Multi-source information fusion processing method and device, equipment and medium

Abstract

The embodiment of the invention provides a multi-source information fusion processing method and device, equipment and a medium, and the method comprises the steps: carrying out the quality evaluation of each external information source under a plurality of different information source quality evaluation dimensions after obtaining first network threat information data and second network threat information data, and obtaining a plurality of quality evaluation scores; weighting to obtain a quality comprehensive score corresponding to each external intelligence source; when the first network threat intelligence data determines that the target address information is unknown address information, determining a determination result of each second network threat intelligence data on the target address information, and allocating different count values to each external intelligence source based on the determination result; and determining a weighting coefficient of the corresponding external intelligence source based on the quality comprehensive score, performing weighted fusion according to the weighting coefficient and the corresponding count value under each external intelligence source to obtain a multi-source intelligence fusion value, and determining a malicious address judgment result of the target address information based on the multi-source intelligence fusion value, so that the recognition accuracy of the malicious address can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technologies, and in particular, to a multi-source intelligence fusion processing method, apparatus, device, and medium. Background Art

[0002] With the rapid development of Internet technologies, network information security issues have become increasingly prominent. Cyber Threat Intelligence (CTI) data is the key data for identifying, evaluating, and responding to network security threats, and is information about potential and ongoing threats related to network security and infrastructure. Through network threat intelligence, it is possible to determine whether a corresponding Internet Protocol (IP) address is a malicious address. Therefore, high-quality network threat intelligence is crucial for identifying malicious addresses.

[0003] In related technologies, due to the relatively narrow data sources and application scenarios covered by a single intelligence source, the data is not comprehensive enough. Combining network threat intelligence data from multiple intelligence sources to identify malicious addresses has become a trend. However, due to the uneven quality of network threat intelligence data from different intelligence sources, currently, only manual analysis can be used to combine network threat intelligence data from multiple intelligence sources for malicious address identification. The manual analysis method not only has low efficiency but also highly depends on the experience of personnel, resulting in low accuracy in identifying malicious addresses. Summary of the Invention

[0004] The main objective of the embodiments of the present disclosure is to propose a multi-source intelligence fusion processing method, apparatus, device, and medium, which can improve the accuracy of identifying malicious addresses.

[0005] To achieve the above objective, a first aspect of the embodiments of the present disclosure proposes a multi-source intelligence fusion processing method, including: Obtaining target address information to be detected, and obtaining first network threat intelligence data corresponding to the target address information from an internal intelligence source, and obtaining second network threat intelligence data corresponding to the target address information from multiple external intelligence sources respectively; Performing quality assessment on each of the external intelligence sources under multiple different intelligence source quality assessment dimensions to obtain multiple quality assessment scores, and weighting the multiple quality assessment scores to obtain a quality comprehensive score corresponding to each of the external intelligence sources; When the first network threat intelligence data determines that the target address information is unknown address information, determining the determination results of each of the second network threat intelligence data on the target address information, and assigning different count values to each of the external intelligence sources based on different determination results; Determine the weighted coefficient of the corresponding external information source based on the comprehensive quality score, and perform weighted fusion according to the weighted coefficient and the corresponding count values under each external information source to obtain a multi-source intelligence fusion value; Determine the malicious address determination result of the target address information based on the magnitude of the multi-source intelligence fusion value.

[0006] In some embodiments, the step of assigning different count values to each external information source based on different determination results includes: Determine the first quantity that determines the target address information as malicious address information from the determination results corresponding to each external information source; Determine the second quantity of the external information source, and determine the determination ratio of determining the target address information as the malicious address information among multiple external information sources according to the first quantity and the second quantity; When the determination ratio reaches a preset ratio and the comprehensive quality score corresponding to the external information source that determines the target address information as the malicious address information reaches a preset score, determine that the target address information is the malicious address information; When the determination ratio is lower than the preset ratio, or the comprehensive quality score corresponding to the external information source that determines the target address information as the malicious address information is lower than the preset score, assign different count values to each external information source based on different determination results.

[0007] In some embodiments, the multi-source intelligence fusion processing method further includes: Determine the internal confidence of the internal information source from the first network threat intelligence data, where the magnitude of the internal confidence is between 0 and 1; Obtain a preset voting ratio adjustment coefficient and a basic voting threshold, determine the difference between 1 and the internal confidence, then obtain a product based on the difference multiplied by the voting ratio adjustment coefficient, and obtain the preset ratio based on the sum of the product and the basic voting threshold.

[0008] In some embodiments, the step of determining the weighted coefficient of the corresponding external information source based on the comprehensive quality score includes: Accumulate the comprehensive quality scores under multiple external information sources to obtain a total quality score; Use the ratio of the comprehensive quality score of each external information source to the total quality score as the weighted coefficient of the corresponding external information source.

[0009] In some embodiments, the multi-source intelligence fusion processing method further includes: When the first network threat intelligence data determines that the target address information is malicious address information and the internal confidence level of the internal intelligence source is greater than a preset confidence threshold, determine the determination results of each of the second network threat intelligence data on the target address information; When the determination result under any one of the external intelligence sources also determines that the target address information is the malicious address information, determine that the target address information is the malicious address information.

[0010] In some embodiments, the quality assessment of each of the external intelligence sources under multiple different intelligence source quality assessment dimensions to obtain multiple quality assessment scores, and weighting the multiple quality assessment scores to obtain the quality comprehensive score corresponding to each of the external intelligence sources includes: Under the intelligence update time, intelligence source confidence level, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability, conduct quality assessment on each of the external intelligence sources to obtain the intelligence update time score, intelligence source confidence level score, intelligence source comprehensiveness score, intelligence source authority score, and intelligence source stability score for each of the external intelligence sources; Weight multiple of the intelligence update time score, the intelligence source confidence level score, the intelligence source comprehensiveness score, the intelligence source authority score, and the intelligence source stability score to obtain the quality comprehensive score corresponding to each of the external intelligence sources.

[0011] In some embodiments, the conduct of quality assessment on each of the external intelligence sources under the intelligence update time, intelligence source confidence level, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability to obtain the intelligence update time score, intelligence source confidence level score, intelligence source comprehensiveness score, intelligence source authority score, and intelligence source stability score for each of the external intelligence sources includes: Based on the difference between the current time and the update time of each of the second network threat intelligence data, round down at a preset stepped time interval to determine the corresponding first deduction stepped value, and successively deduct the corresponding first deduction stepped value based on the preset initial time score to obtain the intelligence update time score that changes in a stepped manner for each of the external intelligence sources; Obtain the external confidence levels of each of the external intelligence sources, and map the external confidence levels to the confidence level values corresponding to the corresponding confidence levels to obtain the intelligence source confidence level scores for each of the external intelligence sources; Rank the multiple external intelligence sources under multiple intelligence source comprehensiveness dimensions to obtain a comprehensiveness ranking, and determine the corresponding second deduction stepped value for each of the external intelligence sources according to the comprehensiveness ranking. Successively deduct the corresponding second deduction stepped value based on the preset initial comprehensiveness score to obtain the intelligence source comprehensiveness score that changes in a stepped manner for each of the external intelligence sources; Rank the multiple external information sources according to the authority dimension of multiple information sources to obtain an authority ranking, and determine the corresponding third deduction ladder value for each external information source according to the authority ranking. Based on the preset initial authority score, sequentially deduct the corresponding third deduction ladder value to obtain the information source authority score that changes step by step for each external information source; Determine the information update frequency, error volatility score, and historical stability score of each external information source, and perform weighting on the information update frequency, the error volatility score, and the historical stability score to obtain the information source stability score for each external information source.

[0012] In some embodiments, obtaining the first network threat intelligence data corresponding to the target address information from the internal information source, and obtaining the second network threat intelligence data corresponding to the target address information from multiple external information sources respectively includes: Obtain multiple different types of preset fields from the internal information source and multiple external information sources respectively, where the preset fields include information source fields, malicious degree fields, intelligence threat type fields, intelligence threat degree fields, and confidence fields; Perform data cleaning and formatting processing on the preset fields of the same type to obtain multiple target fields after data cleaning and formatting processing; Obtain the first network threat intelligence data based on the multiple target fields corresponding to the internal information source, and obtain the corresponding second network threat intelligence data based on the multiple target fields corresponding to each external information source.

[0013] In some embodiments, after determining the malicious address determination result of the target address information based on the magnitude of the multi-source intelligence fusion value, the multi-source intelligence fusion processing method further includes: Receive an intelligence sharing request from a target terminal; Parse the intelligence sharing request, determine the sharing permission of the target terminal, and select the shared information from the first network threat intelligence data, the second network threat intelligence data, and the malicious address determination result based on the sharing permission; Send the shared information to the target terminal.

[0014] To achieve the above object, a second aspect of the embodiments of the present disclosure proposes a multi-source intelligence fusion processing device, including: A data acquisition module, configured to acquire target address information to be detected, and acquire the first network threat intelligence data corresponding to the target address information from an internal information source, and acquire the second network threat intelligence data corresponding to the target address information from multiple external information sources respectively; A quality assessment module for performing quality assessment on each of the external information sources under multiple different intelligence source quality assessment dimensions, obtaining multiple quality assessment scores, and weighting the multiple quality assessment scores to obtain a quality comprehensive score corresponding to each external information source; A preliminary determination module for, when the first network threat intelligence data determines that the target address information is unknown address information, determining the determination results of each of the second network threat intelligence data on the target address information, and assigning different count values to each of the external information sources based on different determination results; A multi-source fusion module for determining a weighting coefficient corresponding to the external information source based on the quality comprehensive score, and performing weighted fusion according to the weighting coefficient and the count values corresponding to each external information source to obtain a multi-source intelligence fusion value; A malicious determination module for determining a malicious address determination result of the target address information based on the magnitude of the multi-source intelligence fusion value.

[0015] To achieve the above object, a third aspect of the embodiments of the present disclosure provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the multi-source intelligence fusion processing method described in the first aspect of the embodiments above.

[0016] To achieve the above object, a fourth aspect of the embodiments of the present disclosure provides a storage medium, the storage medium is a computer-readable storage medium, the storage medium stores a computer program, and when the computer program is executed by a processor, it implements the multi-source intelligence fusion processing method described in the first aspect of the embodiments above.

