying threat intelligence provided in an embodiment of the present application;

[0026] Figure 2A structural block diagram of a threat intelligence classification device provided in an embodiment of the present application;

[0027] Figure 3 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0029] Please refer to Figure 1 , Figure 1 A flowchart of a method for classifying threat intelligence provided in an embodiment of the present application, the method for classifying threat intelligence may specifically include the following steps:

[0030] Step S101: Obtain threat intelligence data to be classified.

[0031] Step S102: Input the threat intelligence data to be classified into a pre-trained threat intelligence classification model to obtain a classification result output by the threat intelligence classification model, wherein the threat intelligence classification model includes a multi-layer classifier, and the classification result includes tactical categories, technical categories, and sub-technical categories corresponding to the threat intelligence data to be classified.

[0032] Step S103: Determine the target TTP name corresponding to the threat intelligence to be classified according to the classification result.

[0033] Specifically, in the above step S101, the threat intelligence data to be classified refers to the threat intelligence data obtained from the network for which the names of corresponding tactics, techniques, and processes (TTPs) need to be determined. The embodiment of the present application does not make any specific limitation on its specific form.

[0034] It should be noted that the embodiments of the present application do not specifically limit the specific implementation methods for obtaining threat intelligence data to be classified, and those skilled in the art may make appropriate adjustments according to actual conditions. For example, threat intelligence data to be classified sent by an external device may be received; or, threat intelligence data to be classified pre-stored locally or in the cloud may be read; or, threat intelligence data to be classified may be determined based on original threat intelligence data, etc.

[0035] In the above step S102, the threat intelligence classification model includes multiple layers of classifiers, each layer of classifiers is used to classify a level. For example, if there are three levels: tactics, technology, and sub-technology, the threat intelligence classification model may include three layers of classifiers, each layer of classifiers is used to classify tactics, technology, and sub-technology.

[0036] By inputting the threat intelligence data to be classified obtained in the above step S101 into a pre-trained threat intelligence classification model, the classification result output by the above threat intelligence classification model can be obtained; wherein, since the threat intelligence classification model includes a multi-layer classifier, the above classification result may include tactical categories, technical categories, and sub-technical categories corresponding to the threat intelligence data to be classified.

[0037] It should be noted that the embodiments of the present application do not specifically limit the specific form of the classification results, and those skilled in the art can make appropriate adjustments according to actual conditions. As an implementation method, the above classification results may include the probability values ​​corresponding to each category; as another implementation method, the above classification results may include the target category with the highest probability value; as an implementation method, the above classification results may include the position coordinates corresponding to the target category with the highest probability value, and the position coordinates represent the position of the target category in the TTP hierarchy.

[0038] In the above step S103, the embodiment of the present application does not specifically limit the specific form of determining the target TTP name corresponding to the threat intelligence to be classified according to the classification result, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, a TTP name mapping table can be pre-constructed, and the target TTP name corresponding to the classification result can be determined by looking up the table; or the above classification result can be input into another pre-trained model to obtain the target TTP name output by the model.

[0039] In the above scheme, a pre-trained threat intelligence classification model can be used to classify the classified threat intelligence data, wherein the above threat intelligence classification model includes a multi-layer classifier, which can classify the tactics, techniques and sub-techniques corresponding to the classified threat intelligence layer by layer, thereby reducing interference between categories and gradually refining the classification results, thereby improving the accuracy of classifying the classified threat intelligence data, and thus improving the accuracy of detecting network security threats.

[0040] Further, based on the above embodiment, the above threat intelligence classification model may include a tactical classifier, a technical classifier, and a sub-technical classifier. In this case, the above step S102 may specifically include the following steps:

[0041] Step 1), input the threat intelligence data to be classified into the tactical classifier to obtain the tactical conditional probability output by the tactical classifier.

[0042] Step 2), input the tactical condition probability into the technical classifier to obtain the technical condition probability output by the technical classifier.

[0043] Step 3), input the technical condition probability into the sub-technical classifier to obtain the sub-technical condition probability output by the sub-technical classifier.

[0044] Step 4), calculate the joint probability according to the tactical condition probability, the technical condition probability and the sub-technical condition probability to obtain the classification result.

[0045] Specifically, as an implementation method, the threat intelligence classification model may include multiple support vector machine (SVM) classifiers based on radial basis function (RBF) kernels (i.e., Gaussian kernels) to divide the feature space in a hierarchical manner, thereby achieving multi-level TTP classification and matching. The above Gaussian kernel can be defined as:

[0046]

[0047] Among them, x i and x j is the distance between samples, σ controls the width of the Gaussian function and controls the mapping of data in high-dimensional space.

[0048] At this point, a three-layer multi-category classification task can be performed: use the softmax function to calculate the prediction probability of multiple categories, calculate the category distribution layer by layer through conditional probability, use the output of each layer as the input of the next layer, and finally select the category corresponding to the maximum joint probability based on the conditional probabilities of all layers.

[0049] In the above step 1), the threat intelligence data to be classified can be represented as a high-order embedding vector x∈R d , where d is the dimension of the embedding vector; inputting the threat intelligence data to be classified into the tactical classifier, the tactical conditional probability output by the tactical classifier can be obtained:

[0050]

[0051] in, is the support vector weight corresponding to category k, is the training label corresponding to category k. The final predicted category is:

[0052]

[0053] In the above step 2), the tactical conditional probability is input into the technical classifier, and the technical conditional probability output by the technical classifier can be obtained:

[0054]

[0055] In the above step 3), the technical condition probability is input into the sub-technical classifier, and the sub-technical condition probability output by the sub-technical classifier can be obtained:

[0056]

[0057] In the above step 4), according to the tactical condition probability determined in the above step 1), the technical condition probability determined in the above step 2), and the sub-technical condition probability determined in the above step 3), the joint probability can be calculated:

[0058] P(y=(k,m,n)|x)=P(y tactic =k|x)·P(y technique =m|x,y tactic )

[0059] P(y subtechnique =n|x,y technique ).

[0060] Based on the above joint probability, a sub-technical category under a technical category under a tactical category with the largest probability can be determined as the classification result.

[0061] In the above scheme, the threat intelligence classification model can include three layers of classifiers, namely, tactical classifier, technical classifier and sub-technical classifier; wherein, the tactical classifier is used to determine the tactical category of the threat intelligence data to be classified, the technical classifier is used to determine the technical category of the threat intelligence data to be classified, and the sub-technical classifier is used to determine the sub-technical category of the threat intelligence data to be classified. By calculating the conditional probability layer by layer, the complexity of each classifier is effectively reduced, and complex hierarchical multi-classification problems can be efficiently processed, thereby improving the accuracy of classification and the interpretability of the model.

[0062] Further, based on the above embodiment, before the above step S103, the threat intelligence classification method provided in the embodiment of the present application may further include the following steps:

[0063] A TTP name mapping table is constructed, wherein the TTP name mapping table includes a mapping relationship between each initial TTP name and a sub-technical category under a technical category under a tactical category.

[0064] At this time, the above step S103 may specifically include the following steps:

[0065] The initial TTP name corresponding to the classification result in the TTP name mapping table is queried as the target TTP name.

[0066] Specifically, the TTP name mapping table includes a mapping relationship between each initial TTP name and a sub-technical category under a technical category under a tactical category. Therefore, based on the tactical category, technical category, and sub-technical category included in the classification result, the initial TTP name corresponding to the classification result can be found by querying the above TTP name mapping table as the target TTP name corresponding to the threat intelligence data to be classified.

[0067] As an implementation method, the initial TTP names under the MITRE ATT&CK framework can be numbered step by step according to the three levels of tactics-technology-sub-technology, and the position coordinates of a sub-technology are (tactical layer, technical layer, sub-technology layer). In this way, each mapping pair can be expressed as (embedded vector, position coordinate), and each position coordinate has a corresponding initial TTP name.