[0017] By executing the multi-source intelligence fusion processing method, the embodiments of the present disclosure can obtain target address information to be detected, obtain first network threat intelligence data corresponding to the target address information from an internal intelligence source, and obtain second network threat intelligence data corresponding to the target address information from multiple external intelligence sources respectively; perform quality assessment on each external intelligence source under multiple different intelligence source quality assessment dimensions, obtain multiple quality assessment scores, and weight the multiple quality assessment scores to obtain a quality comprehensive score corresponding to each external intelligence source; when the first network threat intelligence data determines that the target address information is unknown address information, determine the determination results of each of the second network threat intelligence data on the target address information, and assign different count values to each of the external information sources based on different determination results; determine a weighting coefficient corresponding to the external information source based on the quality comprehensive score, and perform weighted fusion according to the weighting coefficient and the count values corresponding to each external intelligence source to obtain a multi-source intelligence fusion value; determine a malicious address determination result of the target address information based on the magnitude of the multi-source intelligence fusion value.

[0018] Thus, in the embodiments of the present disclosure, network threat intelligence data is obtained from internal intelligence sources and external intelligence sources respectively, and then the quality of the external intelligence sources is evaluated under different intelligence source quality evaluation dimensions, so as to accurately evaluate the intelligence quality of each external intelligence source and obtain the comprehensive quality score corresponding to each external intelligence source. Then, the determination is preferentially based on the data of the internal intelligence source. When the first network threat intelligence data determines that the target address information is unknown address information, it indicates that the internal intelligence source is difficult to accurately determine the malicious situation of the target address information. Therefore, it is necessary to introduce the data of the external intelligence source for comprehensive judgment. Specifically, first determine the determination results of each second network threat intelligence data on the target address information, and assign different count values to each external intelligence source based on different determination results, so as to quantify the determination situation of each external intelligence source on the target address information. Then, determine the weighted coefficient of the corresponding external intelligence source based on the comprehensive quality score, so that the external intelligence source with better quality has more decision-making weight in the fusion process and provides a basis for the fusion between different external intelligence sources. Finally, perform weighted fusion according to the weighted coefficient and the count values corresponding to each external intelligence source, and the multi-source intelligence fusion value obtained can comprehensively represent the determination situation of multiple external intelligence sources on the target address information. Therefore, based on the size of the multi-source intelligence fusion value, the malicious address determination result of the target address information can be accurately obtained.

[0019] Compared with the solution that can only be analyzed manually in the related art, the embodiments of the present disclosure can not only fuse the data of multiple intelligence sources to achieve automatic comprehensive determination of the target address information without manual intervention, thereby improving the efficiency of malicious address determination, but also cleverly consider the determination situations of the internal intelligence source and the external intelligence source, and realize multi-source determination of malicious addresses driven by the internal intelligence source, so as to fully consider the information of different intelligence sources and finally improve the recognition accuracy of malicious addresses. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a schematic diagram of an application environment of a multi-source intelligence fusion processing method provided by an embodiment of the present disclosure; Figure 2 is a schematic flowchart of a multi-source intelligence fusion processing method provided by an embodiment of the present disclosure; Figure 3 is Figure 2 a schematic flowchart further included in step 203 in Figure 4 is a schematic flowchart of a preset ratio determination process provided by an embodiment of the present disclosure; Figure 5 is Figure 2 a schematic flowchart further included in step 204 in Figure 6is a flowchart further included in the multi-source intelligence fusion processing method provided by the embodiment of the present disclosure; Figure 7 yes Figure 2 A schematic diagram of a process flow further included in step 202; Figure 8 yes Figure 7 A schematic diagram of a process flow further included in step 701; Figure 9 yes Figure 2 A schematic diagram of a process flow further included in step 201; Figure 10 yes Figure 2 A schematic diagram of a process flow further included after step 205; Figure 11 is a schematic diagram of a multi-source intelligence fusion processing system provided by an embodiment of the present disclosure; Figure 12 It is a complete schematic diagram of the determination process provided by the embodiment of the present disclosure; Figure 13 It is a functional module diagram of a multi-source intelligence fusion processing device provided by an embodiment of the present disclosure; Figure 14 It is a schematic diagram of the hardware structure of the electronic device provided by the embodiment of the present disclosure. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0022] It can be understood that in the specific implementation of the present disclosure, it involves retrieving initial time series data, initial sample time series data and related data. When the above embodiments of the present disclosure are applied to specific products or technologies, it is necessary to obtain the object's permission or consent, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards.

[0023] In addition, when the embodiments of the present disclosure need to retrieve initial timing data, initial sample timing data, and related data, a separate permission or separate consent for the initial timing data, initial sample timing data, and related data will be obtained through methods such as pop-up windows or redirecting to a confirmation page. After clearly obtaining the separate permission or separate consent for the initial timing data, initial sample timing data, and related data, the necessary initial timing data, initial sample timing data, and related data for the normal operation of the embodiments of the present disclosure will be acquired.

[0024] In the embodiments of the present disclosure, the term "module" or "unit" refers to a computer program with a predetermined function or a part of a computer program, which works together with other related parts to achieve a predetermined goal, and can be fully or partially implemented by using software, hardware (such as a processing circuit or a memory), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an overall module or unit that includes the functions of that module or unit.

[0025] Before further elaborating on the embodiments of the present disclosure, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are applicable to the following explanations: Artificial intelligence (AI): It is a new technical science that studies and develops theories, methods, technologies, and application systems for simulating, extending, and expanding human intelligence; artificial intelligence is a branch of computer science. Artificial intelligence attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a way similar to human intelligence. The research in this field includes robots, speech recognition, image recognition, natural language processing, and expert systems, etc. Artificial intelligence can simulate the information process of human consciousness and thinking. Artificial intelligence also uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, sense the environment, acquire knowledge, and use knowledge to obtain the best results in terms of theories, methods, technologies, and application systems.

[0026] Artificial intelligence basic technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation / interaction systems, and mechatronics. Artificial intelligence software technologies mainly include several major directions such as computer vision technology, robotics technology, biometric technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0027] Cyber Threat Intelligence (CTI) data is the key data used to identify, evaluate, and respond to cybersecurity threats, and it is information about potential and ongoing threats related to cybersecurity and infrastructure.

[0028] Internet Protocol (IP) address refers to the Internet Protocol address, also translated as Internet protocol address. An IP address is a unified address format provided by the IP protocol. It assigns a logical address to each network and each host on the Internet to mask the differences in physical addresses. Through cyber threat intelligence, it can be determined whether the corresponding IP address is a malicious address. Therefore, high-quality cyber threat intelligence is crucial for identifying malicious addresses.

[0029] In related technologies, due to the relatively narrow data sources and application scenarios covered by a single intelligence source, the data is not comprehensive enough. Combining cyber threat intelligence data from multiple intelligence sources to identify malicious addresses has become a trend. However, due to the uneven quality of cyber threat intelligence data from different intelligence sources, currently, only manual analysis can be used to combine cyber threat intelligence data from multiple intelligence sources for malicious address identification. The manual analysis method is not only inefficient but also highly dependent on the experience of personnel, resulting in low accuracy in identifying malicious addresses.

[0030] Embodiments of the present disclosure propose a multi-source intelligence fusion processing method, device, equipment, and medium to solve the above problems and improve the accuracy of malicious address identification.

[0031] Please refer to Figure 1 , Figure 1 which is a schematic diagram of the scenario of the multi-source intelligence fusion processing method implementation environment provided by the embodiments of the present disclosure, including: terminal 101 and server 102.

[0032] Exemplarily, the server 102 may obtain the target address information to be detected from the terminal 101, obtain the first network threat intelligence data corresponding to the target address information from the internal intelligence source, and obtain the second network threat intelligence data corresponding to the target address information from multiple external intelligence sources respectively; perform quality assessment on each external intelligence source under multiple different intelligence source quality assessment dimensions to obtain multiple quality assessment scores, and weight the multiple quality assessment scores to obtain the quality comprehensive score corresponding to each external intelligence source; when the first network threat intelligence data determines that the target address information is unknown address information, determine the determination results of each second network threat intelligence data on the target address information, and assign different count values to each external intelligence source based on different determination results; determine the weighting coefficient of the corresponding external intelligence source based on the quality comprehensive score, and perform weighted fusion according to the weighting coefficient and the count values corresponding to each external intelligence source to obtain the multi-source intelligence fusion value; determine the malicious address determination result of the target address information based on the magnitude of the multi-source intelligence fusion value.

[0033] The terminal 101 may be a mobile phone, a computer, a smart voice interaction device, a smart wearable device, a smart home appliance, a vehicle terminal, etc., but is not limited thereto. The terminal 101 may also independently execute the multi-source intelligence fusion processing method. The terminal 101 and the server 102 may be directly or indirectly connected through a wired or wireless communication method, and the embodiments of the present disclosure do not limit this here.

[0034] The server 102 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Additionally, the server 102 may also be a node server in a blockchain network.

[0035] It should be noted that Figure 1 The scene schematic diagram of the multi-source intelligence fusion processing method implementation environment shown is merely an example. The scenes described in the embodiments of the present disclosure are for more clearly explaining the technical solutions of the embodiments of the present disclosure, and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those of ordinary skill in the art know that with the evolution of technology and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present disclosure are equally applicable to similar technical problems.

[0036] Please refer to Figure 2 , Figure 2It is a schematic flowchart of a multi-source intelligence fusion processing method provided by an embodiment of the present disclosure. This multi-source intelligence fusion processing method can be applied to the server in the above embodiment, or jointly executed by the terminal and the server. The multi-source intelligence fusion processing method includes steps 201 to 205: Step 201, obtain the target address information to be detected, and obtain the first network threat intelligence data corresponding to the target address information from the internal intelligence source, and obtain the second network threat intelligence data corresponding to the target address information from multiple external intelligence sources respectively; Step 202, perform quality evaluation on each external intelligence source under multiple different intelligence source quality evaluation dimensions, obtain multiple quality evaluation scores, and weight the multiple quality evaluation scores to obtain the quality comprehensive score corresponding to each external intelligence source; Step 203, when the first network threat intelligence data determines that the target address information is unknown address information, determine the determination results of each second network threat intelligence data on the target address information, and assign different count values to each external intelligence source based on different determination results; Step 204, determine the weighting coefficient of the corresponding external intelligence source based on the quality comprehensive score, and perform weighted fusion according to the weighting coefficient and the count values corresponding to each external intelligence source to obtain the multi-source intelligence fusion value; Step 205, determine the malicious address determination result of the target address information based on the magnitude of the multi-source intelligence fusion value.