[0068] In the above scheme, before determining the target TTP name corresponding to the threat intelligence to be classified, a TTP name mapping table can be constructed in advance, so that the initial TTP name corresponding to the classification result output by the model can be quickly and accurately found from the above TTP name mapping table by looking up the table.

[0069] Further, based on the above embodiment, the above step S101 may specifically include the following steps:

[0070] Step 1), obtain the original threat intelligence data.

[0071] Step 2) preprocesses the original threat intelligence data to obtain intermediate threat intelligence data.

[0072] Step 3), determining the threat intelligence data to be classified based on the intermediate threat intelligence data.

[0073] Specifically, in the above step 1), the embodiment of the present application does not specifically limit the specific implementation method of obtaining the original threat intelligence data, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the original threat intelligence data sent by an external device can be received; or the original threat intelligence data pre-stored locally or in the cloud can be read.

[0074] In addition, the embodiments of the present application do not specifically limit the specific source of the original threat intelligence data, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the original threat intelligence data can come from: attack descriptions extracted from intrusion detection systems (IDS) or security information and event management; or public network attack reports, papers, and technical documents.

[0075] In the above step 2), the embodiment of the present application does not specifically limit the specific implementation method of preprocessing, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the collected text data is cleaned and noise is removed: meaningless symbols, HTML tags, etc. are deleted; Mr. Hu, the collected text data is normalized: the text is uniformly converted to lowercase, stop words are removed, etc.; or, parts of speech are restored: words are restored to their basic form; or, word segmentation: the description is decomposed into single keywords or phrases, etc.

[0076] In the above scheme, after obtaining the original threat intelligence data, the original threat intelligence data can be preprocessed first, so as to facilitate the subsequent further determination of the threat intelligence data to be classified and classification using the threat intelligence classification model.

[0077] Further, based on the above embodiment, the step of determining the threat intelligence data to be classified according to the intermediate threat intelligence data may specifically include the following steps:

[0078] The intermediate threat intelligence data is input into the pre-trained language model to obtain the threat intelligence data to be classified output by the language model.

[0079] Specifically, the embodiments of the present application do not specifically limit the specific implementation of the above-mentioned language model, and those skilled in the art can make appropriate adjustments according to actual conditions; for example: the language model can adopt a Sentence-T5 model, a Bidirectional Encoder Representations from Transformers (BERT) model, etc.

[0080] In the above scheme, by inputting the intermediate threat intelligence data into the language model, the intermediate threat intelligence data can be encoded into a high-dimensional embedding and the corresponding semantic features can be extracted, so as to facilitate the subsequent classification using the threat intelligence classification model.

[0081] Further, based on the above embodiments, the threat intelligence classification method provided by the embodiment of the present application can also optimize the parameters of the support vector machine to obtain a threat intelligence classification model by using the following steps:

[0082] Step 1), obtaining sample data, wherein the sample data includes sample description data and an initial TTP name corresponding to each sample description data.

[0083] Step 2), use sample data to optimize the parameters of the support vector machine to obtain a threat intelligence classification model.

[0084] Specifically, in the above step 1), the sample data may include sample description data and the initial TTP name corresponding to each sample description data. It should be noted that the embodiments of the present application do not specifically limit the specific implementation method of obtaining sample data, and those skilled in the art may make appropriate adjustments according to actual conditions. For example, sample data sent by an external device may be received; or sample data pre-stored locally or in the cloud may be read, etc.

[0085] In addition, the embodiments of the present application do not specifically limit the specific source of the sample data, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the sample data can come from: public threat intelligence databases, such as the standardized TTP descriptions and TTP names contained in the MITRE ATT&CK (MITRE Adversarial Tactics, Techniques, and Common Knowledge) framework; annotated or classified attack descriptions extracted from an intrusion detection system (IDS) or security information and event management; or public network attack reports, papers, and technical documents.

[0086] It is understandable that after obtaining the above sample data, the above sample data can be preprocessed and semantic features can be extracted. Among them, the embodiment of the present application does not specifically limit the specific implementation method of preprocessing, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the collected text data is cleaned and noise is removed: meaningless symbols, HTML tags, etc. are deleted; Mr. Hu, the collected text data is normalized: the text is uniformly converted to lowercase, stop words are removed, etc.; or, parts of speech are restored: words are restored to their basic form; or, word segmentation: the description is broken down into single keywords or phrases, etc.