[0037] Regarding the above step 201, the target address information is the information containing the target address, which refers to a specific network address that needs to be security-detected in the network environment. Further, the target address can be a network identifier such as an IP address, a domain name, a URL, etc. In the embodiments of the present disclosure, only the case where the target address is an IP address is taken as an example for illustration. It should be noted that the target address information, as the entry point of network attacks, may carry risks such as malicious software propagation and data leakage. By locating the target address, the threat detection can be focused from generalized network traffic analysis to specific attack carriers. And the target address information can be input by the user terminal. The user terminal can send the target address information to be detected to the server based on actual detection needs. Or, the target address information can also be automatically obtained by the server from the system where it is located or the system to be detected. The embodiments of the present disclosure do not make specific limitations on this.

[0038] The first network threat intelligence data is network threat intelligence data related to target address information obtained from internal intelligence sources. It can accurately reflect the actual behavior and impact of the target address in its own network environment and is an important basis for judging whether there are threats to the target address. Internal intelligence sources can come from the enterprise's own security devices, systems, and security operation teams, such as the enterprise's internal firewall logs, detection systems, etc. These data reflect information such as the activities of the target address in the enterprise's internal network environment, interaction records with internal systems, and possible security incidents.

[0039] The second network threat intelligence data is network threat intelligence data related to target address information obtained from multiple external intelligence sources. Although internal intelligence sources provide key information, a single internal intelligence source has limitations, and external intelligence sources can make up for the deficiencies of internal intelligence sources in terms of information breadth and diversity. External intelligence sources include open-source intelligence platforms, third-party security service providers, industry shared intelligence databases, etc., and can also be called commercial intelligence sources. These data sources can provide a wider range of network threat information, covering the network threat situation outside the enterprise, similar attack situations encountered by others, and threat trends, etc.

[0040] Regarding step 202 above, the quality assessment score is a single score obtained by evaluating external intelligence sources from different intelligence source quality assessment dimensions. For example, external intelligence sources are considered from multi-dimensional factors such as intelligence update time, intelligence source confidence, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability. Each dimension gives a corresponding score according to its satisfaction level, and this score is the quality assessment score.

[0041] The quality comprehensive score is a value that comprehensively reflects the overall quality of external intelligence sources obtained by weighted calculation of multiple quality assessment scores. It comprehensively considers the performance of external intelligence sources under each evaluation dimension and can more comprehensively and accurately measure the quality level of this intelligence source. For example, by assigning different weights to the quality assessment scores of dimensions such as intelligence update time, intelligence source confidence, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability, multiplying the quality assessment scores of each dimension by their corresponding weights and then adding them together, the quality comprehensive score is obtained.

[0042] It should be noted that a single evaluation dimension cannot fully reflect the quality of intelligence sources, and different external intelligence sources may have their own advantages and disadvantages in different aspects, while other intelligence sources provide information with high accuracy but may lack completeness. Therefore, the disclosed embodiment can examine intelligence sources from multiple angles through multiple-dimensional evaluations, and understand their quality status more comprehensively and objectively to adapt to complex and changing network threats. Different evaluation dimensions have different importance in judging the quality of intelligence sources. By assigning different weights to different dimensions, the relative importance of each dimension in the overall evaluation can be reflected, so that the comprehensive quality score can more accurately reflect the actual value of the intelligence source.

[0043] For the above step 203, the determination result refers to the determination conclusion of the second network threat intelligence data of each external intelligence source on whether the target address information is a malicious address. For example, the determination results include "malicious", "non-malicious", "suspicious", "unknown" and the like.

[0044] When the first network threat intelligence determines that the target address information is "unknown", it means that the first network threat intelligence data determines that the target address information is unknown, indicating that the internal intelligence source cannot clearly identify the malicious situation of the target address information. At this time, it is necessary to use external intelligence sources to supplement the information to more comprehensively determine the nature of the target address. Determining the judgment results of each second network threat intelligence data on the target address information is to collect information from more angles and understand the views of different external intelligence sources on the target address. For example, the internal intelligence source may not be able to make an accurate judgment on a certain target address due to limited data coverage or limitations of the analysis algorithm, while the external intelligence source may have richer data or more advanced analysis methods and can provide valuable judgment results.

[0045] The count value is a quantified value based on the judgment result of the external intelligence source. It is a quantitative representation of the judgment of each external intelligence source and is used for subsequent weighted fusion calculations. The setting of the count value is usually related to the nature of the judgment result. For example, when the judgment result is "malicious", the count value is 1; when the judgment result is "non-malicious", the count value is -1; when the judgment result is "suspicious", the count value is 0.5; when the judgment result is "unknown", the count value is 0, so that in the counting process, the larger the value, the more it indicates that the target address information tends to be malicious address information. It should be noted that the specific value of the count value can be adjusted according to actual conditions and experience.

[0046] It should be noted that different count values are assigned to each external information source based on different determination results in order to quantify the determination situations of each external information source. There are two advantages to doing this. One is to facilitate subsequent calculations and comparisons. By converting the determination results into count values, mathematical methods can be used to fuse and analyze the information of multiple external information sources, such as performing operations like weighted summation, so as to obtain a comprehensive evaluation result. The other is to be able to reflect the differences and importance of different determination results. Different determination results have different influences on finally determining whether the target address is a malicious address. By assigning different count values, corresponding weights can be given to different determination results in the calculation, making the final decision more scientific and accurate.

[0047] Regarding step 204 above, the weighting coefficient is a value determined according to the comprehensive quality score of the external information source, which reflects the importance or influence of this external information source in the process of multi-source information fusion. It should be noted that the higher the comprehensive quality score, the better the intelligence quality of this external information source, and the larger the corresponding weighting coefficient.

[0048] It should be noted that different external information sources vary in aspects such as data accuracy, integrity, and timeliness, that is, their qualities are uneven. Determining the weighting coefficient of the corresponding external information source based on the comprehensive quality score can enable the external information source with better quality to have more decision-making weights in the fusion process. Doing this can give full play to the advantages of high-quality information sources and reduce the interference of low-quality information sources on the final result, making the fusion result more reliable and accurate.

[0049] The multi-source information fusion value is a comprehensive value obtained by performing weighted fusion calculation on the count values of each external information source and the corresponding weighting coefficients. It comprehensively considers the determination situations of multiple external information sources and the qualities of each information source, and can comprehensively reflect the overall judgment result of multiple external information sources on the target address information. The multi-source information fusion value is a quantitative indicator used as the basis for finally determining whether the target address information is a malicious address. For example, the larger the multi-source information fusion value obtained through weighted fusion calculation, the higher the possibility that multiple external information sources comprehensively judge the target address information as a malicious address; conversely, the smaller the fusion value, the lower the possibility that the target address information is a malicious address.

[0050] Performing weighted fusion based on the weighting coefficient and the corresponding count values under each external information source can effectively integrate the determination information of multiple external information sources. The count value of each external information source represents its determination situation of the target address information. Through weighted fusion, these determination information can be comprehensively processed according to the quality importance of each information source to obtain a result that can comprehensively reflect the overall judgment of multiple external information sources, that is, the multi-source information fusion value.

[0051] Regarding step 205 above, the malicious address determination result refers to the final judgment conclusion on whether the target address information is a malicious address according to the multi-source intelligence fusion processing method. The malicious address determination result can be "malicious" or "non-malicious", and there may also be some intermediate states, such as "suspicious", depending on the adopted determination criteria and thresholds.

[0052] It should be noted that the multi-source intelligence fusion value is obtained by comprehensively processing the information of multiple external intelligence sources. It takes into account the comprehensive quality scores of different external intelligence sources and their determination results for the target address information. Different intelligence sources may judge the target address from different perspectives, based on different data and algorithms, and the multi-source intelligence fusion value can integrate these scattered and even potentially conflicting information to comprehensively reflect the overall judgment of multiple external intelligence sources on the target address, rather than simply judging according to the majority principle or a single intelligence source.

[0053] Moreover, since the multi-source intelligence fusion value provides a quantitative indicator, it gives a clear numerical basis for the determination of malicious addresses. Compared with the subjective judgment of manual analysis, this quantitative method is more objective and accurate. Reasonable thresholds can be set according to historical data, actual business requirements, etc. When the fusion value is greater than the threshold, it indicates that multiple external intelligence sources have a relatively high confidence that the target address is malicious; conversely, when the fusion value is less than the threshold, it means that the target address is less likely to be malicious. Therefore, through multi-source intelligence fusion, the advantages of each intelligence source can be fully utilized to make up for the deficiencies of a single intelligence source. Different intelligence sources may vary in data coverage, detection technology, update frequency, etc. Some intelligence sources may be more sensitive to certain types of malicious behaviors, while other intelligence sources may perform better in other aspects. By integrating the information of these intelligence sources, the characteristics of the target address can be captured more comprehensively, thereby improving the accuracy of malicious address determination.

[0054] In summary, in the embodiments of the present disclosure, by performing the multi-source intelligence fusion processing method in steps 201 to 205, network threat intelligence data is obtained from internal intelligence sources and external intelligence sources respectively, and then the quality of external intelligence sources is evaluated under different intelligence source quality evaluation dimensions, so that the intelligence quality of each external intelligence source can be accurately evaluated, and a comprehensive quality score corresponding to each external intelligence source is obtained; then, a determination is preferentially made based on the data of the internal intelligence source. When the first network threat intelligence data determines that the target address information is unknown address information, it indicates that the internal intelligence source is difficult to accurately determine the malicious situation of the target address information. Therefore, it is necessary to introduce the data of the external intelligence source for comprehensive judgment. Specifically, first, the determination results of each second network threat intelligence data on the target address information are determined, and different count values are assigned to each external intelligence source based on different determination results, so as to quantify the determination situations of each external intelligence source on the target address information. Then, the weighting coefficient of the corresponding external intelligence source is determined based on the comprehensive quality score, so that the external intelligence source with better quality has more decision-making weight in the fusion process, and also provides a basis for the fusion between different external intelligence sources. Finally, weighted fusion is performed according to the weighting coefficient and the count values corresponding to each external intelligence source, and the multi-source intelligence fusion value obtained can comprehensively represent the determination situations of multiple external intelligence sources on the target address information. Therefore, based on the size of the multi-source intelligence fusion value, the malicious address determination result of the target address information can be accurately obtained. Compared with the solution in the related art that can only be analyzed manually, the embodiments of the present disclosure can not only fuse the data of multiple intelligence sources to achieve automatic comprehensive determination of the target address information without manual intervention, thereby improving the efficiency of malicious address determination, but also cleverly consider the determination situations of the internal intelligence source and the external intelligence source, realizing multi-source determination of malicious addresses driven by the internal intelligence source, thus fully considering the information of different intelligence sources and ultimately improving the recognition accuracy of malicious addresses.

[0055] Next, the further included content in steps 201 to 205 in the embodiments of the present disclosure will be described in detail.

[0056] Please refer to Figure 3 , Figure 3 is Figure 2 The flow diagram further included in step 203 in [reference]. In some embodiments, in the process of assigning different count values to each external intelligence source based on different determination results, steps 301 to 304 may be included: Step 301, determine the first quantity that determines the target address information as malicious address information from the determination results corresponding to each external intelligence source; Step 302, determine the second quantity of the external intelligence source, and determine the determination ratio of the target address information as malicious address information among multiple external intelligence sources according to the first quantity and the second quantity; Step 303: When the determination ratio reaches a preset ratio and the comprehensive quality score of the external information source corresponding to the determined target address information being malicious address information reaches a preset score, determine that the target address information is malicious address information; Step 304: When the determination ratio is lower than the preset ratio, or the comprehensive quality score of the external information source corresponding to the determined target address information being malicious address information is lower than the preset score, assign different count values to each external information source based on different determination results.

[0057] In the above steps, after obtaining the second network threat intelligence data corresponding to the target address information from multiple external information sources, the determination results of these data are statistically analyzed. Here, the determination results include situations such as determining that the target address information is malicious address information or not. The number of external information sources that determine the target address information to be malicious address information is counted, and this number is defined as the first quantity. The second quantity is the total number of all external information sources. Dividing the first quantity by the second quantity, the obtained ratio is the determination ratio of the target address information being malicious address information. For example, assume there are 5 external information sources, namely information source A, information source B, information source C, information source D, information source E, and information source F. Among them, information source A, information source C, and information source D determine the target address information to be malicious address information. Then the first quantity is 3, the second quantity is 6, and the determination ratio is 50%.

[0058] The preset ratio is a threshold set in advance in the embodiments of the present disclosure for judging the determination results of multiple external information sources on the target address information. The preset ratio can be determined according to actual requirements and experience, and is used to measure whether the proportion of external information sources that determine the target address information to be malicious address information among all external information sources has reached a level sufficient to recognize the target address as malicious. The preset score is similar in function to the preset ratio. It is also a threshold set in advance in the embodiments of the present disclosure for measuring the comprehensive quality score of the external information source, and is a value determined according to the expectation of the information source quality and actual application requirements, and is used to judge whether the quality of the external information source that determines the target address information to be malicious address information has reached a certain standard.

[0059] In the embodiments of the present disclosure, two conditions need to be simultaneously satisfied to determine that the target address information is malicious address information. One is that the determination ratio needs to reach the preset ratio set in advance, and the other is that the comprehensive quality score of those external information sources that determine the target address information to be malicious address information also needs to reach a preset score set in advance. When both of these conditions are satisfied, the target address information can be directly determined to be malicious address information.

[0060] It should be noted that when the maliciousness degree of the target address information cannot be accurately confirmed by the internal intelligence source in the embodiments of the present disclosure, it relies on the voting decision of the external intelligence source. The preset ratio set can be understood as the voting ratio. When the determination result corresponding to the external intelligence source can determine that the target address information is malicious address information, it indicates that this external intelligence source votes one vote to support the target address information as malicious address information. In this way, through voting by a sufficient number of external intelligence sources and when the quality of these external intelligence sources is also high enough, it is possible to quickly and accurately determine that the target address information is malicious address information, improving the determination efficiency.

[0061] On the contrary, when the above two conditions cannot be satisfied simultaneously, that is, the determination ratio is lower than the preset ratio or the comprehensive quality score corresponding to the external intelligence source that determines the target address information as malicious address information is lower than the preset score, it is necessary to assign different count values to them according to the different determination results of each external intelligence source, so as to subsequently perform the weighted fusion operation on the external intelligence source data, and further accurately determine the malicious situation of the target address information based on the data of the external intelligence source.

[0062] Please refer to Figure 4 , Figure 4 which is a schematic flowchart of the preset ratio determination process provided by the embodiments of the present disclosure. In some embodiments, the multi-source intelligence fusion processing method may further include steps 401 to 402: Step 401, determine the internal confidence of the internal intelligence source from the first network threat intelligence data; wherein, the value of the internal confidence is between 0 and 1; Step 402, obtain the preset voting ratio adjustment coefficient and the basic voting threshold, determine the difference between 1 and the internal confidence, then obtain the product based on the difference multiplied by the voting ratio adjustment coefficient, and obtain the preset ratio based on the sum of the product and the basic voting threshold.

[0063] In the above steps, the internal confidence is a value that measures the reliability of the internal intelligence source's determination of the target address information, and its value range is between 0 and 1. 0 means that the internal intelligence source's determination of the target address information is completely untrustworthy, and 1 means that the internal intelligence source's determination of the target address information is completely trustworthy. It should be noted that in the embodiments of the present disclosure, this internal confidence can be determined from the first network threat intelligence data obtained from the internal intelligence source through a certain algorithm or evaluation method. For example, the internal confidence can be comprehensively evaluated according to factors such as the historical data accuracy of the internal intelligence source and the reliability of the data source. The embodiments of the present disclosure do not make specific limitations on this.

[0064] The voting ratio adjustment coefficient is a preset coefficient used to adjust the range of calculating the preset ratio based on the internal confidence level. It is a fixed value, and its value affects the size of the preset ratio. The basic voting threshold is also a preset value and is a base value for calculating the preset ratio.

[0065] In the embodiments of the present disclosure, in order to better measure the influence of the internal confidence level of the internal information source on the voting of the external information source, a voting threshold ratio threshold formula is designed: Tvote = (1 - Cinternal) × α + β. Where Tvote is the preset ratio, representing the minimum voting ratio required for the external information source to determine that the target address information is malicious, Cinternal is the internal confidence level, ranging from [0, 1], α represents the voting ratio adjustment coefficient, which can be used to control the influence degree of the internal confidence level on the preset ratio, and β represents the basic voting threshold, ensuring that even when the internal confidence level is a high confidence level, a certain external consensus threshold is still retained.

[0066] It should be noted that determining the preset ratio through such a calculation method is to dynamically adjust the support ratio of the external information source required to determine that the target address information is malicious address information according to the reliability of the internal information source. When the internal confidence level is relatively high, the difference between 1 and the internal confidence level is relatively small, and the calculated preset ratio is relatively low, which means that at this time, the ratio requirement for the external information source to consider the target address information as malicious address information is relatively low because the internal information source itself is relatively reliable; when the internal confidence level is relatively low, the difference is relatively large, and the preset ratio is relatively high, that is, more external information sources need to consider the target address information as malicious address information to determine that the target address information is malicious address information. In this way, a more cautious determination can be made in the case of an unreliable internal information source, improving the accuracy and reliability of the determination.

[0067] For example, setting α = 0.5 means adjusting the influence intensity of the internal confidence level on the preset ratio, and β = 0.3 means the minimum voting ratio, ensuring that even if the internal intelligence is extremely high, at least 30% support from the external information source is required. When the internal information source has a high confidence level (such as Cinternal = 0.9), Tvote = (1 - 0.9) × 0.5 + 0.3 = 0.35, that is, only 35% of the votes from the external information source considering the target address information as malicious are required to confirm that the target address information is malicious address information, thus achieving a quick response. When the internal information source has a low confidence level (such as Cinternal = 0.2), Tvote = (1 - 0.2) × 0.5 + 0.3 = 0.7, then 70% of the malicious votes from the external information source are required to determine the target address information to achieve a cautious decision and reduce the probability of false alarms.

[0068] Further, in the process of executing step 203 in the embodiments of the present disclosure, it is also possible to make a judgment based on the internal confidence level of the internal information source. Specifically, the embodiments of the present disclosure can first obtain the internal confidence level of the internal information source, and only when the internal confidence level meets the threshold requirement (for example, the threshold is T), further judge the determination result of the first network threat intelligence data. That is, only when the internal confidence level meets the threshold requirement and when the first network threat intelligence data determines that the target address information is unknown address information, further determine the determination results of each second network threat intelligence data for the target address information, and assign different count values to each external information source based on different determination results. The subsequent steps will not be elaborated here.

[0069] Please refer to Figure 5 , Figure 5 is Figure 2 a schematic flowchart further included in step 204 in [reference document]. In some embodiments, in the process of determining the weighted coefficient of the corresponding external information source based on the comprehensive quality score, steps 501 to 502 may be included: Step 501, accumulate the comprehensive quality scores under multiple external information sources to obtain the total quality score; Step 502, use the ratio of the comprehensive quality score of each external information source to the total quality score as the weighted coefficient of the corresponding external information source.

[0070] In the above steps, the total quality score refers to the sum obtained by accumulating the comprehensive quality scores under multiple external information sources. In the embodiments of the present disclosure, by dividing the comprehensive quality score of each external information source by the total quality score, the obtained ratio is the weighted coefficient of this external information source. This coefficient reflects the proportion of the quality of this external information source in the total quality of all external information sources. The larger the proportion, the relatively higher the quality of this external information source, and a greater weight should be given in the fusion process.

[0071] In this way, the method of determining the weighted coefficient is based on the principle that the external information source with higher quality should have a greater decision-making weight in multi-source intelligence fusion. By calculating the ratio of the comprehensive quality score to the total quality score, the relative quality of each external information source can be objectively reflected, so as to reasonably allocate its weight in the fusion process, which can make the multi-source intelligence fusion value more accurately reflect the contributions of each external information source and improve the accuracy of the malicious address determination result for the target address information. Therefore, high-quality external information sources play a greater role in the fusion, avoiding the unreasonable influence of external information sources with uneven quality on the result in the fusion process, and finally achieving more reliable malicious address recognition.

[0072] Furthermore, in the weighted fusion process of the embodiments of the present disclosure, only some of the external information sources with higher rankings (such as the first N / 2, that is, after sorting the N external information sources according to the size of the comprehensive quality score, they are in the first half position) are selected according to the comprehensive quality scores under each external information source for subsequent weighted fusion determination.