[0087] In step 2) above, the SVM classifier can minimize the classification error by optimizing the following objective function:

[0088]

[0089] Among them, w k and b k is the weight and bias term corresponding to each category, C is the penalty parameter, ξ i is a soft interval variable. Therefore, the sample data can be used to optimize the parameters of the support vector machine to obtain a pre-trained threat intelligence classification model.

[0090] It is understandable that when the threat intelligence classification model cannot accurately classify, new data can be annotated and incorporated into the sample data, and the model parameters can be updated through incremental learning to ensure that it can adapt to dynamic changes in data.

[0091] In the above scheme, the sample data can be used to optimize the parameters of the support vector machine to obtain threat intelligence classification data. Since the above threat intelligence classification model includes a multi-layer classifier, the tactics, techniques and sub-techniques corresponding to the classified threat intelligence can be classified layer by layer, thereby reducing the interference between categories and gradually refining the classification results, improving the accuracy of classifying the classified threat intelligence data, and thus improving the accuracy of detecting network security threats.

[0092] Further, based on the above embodiment, the sample description data may include first description data and second description data. In this case, the step of obtaining the sample data may further include the following steps:

[0093] Step 1), obtaining sample description data and an initial TTP name corresponding to the first description data.

[0094] Step 2), calculating the similarity between the first description data and the second description data, and determining the initial TTP name corresponding to the second description data according to the similarity.

[0095] Specifically, in the above step 1), the initial TTP name corresponding to the first description data is known, while the initial TTP name corresponding to the second description data is unknown. Therefore, the first description data, the second description data and the initial TTP name corresponding to the first description data can be obtained respectively.

[0096] In the above step 2), the embodiment of the present application does not specifically limit the specific implementation method of calculating the similarity between the first description data and the second description data, and those skilled in the art can make appropriate adjustments according to actual conditions. For example, the similarity between the first description data and the second description data can be calculated using a trained similarity model; or the sine similarity between the first description data and the second description data can be calculated.

[0097] By calculating the similarity between the first description data and the second description data, the initial TTP name corresponding to the second description data can be determined according to the similarity. For example, if a second description data has the highest similarity with a first description data among multiple first description data, the initial TTP name corresponding to the first description data is determined as the initial TTP name corresponding to the second description data.

[0098] It is understandable that the second description data may also be matched with the corresponding initial TTP name by manual annotation. In the process of adding new data matching, the impact on the existing grouping can be minimized, thereby ensuring the continuous consistency and reliability of the grouping structure.

[0099] In the above scheme, for the second description data whose initial TTP name is unknown, the similarity between it and the first description data can be calculated to match it with a suitable initial TTP name, thereby expanding the data volume in the sample data and improving the accuracy of classifying the threat intelligence data to be classified.

[0100] Further, based on the above embodiment, when automatically classifying the input attack description into a known TTP name, confidence information may be added.

[0101] As an implementation method, high-confidence classification results can be processed first, and low-confidence samples can be marked as "unknown" and wait for manual review; as another implementation method, different security responses can be triggered according to the classification results. When the classification confidence is low, the response can be delayed and further confirmation can be requested; as another implementation method, the threat description multi-candidate task can be completed, the top K possible classification results can be output and the corresponding confidence can be displayed.

[0102] Furthermore, the threat intelligence classification method provided in the embodiment of the present application supports data extracted from multiple sources (such as: MITRE ATT&CK, IDS, SIEM, public reports, etc.), and has strong adaptability and versatility; in addition, the threat intelligence classification method provided in the embodiment of the present application is not only applicable to TTP classification, but can also be extended to other multi-classification and multi-level problems, such as vulnerability classification, event grouping, etc.

[0103] Please refer to Figure 2 , Figure 2 A structural block diagram of a threat intelligence classification device provided in an embodiment of the present application, the threat intelligence classification device 200 includes: an acquisition module 201, used to obtain threat intelligence data to be classified; an input module 202, used to input the threat intelligence data to be classified into a pre-trained threat intelligence classification model to obtain a classification result output by the threat intelligence classification model, wherein the threat intelligence classification model includes a multi-layer classifier, and the classification result includes tactical categories, technical categories and sub-technical categories corresponding to the threat intelligence data to be classified; a determination module 203, used to determine the target TTP name corresponding to the threat intelligence to be classified according to the classification result.

[0104] In the above scheme, a pre-trained threat intelligence classification model can be used to classify the classified threat intelligence data, wherein the above threat intelligence classification model includes a multi-layer classifier, which can classify the tactics, techniques and sub-techniques corresponding to the classified threat intelligence layer by layer, thereby reducing interference between categories and gradually refining the classification results, thereby improving the accuracy of classifying the classified threat intelligence data, and thus improving the accuracy of detecting network security threats.

[0105] Further, on the basis of the above embodiments, the threat intelligence classification model includes a tactical classifier, a technical classifier and a sub-technical classifier; the input module 202 is specifically used to: input the threat intelligence data to be classified into the tactical classifier to obtain the tactical condition probability output by the tactical classifier; input the tactical condition probability into the technical classifier to obtain the technical condition probability output by the technical classifier; input the technical condition probability into the sub-technical classifier to obtain the sub-technical condition probability output by the sub-technical classifier; calculate the joint probability according to the tactical condition probability, the technical condition probability and the sub-technical condition probability to obtain the classification result.

[0106] In the above scheme, the threat intelligence classification model can include three layers of classifiers, namely, tactical classifier, technical classifier and sub-technical classifier; wherein, the tactical classifier is used to determine the tactical category of the threat intelligence data to be classified, the technical classifier is used to determine the technical category of the threat intelligence data to be classified, and the sub-technical classifier is used to determine the sub-technical category of the threat intelligence data to be classified. By calculating the conditional probability layer by layer, the complexity of each classifier is effectively reduced, and complex hierarchical multi-classification problems can be efficiently processed, thereby improving the accuracy of classification and the interpretability of the model.

[0107] Furthermore, based on the above embodiment, the threat intelligence classification device 200 also includes: a construction module, used to construct a TTP name mapping table, wherein the TTP name mapping table includes a mapping relationship between each initial TTP name and a sub-technical category under a technical category under a tactical category; the determination module is specifically used to: query the initial TTP name corresponding to the classification result in the TTP name mapping table as the target TTP name.

[0108] In the above scheme, before determining the target TTP name corresponding to the threat intelligence to be classified, a TTP name mapping table can be constructed in advance, so that the initial TTP name corresponding to the classification result output by the model can be quickly and accurately found from the above TTP name mapping table by looking up the table.

[0109] Further, based on the above embodiment, the acquisition module 201 is specifically used to: acquire original threat intelligence data; preprocess the original threat intelligence data to obtain intermediate threat intelligence data; and determine the threat intelligence data to be classified based on the intermediate threat intelligence data.

[0110] In the above scheme, after obtaining the original threat intelligence data, the original threat intelligence data can be preprocessed first, so as to facilitate the subsequent further determination of the threat intelligence data to be classified and classification using the threat intelligence classification model.

[0111] Further, based on the above embodiment, the acquisition module 201 is also used to: input the intermediate threat intelligence data into a pre-trained language model to obtain the threat intelligence data to be classified output by the language model.

[0112] In the above scheme, by inputting the intermediate threat intelligence data into the language model, the intermediate threat intelligence data can be encoded into a high-dimensional embedding and the corresponding semantic features can be extracted, so as to facilitate the subsequent classification using the threat intelligence classification model.

[0113] Furthermore, based on the above embodiments, the threat intelligence classification device 200 also includes: a training module, which is used to optimize the parameters of the support vector machine using the following steps to obtain the threat intelligence classification model: obtaining sample data, wherein the sample data includes sample description data and an initial TTP name corresponding to each sample description data; using the sample data to optimize the parameters of the support vector machine to obtain the threat intelligence classification model.