[0073] For example, if Si represents the i-th external information source, where i represents the code of the external information source with the top N / 2 in the score ranking, and the weighting coefficient of the i-th external information source is Wi. Assuming the comprehensive quality score of the i-th external information source is scorei, then Wi = scorei / sum(scorei). The meaning of this formula is the proportion of the comprehensive quality score of this external information source among the top N / 2 external information sources, and the range of Wi is between 0 and 1.

[0074] When different count values are assigned to each external information source based on different determination results, "malicious" is recorded as 1 point, "non-malicious" is -1 point, "suspicious" is 0.5 point, and "unknown" is 0 point. Then, weighted fusion is performed according to the weighting coefficient and the corresponding count value under each external information source. Multiply the multi-source intelligence fusion value Ai and Wi to obtain the weighted judgment score Sum(Wi * Ai). Specifically, sum up the weighted judgment scores Sum(Wi * Ai) of N / 2 Si. Then, compare Sum(Wi * Ai) with the preset determination thresholds T (including the first determination threshold T1 and the second determination threshold T2, T1 > T2). If Sum(Wi * Ai) >= T1, the final malicious address determination result indicates that the target address information is malicious address information, that is, the result is "malicious"; if Sum(Wi * Ai) < T2, the final malicious address determination result indicates that the target address information is non-malicious address information, that is, the result is "non-malicious"; if Sum(Wi * Ai) >= T2 and Sum(Wi * Ai) < T1, the final malicious address determination result indicates that the target address information is suspicious address information, that is, the result is "suspicious".

[0075] It should be noted that the first determination threshold T1 and the second determination threshold T2 are selected by comprehensively considering the distribution trend of the weighted judgment score Sum(Wi * Ai) and the historically accumulated data. For example, take the historical data samples of "malicious", "non-malicious", and "suspicious" in the historical data. Calculate Sum(Wi * Ai) respectively. Take the minimum value of the weight sum of the "malicious" sample as the first determination threshold T1, and take the maximum value of the weight sum of the "non-malicious" sample as the second determination threshold T2. These two thresholds can continuously learn the historical data dynamically and optimize and adjust in real time.

[0076] Please refer to Figure 6 , Figure 6It is a schematic flowchart further included in the multi-source intelligence fusion processing method provided by an embodiment of the present disclosure. In some embodiments, the multi-source intelligence fusion processing method may further include steps 601 to 602: Step 601, when the first network threat intelligence data determines that the target address information is malicious address information and the internal confidence level of the internal intelligence source is greater than a preset confidence level threshold, determine the determination results of each second network threat intelligence data for the target address information; Step 602, when the determination result under any external intelligence source also determines that the target address information is malicious address information, determine that the target address information is malicious address information.

[0077] In the above steps, the internal confidence level has been mentioned in the previous steps. It is a value determined from the first network threat intelligence data and is used to measure the reliability of the internal intelligence source's determination of the target address information. It will not be elaborated here. The preset confidence level threshold is a preset value and is used as a standard for judging the reliability of the internal intelligence source. When the internal confidence level is greater than this threshold, it is considered that the determination of the target address information by the internal intelligence source is relatively reliable.

[0078] When the first network threat intelligence data determines that the target address information is malicious address information and the internal confidence level of the internal intelligence source is greater than the preset confidence level threshold, the embodiment of the present disclosure can further determine the determination results of each second network threat intelligence data for the target address information, and when the determination result under any external intelligence source also determines that the target address information is malicious address information, determine that the target address information is malicious address information. Thus, on the basis that the internal intelligence source already has a relatively reliable determination (as malicious address information), as long as one external intelligence source also supports this determination, the confidence in this determination can be further enhanced.

[0079] It should be noted that since multiple intelligence sources all point to the same result (the target address information is malicious address information), it indicates that this determination is more likely to be accurate. This helps to quickly and accurately determine that the target address information is malicious address information with the joint support of the internal intelligence source and at least one external intelligence source, improves the efficiency and accuracy of malicious address identification, and avoids the risks that may be brought by over-relying on a single intelligence source.

[0080] In addition, when the internal confidence level of the internal information source is less than the preset confidence level threshold, it is also determined that the determination result is "unknown", so as to avoid the accurate judgment of the malicious degree of the target address information being affected by the low internal confidence level. Therefore, in this case, the determination results of each second network threat intelligence data for the target address information can be determined, and the steps of subsequent step 204 and step 205 can be executed; or, when the first network threat intelligence data determines that the target address information is suspicious address information and the internal confidence level of the internal information source is greater than the preset confidence level threshold, the target address information is suspicious address information. Thus, when the internal confidence level of the internal information source is relatively high, the malicious situation of the target address information can be quickly determined through the internal information source itself; or, when the first network threat intelligence data determines that the target address information is malicious address information and the internal confidence level of the internal information source is greater than the preset confidence level threshold, while multiple external information sources determine that the target address information is non-malicious address information, the target address information is finally determined to be suspicious address information, so as to re-obtain the data of the internal information source and the external information sources subsequently for re-determination.

[0081] Please refer to Figure 7 , Figure 7 is Figure 2 a schematic flow chart further included in step 202 in []. In some embodiments, in the process of performing quality assessment on each external information source under multiple different intelligence source quality assessment dimensions to obtain multiple quality assessment scores and weighting the multiple quality assessment scores to obtain the corresponding quality comprehensive score for each external information source, steps 701 to 702 may be included: Step 701, perform quality assessment on each external information source in terms of intelligence update time, intelligence source confidence level, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability to obtain the intelligence update time score, intelligence source confidence level score, intelligence source comprehensiveness score, intelligence source authority score, and intelligence source stability score for each external information source; Step 702, weight multiple of the intelligence update time score, intelligence source confidence level score, intelligence source comprehensiveness score, intelligence source authority score, and intelligence source stability score to obtain the corresponding quality comprehensive score for each external information source.

[0082] In the above steps, embodiments of the present disclosure can evaluate the quality of each external information source from five different dimensions: information update time, information source confidence, information source comprehensiveness, information source authority, and information source stability. Corresponding evaluation criteria and methods are formulated for each dimension, so as to obtain the respective scores of each external information source under these five dimensions. Different dimensions reflect the quality of the external information source from different aspects. Evaluating from a single dimension cannot comprehensively understand the advantages and disadvantages of the information source. Through evaluations of multiple dimensions, the quality of each external information source can be measured more comprehensively and accurately, providing a more detailed and reliable data basis for subsequent weighted calculations.

[0083] Among them, the information update time is the time situation of the external information source updating its second network threat intelligence data. Timely updated data can reflect the latest network threat situation, which is crucial for identifying malicious addresses; the information source confidence measures the credibility of the intelligence provided by the external information source and is related to the accuracy and reliability of the intelligence; the information source comprehensiveness indicates the range of data covered by the external information source and the breadth of the application scenarios involved. A comprehensive information source can provide richer information for identifying malicious addresses; the information source authority reflects the professional status and influence of the information source in the field of network security. The data of an authoritative information source is more valuable for reference; the information source stability reflects the ability of the external information source to provide stable and reliable intelligence within a certain period of time. A stable information source helps to continuously and accurately identify malicious addresses. The information update time score, the information source confidence score, the information source comprehensiveness score, the information source authority score, and the information source stability score are respectively the quantitative scores obtained after evaluating the quality of each external information source under the above five dimensions, and are used for subsequent calculation of the comprehensive quality score.

[0084] Embodiments of the present disclosure can weight multiple of the information update time score, the information source confidence score, the information source comprehensiveness score, the information source authority score, and the information source stability score to obtain the corresponding comprehensive quality score for each external information source. By calculating the comprehensive quality score through weighting, reasonable comprehensive consideration can be carried out according to the importance of each dimension. For example, any multiple of the information update time score, the information source confidence score, the information source comprehensiveness score, the information source authority score, and the information source stability score can be selected for weighted calculation, such as selecting the information update time score and the information source confidence score, or selecting the information source comprehensiveness score, the information source authority score, and the information source stability score, or selecting all the scores for weighting, which can be set according to actual considerations. The embodiments of the present disclosure do not make specific limitations on this.

[0085] Please refer to Figure 8 , Figure 8 is Figure 7The flow diagram further included in step 701. In some embodiments, in the process of evaluating the quality of each external information source under the information update time, information source confidence, information source comprehensiveness, information source authority, and information source stability, and obtaining the information update time score, information source confidence score, information source comprehensiveness score, information source authority score, and information source stability score for each external information source, the process may include steps 801 to 805: Step 801: Based on the difference between the current time and the update time of each second network threat intelligence data, round down at preset stepped time intervals to determine the corresponding first deduction stepped value, and sequentially deduct the corresponding first deduction stepped value based on the preset initial time score to obtain the information update time score that changes in a stepped manner for each external information source; Step 802: Obtain the external confidence of each external information source, and map the external confidence to the confidence values corresponding to the confidence levels to obtain the information source confidence score for each external information source; Step 803: Rank the multiple external information sources in multiple information source comprehensiveness dimensions to obtain the comprehensiveness ranking, and determine the corresponding second deduction stepped value for each external information source according to the comprehensiveness ranking. Sequentially deduct the corresponding second deduction stepped value based on the preset initial comprehensiveness score to obtain the information source comprehensiveness score that changes in a stepped manner for each external information source; Step 804: Rank the multiple external information sources in multiple information source authority dimensions to obtain the authority ranking, and determine the corresponding third deduction stepped value for each external information source according to the authority ranking. Sequentially deduct the corresponding third deduction stepped value based on the preset initial authority score to obtain the information source authority score that changes in a stepped manner for each external information source; Step 805: Determine the information update frequency, error volatility score, and historical stability score of each external information source, and weight the information update frequency, error volatility score, and historical stability score to obtain the information source stability score for each external information source.

[0086] In the above steps, the preset stepped time interval is a preset time range used to divide different time stages for stepped calculation of the intelligence update time score; the first deduction step value is the deduction value corresponding to each step determined by rounding down the difference between the current time and the intelligence update time according to the preset stepped time interval. The preset initial time score is a set starting score as the basis for calculating the intelligence update time score, and the corresponding deduction step value is deducted according to the time difference subsequently. Specifically, the embodiments of the present disclosure can calculate the difference between the current time and the update time of each second network threat intelligence data, then round down this difference according to the preset stepped time interval to obtain the corresponding first deduction step value, and finally, sequentially deduct this first deduction step value from the preset initial time score to obtain the intelligence update time score that changes step by step under each external information source.