[0114] In the above scheme, the sample data can be used to optimize the parameters of the support vector machine to obtain threat intelligence classification data. Since the above threat intelligence classification model includes a multi-layer classifier, the tactics, techniques and sub-techniques corresponding to the classified threat intelligence can be classified layer by layer, thereby reducing the interference between categories and gradually refining the classification results, improving the accuracy of classifying the classified threat intelligence data, and thus improving the accuracy of detecting network security threats.

[0115] Further, based on the above embodiment, the sample description data includes first description data and second description data, the initial TTP name corresponding to the first description data is known, and the initial TTP name corresponding to the second description data is unknown; the training module is specifically used to: obtain the sample description data and the initial TTP name corresponding to the first description data; calculate the similarity between the first description data and the second description data, and determine the initial TTP name corresponding to the second description data based on the similarity.

[0116] In the above scheme, for the second description data whose initial TTP name is unknown, the similarity between it and the first description data can be calculated to match it with a suitable initial TTP name, thereby expanding the data volume in the sample data and improving the accuracy of classifying the threat intelligence data to be classified.

[0117] Please refer to Figure 3 , Figure 3 The structural block diagram of an electronic device provided in an embodiment of the present application, the electronic device 300 includes: at least one processor 301, at least one communication interface 302, at least one memory 303 and at least one communication bus 304. Among them, the communication bus 304 is used to realize the direct connection and communication of these components, the communication interface 302 is used to communicate signaling or data with other node devices, and the memory 303 stores machine-readable instructions executable by the processor 301. When the electronic device 300 is running, the processor 301 communicates with the memory 303 through the communication bus 304, and the machine-readable instructions are called by the processor 301 to execute the above-mentioned threat intelligence classification method.

[0118] For example, the processor 301 of the embodiment of the present application reads a computer program from the memory 303 through the communication bus 304 and executes the computer program to implement the following method: obtaining threat intelligence data to be classified; inputting the threat intelligence data to be classified into a pre-trained threat intelligence classification model to obtain a classification result output by the threat intelligence classification model, wherein the threat intelligence classification model includes a multi-layer classifier, and the classification result includes a tactical category, a technical category, and a sub-technical category corresponding to the threat intelligence data to be classified; and determining the target TTP name corresponding to the threat intelligence to be classified according to the classification result.

[0119] Among them, the processor 301 includes one or more, which can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 301 can be a general-purpose processor, including a central processing unit (CPU), a micro control unit (MCU), a network processor (NP) or other conventional processors; it can also be a dedicated processor, including a neural network processor (NPU), a graphics processor (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. In addition, when there are multiple processors 301, some of them can be general-purpose processors and the other part can be dedicated processors.

[0120] The memory 303 includes one or more, which may be, but not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.

[0121] Understandably, Figure 3 The structure shown is for illustration only. The electronic device 300 may also include Figure 3 More or fewer components as shown, or with Figure 3 Different configurations are shown. Figure 3Each component shown in can be implemented by hardware, software or a combination thereof. In the embodiment of the present application, the electronic device 300 can be, but is not limited to, a physical device such as a desktop computer, a laptop computer, a smart phone, a smart wearable device, a vehicle-mounted device, etc., and can also be a virtual device such as a virtual machine. In addition, the electronic device 300 is not necessarily a single device, but can also be a combination of multiple devices, such as a server cluster, etc.

[0122] The embodiment of the present application also provides a computer program product, including a computer program stored on a computer-readable storage medium, the computer program including computer program instructions, and when the computer program instructions are executed by a computer, the computer can execute the steps of the threat intelligence classification method in the above embodiment, for example including: Step S101: Obtain threat intelligence data to be classified. Step S102: Input the threat intelligence data to be classified into a pre-trained threat intelligence classification model to obtain a classification result output by the threat intelligence classification model, wherein the threat intelligence classification model includes a multi-layer classifier, and the classification result includes tactical categories, technical categories, and sub-technical categories corresponding to the threat intelligence data to be classified. Step S103: Determine the target TTP name corresponding to the threat intelligence to be classified based on the classification result.

[0123] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer program instructions. When the computer program instructions are executed by a computer, the computer executes the threat intelligence classification method described in the aforementioned method embodiment.

[0124] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0125] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0126] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0127] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM) random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0128] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0129] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for classifying threat intelligence, characterized in that: include: Obtain threat intelligence data to be classified; Inputting the threat intelligence data to be classified into a pre-trained threat intelligence classification model to obtain a classification result output by the threat intelligence classification model, wherein the threat intelligence classification model includes a multi-layer classifier, and the classification result includes a tactical category, a technical category, and a sub-technical category corresponding to the threat intelligence data to be classified; Determine the target TTP name corresponding to the threat intelligence to be classified according to the classification result.

2. The method for classifying threat intelligence according to claim 1, characterized in that: The threat intelligence classification model includes a tactical classifier, a technical classifier, and a sub-technical classifier; The step of inputting the threat intelligence data to be classified into a pre-trained threat intelligence classification model to obtain a classification result output by the threat intelligence classification model includes: Inputting the threat intelligence data to be classified into the tactical classifier to obtain the tactical conditional probability output by the tactical classifier; Inputting the tactical condition probability into the technical classifier to obtain the technical condition probability output by the technical classifier; Inputting the technical condition probability into the sub-technical classifier to obtain the sub-technical condition probability output by the sub-technical classifier; The joint probability is calculated according to the tactical condition probability, the technical condition probability and the sub-technical condition probability to obtain the classification result.

3. The method for classifying threat intelligence according to claim 1, characterized in that: Before determining the target TTP name corresponding to the threat intelligence to be classified according to the classification result, the method further includes: Constructing a TTP name mapping table, wherein the TTP name mapping table includes a mapping relationship between each initial TTP name and a sub-technical category under a technical category under a tactical category; Determining the target TTP name corresponding to the threat intelligence to be classified according to the classification result includes: The TTP name mapping table is queried for an initial TTP name corresponding to the classification result as the target TTP name.

4. The method for classifying threat intelligence according to claim 1, characterized in that: The obtaining of threat intelligence data to be classified includes: Obtain raw threat intelligence data; Preprocessing the original threat intelligence data to obtain intermediate threat intelligence data; The threat intelligence data to be classified is determined according to the intermediate threat intelligence data.

5. The method for classifying threat intelligence according to claim 4, characterized in that: The determining the threat intelligence data to be classified according to the intermediate threat intelligence data includes: The intermediate threat intelligence data is input into a pre-trained language model to obtain the threat intelligence data to be classified output by the language model.

6. The method for classifying threat intelligence according to any one of claims 1 to 5, characterized in that: Also includes: The following steps are used to optimize the parameters of the support vector machine to obtain the threat intelligence classification model: Acquire sample data, wherein the sample data includes sample description data and an initial TTP name corresponding to each sample description data; The sample data is used to optimize the parameters of the support vector machine to obtain the threat intelligence classification model.

7. The method for classifying threat intelligence according to claim 6, characterized in that: The sample description data includes first description data and second description data, the initial TTP name corresponding to the first description data is known, and the initial TTP name corresponding to the second description data is unknown; The obtaining of sample data comprises: Obtaining the sample description data and an initial TTP name corresponding to the first description data; The similarity between the first description data and the second description data is calculated, and an initial TTP name corresponding to the second description data is determined according to the similarity.

8. A computer program product, characterized in that It includes computer program instructions, which, when read and executed by a processor, execute the threat intelligence classification method as described in any one of claims 1 to 7.

9. An electronic device, characterized in that: include: processor, memory, and bus; The processor and the memory communicate with each other via the bus; The memory stores computer program instructions that can be executed by the processor, and the processor calls the computer program instructions to execute the threat intelligence classification method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a computer, the computer executes the threat intelligence classification method according to any one of claims 1 to 7.

Images