[0087] For example, the intelligence update time score is used to rank the timeliness based on the update times of relevant data of different external information sources that extract the same target address information. The higher the ranking, the higher the score. To better simulate the impact of intelligence timeliness on the score and avoid the smooth transition of linear attenuation, making the score stable within a specific time period and then suddenly decreasing, presenting a stepped change, the embodiments of the present disclosure design a formula. This formula uses the intelligence update time as a variable factor, and the generated score presents a stepped change. The obtained intelligence update time score is , where t represents the difference (in days) between the current time and the update time of each second network threat intelligence data; Smax represents the preset initial time score (such as 100 points), Smin represents the preset score threshold, that is, the lowest score threshold to avoid the score dropping to a negative value (such as 0); k represents the score deducted for each step, such as 20 points deducted for each time interval; Tstep represents the stepped time interval, such as descending one level every 7 days; the symbol represents rounding down to obtain the first deduction step value to ensure that the score remains constant within a specific time period. The time step and the amplitude of score change can be adjusted according to actual needs. When the time difference t = 12 days, (rounding down), the first deduction step value is points, then the intelligence update time score points.

[0088] It should be noted that adopting this method of stepped calculation of the intelligence update time score can more accurately simulate the impact of intelligence timeliness on the score. It avoids the smooth transition problem that may be caused by linear attenuation, makes the score stable within a specific time period and then suddenly decreases, which is more in line with the characteristics of the change in the value of intelligence over time in actual situations, and can more effectively evaluate the quality of external information sources in terms of intelligence update time.

[0089] The external confidence level refers to the credibility of the intelligence provided by each external intelligence source, which may be measured in degrees such as "high, medium, low". The confidence level value is the specific score mapped from the external confidence level and is used to participate in calculating the confidence level score of the intelligence source. Specifically, in the embodiments of the present disclosure, the external confidence levels of each external intelligence source can be obtained, and the external confidence levels are mapped into the confidence level values corresponding to the corresponding confidence degrees to obtain the confidence level scores of the intelligence sources under each external intelligence source.

[0090] For example, the confidence level score of the intelligence source is calculated based on the external confidence level values of the relevant data of different external intelligence sources that extract the same target address information. When the external confidence level is measured in degrees such as "high, medium, low", it can be initialized and mapped to specific scores "90, 60, 10" to participate in the calculation, and the specific values can be dynamically adjusted according to the effects. Suppose there is an external intelligence source B whose external confidence level is evaluated as "medium", and according to the initialized mapping, it is mapped to 60 points. Then the confidence level score of this external intelligence source is 60 points. If it is found that this mapped score is unreasonable according to the actual effects later, it can be adjusted, such as adjusted to 50 points, etc.

[0091] It should be noted that mapping the external confidence level to specific values for calculation can quantify the credibility of the intelligence source, facilitate comprehensive consideration in multi-dimensional quality assessment, and can more intuitively compare the differences in confidence levels of different external intelligence sources, so as to more comprehensively evaluate their quality.

[0092] The comprehensiveness dimensions of multiple intelligence sources are multiple aspects used to measure the comprehensiveness degree of the intelligence sources, such as factors like attack type coverage, geographical coverage range, data dimension richness, etc.; the comprehensiveness ranking is the ranking result obtained after evaluating multiple external intelligence sources in terms of the comprehensiveness dimensions of multiple intelligence sources. The higher the ranking, the more comprehensive the intelligence source; the second deduction ladder value is the deduction value corresponding to each ranking ladder determined according to the comprehensiveness ranking; the preset initial comprehensiveness score is a set starting score, which serves as the basis for calculating the comprehensiveness score of the intelligence source, and the corresponding second deduction ladder value is deducted subsequently according to the ranking. Specifically, in the embodiments of the present disclosure, the comprehensiveness ranking of multiple external intelligence sources can be obtained by ranking them in terms of the comprehensiveness dimensions of multiple intelligence sources, and the second deduction ladder value corresponding to each external intelligence source is determined according to the comprehensiveness ranking. Based on the preset initial comprehensiveness score, the corresponding second deduction ladder value is deducted in sequence to obtain the comprehensiveness score of the intelligence source under each external intelligence source that changes in a stepped manner.

[0093] For example, the comprehensiveness of the intelligence source needs to comprehensively consider factors such as attack type coverage, geographical coverage, and data dimension richness. The measurement score is based on the honey collection lists accumulated in major historical network security protection activities, and the above-mentioned measurement indicators of the intelligence are sequentially counted to rank the intelligence sources. To better simulate the impact of the comprehensiveness ranking of intelligence on the score, a formula is specifically designed. This formula uses the comprehensiveness ranking of intelligence as a variable factor, and the generated score shows a stepped change. The obtained comprehensiveness score of the intelligence source is , where R represents the comprehensiveness ranking of the intelligence source (the smaller the more comprehensive), Smax represents the preset initial comprehensiveness score, that is, the preset highest score (such as 100 points), Smin represents the preset lowest score, such as 0, k represents the score reduction for each ranking step, such as a deduction of 10 points for each step down, Nstep represents the step width, such as dividing a step for every 2 rankings, and the symbol represents rounding down to ensure that the score is fixed within each ranking interval to obtain the second score deduction step value. For example, the scores are quantified by the formula according to the ranking as {External Intelligence Source 1: 100 points, External Intelligence Source 2: 95 points, External Intelligence Source 3: 90 points, External Intelligence Source 4: 85 points}. At this time, Nstep = 1, k = 5, and taking the External Intelligence Source 3 ranked 3rd as an example, , the second score deduction step value is 5 * 2 = 10 points, and the comprehensiveness score of the intelligence source = 100 - 10 = 90 points, and so on.

[0094] It should be noted that through this stepped calculation method based on the comprehensiveness ranking, it can more accurately reflect the impact of the differences in the comprehensiveness of the intelligence source on the score, avoid the irrationality that may be brought by simple linear ranking calculation, make the score relatively stable within each ranking interval, and be more in line with the difference characteristics of the comprehensiveness of different intelligence sources in the actual situation, so as to more effectively evaluate the quality of external intelligence sources in terms of comprehensiveness.

[0095] Multiple dimensions of information source authority are used to measure multiple aspects of the authority degree of information sources, such as traffic and ranking, reputation and security, industry certification and citation, community trust, etc.; the authority ranking is the ranking result obtained after evaluating multiple external information sources under multiple dimensions of information source authority, and the higher the ranking, the more authoritative the information source; the third deduction ladder value is the deduction value corresponding to each ranking ladder determined according to the authority ranking; the preset initial authority score is a set starting score, which serves as the basis for calculating the authority score of the information source, and then the corresponding deduction ladder value is deducted according to the ranking. Specifically, the embodiments of the present disclosure can rank multiple external information sources under multiple dimensions of information source authority to obtain the authority ranking, and determine the third deduction ladder value corresponding to each external information source according to the authority ranking, and sequentially deduct the corresponding third deduction ladder value based on the preset initial authority score to obtain the information source authority score that changes in a stepped manner for each external information source.

[0096] For example, the information source authority ranking can be obtained by comprehensively evaluating the rankings of multiple authority measurement websites. It can be considered from multiple dimensions such as its traffic and ranking, reputation and security, industry certification and citation, community trust, etc. For example, for a network platform that provides website and application rankings and competitive data analysis, check the domain name registration history and age, identify newly registered suspicious domain names, and whether it is listed in the reliable site security alliance whitelist by the official or security community. Then, after considering these items separately, the final comprehensive ranking result can be obtained. To better simulate the influence of the information source authority ranking on the score, the formula design in the above process of determining the information source comprehensiveness score and the information update time score can be followed. The difference is that the information source authority ranking is used as a variable factor, and the generated score shows a stepped change, which will not be elaborated here. Among them, in the process of determining the information source full-dimensional score, R represents the information source authority ranking (the smaller the more authoritative), Smax represents the preset initial authority score at this time, that is, the highest score, such as 100 points, Smin represents the lowest score, such as 0, k represents the score reduction value for each ranking step, such as deducting 10 points for each step down, and Nstep represents the step width, such as dividing a step for every 10 rankings to ensure that the score is fixed within each ranking interval to obtain the third deduction ladder value.

[0097] It should be noted that adopting this stepped calculation method based on the authority ranking can more accurately reflect the influence of the differences in the authority degree of information sources on the score, avoid the deficiencies of simple linear ranking calculations, make the score more reasonably reflect the authority quality of the information source, and provide a more reliable evaluation basis for multi-source information fusion processing.

[0098] The intelligence update frequency refers to the frequency at which an external intelligence source updates its cyber threat intelligence data; the error volatility score is a score that quantifies the error fluctuation of the intelligence source by the standard deviation of the changes in the false alarm rate and the miss rate. An intelligence source with less fluctuation has a higher score; the historical stability score is a score that reflects the historical stability of the intelligence source obtained by evaluating the fluctuation range and consistency of historical data. An intelligence source with less fluctuation has a higher score. Specifically, embodiments of the present disclosure can determine the intelligence update frequency, error volatility score, and historical stability score of each external intelligence source, and weight the intelligence update frequency, error volatility score, and historical stability score to obtain the intelligence source stability score for each external intelligence source.

[0099] For example, the intelligence source stability score comprehensively measures the persistence and consistency of the intelligence source over a period of time, including the consistency of the update frequency, historical stability, error volatility, etc. The quantification method of the update frequency consistency is quantified by calculating the standard deviation. An intelligence source with less fluctuation in the update frequency gets a high score. The error volatility is quantified by the standard deviation of the changes in the false alarm rate and the miss rate. An intelligence source with less fluctuation gets a high score. The historical stability is obtained by evaluating the fluctuation range and consistency of historical data. An intelligence source with less fluctuation gets a high score. The scores of these sub-items are weighted and summed and normalized to obtain the intelligence source stability score.

[0100] It should be noted that calculating the intelligence source stability score by comprehensively considering the intelligence update frequency, error volatility, and historical stability can more comprehensively measure the persistence and consistency of the external intelligence source over a period of time. By combining these factors through weighting and normalization, a score that more accurately reflects the stability of the intelligence source can be obtained, thereby providing a more reliable quality assessment basis for multi-source intelligence fusion processing.

[0101] Please refer to Figure 9 , Figure 9 is Figure 2 The process schematic diagram further included in step 201 in . In some embodiments, in the process of obtaining the first cyber threat intelligence data corresponding to the target address information from the internal intelligence source and the second cyber threat intelligence data corresponding to the target address information from multiple external intelligence sources respectively, steps 901 to 903 may be included: Step 901, obtain multiple different types of preset fields from the internal intelligence source and multiple external intelligence sources respectively; Among them, the preset fields include information source field, malicious degree field, intelligence threat type field, intelligence threat degree field, confidence level field; Step 902, perform data cleaning and formatting processing on the preset fields of the same type to obtain multiple target fields after data cleaning and formatting processing; Step 903: Obtain the first network threat intelligence data based on multiple target fields corresponding to the internal intelligence source, and obtain the corresponding second network threat intelligence data based on multiple target fields corresponding to each external intelligence source.

[0102] In the above steps, embodiments of the present disclosure can obtain multiple different types of preset fields from intelligence sources such as internal intelligence sources and multiple external intelligence sources, such as information source (source) fields, maliciousness (malicious) fields, threat type (threat_type) fields, threat level (threat_level) fields, confidence level (confidence_level) fields, etc. Then, data cleaning and formatting processing are performed on the preset fields of the same type to obtain multiple target fields after data cleaning and formatting processing. The goal is to format these keyword fields into a unified data structure, including standardized field names and standardized field values, to ensure that threat intelligence information obtained from different data sources undergoes consistent processing and has the same data structure.

[0103] For example, for the maliciousness field, finally, different intelligence sources will consistently map the fields related to maliciousness to the malicious field, and its field values are standardized and mapped to (malicious, suspicious, unknown, non-malicious). This consistent data structure provides a consistent data basis for subsequent analysis and determination.

[0104] Finally, embodiments of the present disclosure obtain the first network threat intelligence data based on multiple target fields corresponding to the internal intelligence source, and obtain the corresponding second network threat intelligence data based on multiple target fields corresponding to each external intelligence source, so as to perform processing and analysis based on the network threat intelligence data under different intelligence sources subsequently.

[0105] Please refer to Figure 10 , Figure 10 is Figure 2 The schematic flowchart further included after step 205 in . In some embodiments, after determining the malicious address determination result of the target address information based on the magnitude of the multi-source intelligence fusion value, the multi-source intelligence fusion processing method may further include steps 1001 to 1003: Step 1001: Receive an intelligence sharing request from the target terminal; Step 1002: Analyze the intelligence sharing request, determine the sharing permission of the target terminal, and select the shared information from the first network threat intelligence data, the second network threat intelligence data, and the malicious address determination result based on the sharing permission; Step 1003: Send the shared information to the target terminal.

[0106] In the above steps, the target terminal is the device terminal that initiates the intelligence sharing request, which may be a personal computer, a server, a mobile device, etc. It hopes to obtain network threat intelligence data related to the target address information, malicious address determination results, and other information; the intelligence sharing request is a request instruction sent by the target terminal to the current system, used to express its willingness to obtain relevant network threat intelligence, malicious address determination results, and other information.

[0107] The sharing permission is a permission setting that limits the scope and level of intelligence information that the target terminal can obtain. Different target terminals may have different sharing permissions. For example, some terminals may only be able to obtain the second network threat intelligence data of some external intelligence sources, while some terminals may be able to obtain the complete malicious address determination results, etc. Specifically, the embodiments of the present disclosure can parse the received intelligence sharing request, extract the information related to the target terminal therein, and then determine the sharing permission of the target terminal according to the preset permission rules and information such as the identity of the target terminal.

[0108] Finally, the embodiments of the present disclosure can, according to the sharing permission, screen out the sharing information that the target terminal has the right to obtain from the first network threat intelligence data, the second network threat intelligence data, and the malicious address determination results owned by the system, and send the sharing information to the target terminal, providing the fused multi-source intelligence for the target terminal of the third party, so that it can perform multi-dimensional statistical analysis on the threat intelligence data, thereby ensuring the security and reasonable use of the intelligence information. Since different terminals may have different usage requirements and security levels, by setting the sharing permission, the leakage of sensitive information can be avoided, and at the same time, each terminal can obtain useful intelligence information that matches its permission, realizing the effective sharing and management of intelligence.

[0109] Furthermore, the embodiments of the present disclosure can also provide a channel for the target terminal of the sharing to feedback and correct the accuracy of the intelligence data. In the process of multi-source intelligence fusion processing, due to involving multiple intelligence sources, the data quality of different intelligence sources is uneven, and the situation of network threats is also constantly changing, so the intelligence data may be inaccurate. Therefore, a feedback mechanism is needed to enable the users or relevant systems using these intelligence data to feedback the discovered inaccurate information to the system. The feedback entity can be the target terminal that receives the intelligence sharing information, and the feedback method can be various. For example, through the special feedback interface provided by the system, fill in the feedback information, including the target address information, the description of the discovered problem, the actual situation, etc.; it can also be feedback through email, message push, etc.

[0110] After the system receives the feedback information, it is necessary to analyze and process the feedback content. First, verify the authenticity and reliability of the feedback information. For example, the existence of the problem in the feedback can be confirmed by further querying data from other intelligence sources, analyzing historical data, etc. If it is confirmed that there are accuracy problems in the intelligence data, the relevant intelligence data needs to be corrected. For the first network threat intelligence data (internal intelligence source), the internal intelligence database can be updated and corrected according to the feedback information; for the second network threat intelligence data (external intelligence source), the feedback information can be fed back to the corresponding external intelligence source to prompt it to correct the data. At the same time, the system itself can also mark or adjust the data of the external intelligence source according to the situation. By continuously receiving feedback and making corrections, the system can gradually reduce errors and biases in the intelligence data, making the subsequent malicious address determination more accurate and reliable.

[0111] Further, please refer to Figure 11 , Figure 11 which is a schematic diagram of the multi-source intelligence fusion processing system provided by the embodiments of the present disclosure. The embodiments of the present disclosure also provide a multi-source intelligence fusion processing system (hereinafter referred to as the system), which can execute the multi-source intelligence fusion processing method in the above embodiments. The system is composed of a multi-source heterogeneous intelligence data acquisition module, a multi-source heterogeneous intelligence data fusion module, and a fusion intelligence sharing module. Among them, the multi-source heterogeneous intelligence data acquisition module is composed of a generation sub-module of the internal intelligence source and a collection sub-module of the external intelligence source; the multi-source heterogeneous intelligence data fusion module is composed of a multi-source IP threat intelligence information processing sub-module, an intelligence source quality assessment and quantification sub-module, and an IP threat intelligence fusion determination sub-module, aiming to obtain higher-quality and more comprehensive threat intelligence, thereby improving the accuracy of malicious address identification.

[0112] Next, a detailed description will be given in combination with the multi-source intelligence fusion processing method and the application of the multi-source intelligence fusion processing method in the multi-source intelligence fusion processing system: (1) The multi-source heterogeneous intelligence acquisition module is composed of a generation sub-module of the internal intelligence source and a collection sub-module of the external intelligence source. This module parallelly and real-timely acquires commercial intelligence information and generates internal intelligence information through an automated method, ensuring the rapid acquisition of comprehensive threat intelligence information.

[0113] Among them, the internal intelligence source generation sub-module first collects the original honey collection logs from the four honey devices (such as honey points, honey courts, honey arrays, and honey holes) in large-scale network security protection activities, and then retains the key information such as the timestamp, honey collection IP, honey collection type, honey collection behavior, attack behavior, port, and honey collection times in the logs, and removes other messy noises and redundant data; finally, it is converted into a unified format of internal intelligence and stored in the database for subsequent multi-source heterogeneous intelligence data fusion processing. The intelligence sources of the external intelligence source collection sub-module are generally provided in the form of Application Programming Interface (API interface). This sub-module first sets up a multi-source intelligence interface list that can be continuously updated. This list contains all the field information required for interface requests, such as the interface address, request token, request content format, and request parameters of each intelligence source. This list supports on-demand updates to adapt to newly added API-based intelligence sources in a timely manner. Secondly, when an intelligence query needs to be performed on an IP, the system will automatically trigger the collection module to execute, and this module will automatically call all intelligence source API interfaces to obtain threat intelligence.

[0114] (2) The multi-source heterogeneous intelligence data fusion module is used to perform information processing, intelligence source quality assessment and quantification, fusion determination, and normalized storage on the data obtained by the multi-source heterogeneous intelligence acquisition module, and generate multi-source fusion intelligence. It includes a multi-source IP threat intelligence information processing sub-module, an intelligence source quality assessment and quantification sub-module, and an IP threat intelligence fusion determination sub-module.

[0115] The multi-source IP threat intelligence information processing sub-module mainly extracts key fields from N external intelligence sources and internal intelligence sources, including information source (source), maliciousness (malicious), threat type (threat_type), threat level (threat_level), confidence level (confidence_level), etc. Its goal is to format these key fields into a unified data structure (standardized field names and standardized field values) to ensure that the threat intelligence information obtained from different data sources undergoes consistent processing and has the same data structure.

[0116] The intelligence source quality assessment and quantification sub-module is a process of comprehensively considering multi-dimensional factors such as intelligence update time, intelligence source confidence, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability and quantifying them with scores. The scores corresponding to the consideration of intelligence update time, intelligence source confidence, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability have been described in the above embodiments and will not be elaborated here.

[0117] The IP threat intelligence fusion and determination sub-module takes the internal intelligence source as the benchmark and collaborates with other mainstream external intelligence sources, namely N mainstream external intelligence sources, to make comprehensive threat determinations. The specific number of external intelligence sources can be adjusted according to the actual situation. Please refer to Figure 12 , Figure 12 which is a complete schematic diagram of the determination process provided by the embodiments of the present disclosure. The determination process is as follows: (2.1) Quick malicious determination based on internal confidence; For the IP to be detected, when the internal intelligence source marks the IP as malicious, the system makes a dynamic decision by combining the internal confidence and the determination results of the external intelligence sources. Subsequently, the internal confidence is calculated first. When the internal confidence >= the preset determination threshold T, if any external intelligence source also determines it to be malicious, then the IP is determined to be malicious through fusion and the blocking is immediately triggered; if none of the external intelligence sources determine it to be malicious, that is, all are "non-malicious", then the IP is determined to be suspicious through fusion and enters continuous monitoring and behavior baseline analysis; if the internal confidence < T, it is tentatively marked as "unknown" first and enters the process of 2.2.

[0118] Among them, the calculation of the internal confidence comprehensively considers various indicators (number of honey stepping times, attack type, attack behavior, timeliness, consistency between internal and external intelligence, etc.), quantifies them with weights, and the weights can be dynamically adjusted through machine learning algorithm training based on historical data. Finally, a comprehensive score is obtained and normalized to ensure that the internal confidence is within the range of [0,1]. The threshold T can continuously learn historical data dynamically and optimize the adjustment in real time.

[0119] (2.2) Voting mechanism of external intelligence sources; If the internal intelligence determines that the malicious determination of the IP is "unknown", then it relies on the voting decision of the external intelligence sources: count the proportion of malicious votes of external manufacturers. If the proportion of malicious votes exceeds Tvote (voting threshold proportion threshold, such as N / 2) and the intelligence source quality score is relatively high, then it is determined to be malicious. If the proportion of malicious votes is less than Tvote, then it enters step 2.3 to further make a comprehensive determination by combining high-quality intelligence sources.

[0120] In the embodiments of the present disclosure, in order to better measure the influence of the internal confidence of the internal intelligence source on the voting of the external intelligence sources, a voting threshold proportion threshold formula is designed: Tvote = (1 - Cinternal) × α + β. Where Tvote is the preset proportion, representing the minimum voting proportion required for the external intelligence source to determine that the target address information is malicious, Cinternal is the internal confidence, with a range of [0,1], α represents the voting proportion adjustment coefficient, which can be used to control the influence degree of the internal confidence on the preset proportion, and β represents the basic voting threshold, ensuring that even when the internal confidence is at a high confidence level, a certain external consensus threshold is still retained.

[0121] (2.3) Weighted fusion determination of high-quality intelligence sources; When the voting result ratio is insufficient, the top N / 2, that is, the top 50% of commercial intelligence manufacturers in terms of the scores quantified by the intelligence source quality assessment and quantification sub-module are selected, and at this time, their weighted fusion judgment results are taken. Further, in the weighted fusion process of the embodiments of the present disclosure, only some external intelligence sources ranked in the front (such as the first N / 2, that is, after sorting the N external intelligence sources according to the size of the comprehensive quality scores, located in the first half position) are selected according to the comprehensive quality scores of each external intelligence source for subsequent weighted fusion judgment.

[0122] For example, if Si represents the i-th external intelligence source, where i represents the code of the external intelligence source ranked in the top N / 2 in terms of scores, the weighting coefficient of the i-th external intelligence source is Wi. If the comprehensive quality score of the i-th external intelligence source is scorei, then Wi = scorei / sum(scorei) can be obtained. The meaning of this formula is the proportion of the comprehensive quality score of this external intelligence source among the top N / 2 external intelligence sources, and the range of Wi is between 0 and 1.

[0123] When different count values are assigned to each external intelligence source based on different judgment results, the "malicious" is recorded as 1 point, the "non-malicious" is -1 point, the "suspicious" is 0.5 point, and the "unknown" is 0 point. Then, weighted fusion is performed according to the weighting coefficient and the corresponding count values of each external intelligence source. Multiply Ai and Wi to obtain the weighted judgment score Sum(Wi * Ai). Specifically, summarize the weighted judgment scores Sum(Wi * Ai) of N / 2 Si, and then compare Sum(Wi * Ai) with the preset judgment thresholds T (including the first judgment threshold T1 and the second judgment threshold T2, T1 > T2). If Sum(Wi * Ai) >= T1, the final malicious address judgment result indicates that the target address information is malicious address information, that is, the result is "malicious"; if Sum(Wi * Ai) < T2, the final malicious address judgment result indicates that the target address information is non-malicious address information, that is, the result is "non-malicious"; if Sum(Wi * Ai) >= T2 and Sum(Wi * Ai) < T1, the final malicious address judgment result indicates that the target address information is suspicious address information, that is, the result is "suspicious".

[0124] It should be noted that the first determination threshold T1 and the second determination threshold T2 are selected by comprehensively considering the distribution trend of the weighted judgment score Sum(Wi*Ai) and the historically accumulated data. For example, for the three types of historical samples of "malicious", "non-malicious", and "suspicious" in the historical data samples, calculate Sum(Wi*Ai) respectively. Take the minimum value of the weight sum of the "malicious" samples as the first determination threshold T1, and take the maximum value of the weight sum of the "non-malicious" samples as the second determination threshold T2. These two thresholds can continuously learn historical data dynamically and optimize and adjust in real time.

[0125] (3) The fusion intelligence sharing module opens and shares the capabilities and data of the threat intelligence platform, provides multi-source intelligence after fusion for a third party (target terminal), conducts multi-dimensional statistical analysis on the threat intelligence data, and at the same time provides a channel for feedback and correction of the accuracy of the intelligence data. In addition, different access rights and flow limiting strategies are provided for callers with different trust levels.

[0126] Finally, the multi-source intelligence fusion processing system in the embodiments of the present disclosure performs comprehensive threat determination by executing the multi-source intelligence fusion method, taking the internal intelligence source as the benchmark, collaborating with other external intelligence sources. The internal intelligence is generated in combination with the most actual threats of the defense unit. Finally, from the perspective of external intelligence, a comprehensive threat determination is formed to form an effective IP ban. It solves the problem of ignoring the internal intelligence source when determining the IP threat of multi-source intelligence, and also overcomes the drawback of the need for manual analysis due to the differences in intelligence sources. In addition, it provides an innovative reference method for generating high-quality comprehensive threat intelligence, and also proposes a quality assessment and quantification method for the threat intelligence data source, that is, the weighted scoring model. This method comprehensively considers multi-dimensional factors such as intelligence update time, intelligence source confidence, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability and scientifically quantifies them with specific scores.

[0127] Please refer to Figure 13 , the embodiments of the present disclosure also provide a multi-source intelligence fusion processing device that can implement the above multi-source intelligence fusion processing method. The multi-source intelligence fusion processing device includes: A data acquisition module 1301, configured to acquire target address information to be detected, acquire first network threat intelligence data corresponding to the target address information from an internal intelligence source, and acquire second network threat intelligence data corresponding to the target address information from multiple external intelligence sources respectively; A quality assessment module 1302, configured to perform quality assessment on each external intelligence source under multiple different intelligence source quality assessment dimensions, obtain multiple quality assessment scores, and weight the multiple quality assessment scores to obtain a quality comprehensive score corresponding to each external intelligence source; The preliminary determination module 1303 is configured to, when the first network threat intelligence data determines that the target address information is unknown address information, determine the determination results of each second network threat intelligence data on the target address information, and assign different count values to each external intelligence source based on different determination results; The multi-source fusion module 1304 is configured to determine the weighting coefficient of the corresponding external intelligence source based on the comprehensive quality score, and perform weighted fusion according to the weighting coefficient and the corresponding count values under each external intelligence source to obtain a multi-source intelligence fusion value; The malicious determination module 1305 is configured to determine the malicious address determination result of the target address information based on the magnitude of the multi-source intelligence fusion value.

[0128] In summary, the multi-source intelligence fusion processing device executes the multi-source intelligence fusion processing method in the above embodiments. By obtaining network threat intelligence data from internal intelligence sources and external intelligence sources respectively, and then evaluating the quality of external intelligence sources under different intelligence source quality evaluation dimensions, the intelligence quality of each external intelligence source can be accurately evaluated, and the corresponding comprehensive quality score of each external intelligence source can be obtained. Then, the determination is preferentially based on the data of the internal intelligence source. When the first network threat intelligence data determines that the target address information is unknown address information, it indicates that the internal intelligence source is difficult to accurately determine the malicious situation of the target address information. Therefore, it is necessary to introduce the data of the external intelligence source for comprehensive judgment. Specifically, first determine the determination results of each second network threat intelligence data on the target address information, and assign different count values to each external intelligence source based on different determination results, so as to quantify the determination situations of each external intelligence source on the target address information. Then, determine the weighting coefficient of the corresponding external intelligence source based on the comprehensive quality score, so that the external intelligence source with better quality has more decision-making weight in the fusion process, and also provides a basis for the fusion between different external intelligence sources. Finally, perform weighted fusion according to the weighting coefficient and the corresponding count values under each external intelligence source, and the obtained multi-source intelligence fusion value can comprehensively represent the determination situations of multiple external intelligence sources on the target address information. Therefore, based on the magnitude of the multi-source intelligence fusion value, the malicious address determination result of the target address information can be accurately obtained. Compared with the related art where only manual analysis can be performed, the embodiments of the present disclosure can not only fuse the data of multiple intelligence sources to achieve automatic comprehensive determination of the target address information without manual intervention, thereby improving the efficiency of malicious address determination, but also cleverly consider the determination situations of internal intelligence sources and external intelligence sources, realizing multi-source determination of malicious addresses driven by internal intelligence sources, thus fully considering the information of different intelligence sources and finally improving the recognition accuracy of malicious addresses.

[0129] The specific implementation of the multi-source intelligence fusion processing device is basically the same as the specific embodiments of the above multi-source intelligence fusion processing method, and will not be elaborated here. On the premise of meeting the requirements of the embodiments of the present disclosure, other functional modules may be provided in the multi-source intelligence fusion processing device to implement the multi-source intelligence fusion processing method in the above embodiments.

[0130] The embodiments of the present disclosure also provide an electronic device, which includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the above multi-source intelligence fusion processing method is implemented. The electronic device may be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0131] Please refer to Figure 14 , Figure 14 which illustrates the hardware structure of an electronic device in another embodiment. The electronic device includes: A processor 1401, which can be implemented by using a general-purpose CPU (Central Processing Unit, central processor), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, etc., and is used to execute relevant programs to implement the technical solutions provided by the embodiments of the present disclosure; A memory 1402, which can be implemented in the form of a read-only memory (ReadOnly Memory, ROM), a static storage device, a dynamic storage device, or a random access memory (Random Access Memory, RAM), etc. The memory 1402 can store an operating device and other application programs. When implementing the technical solutions provided by the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 1402, and the processor 1401 is called to execute the multi-source intelligence fusion processing method of the embodiments of the present disclosure; An input / output interface 1403, which is used to implement information input and output; A communication interface 1404, which is used to implement communication interaction between this device and other devices, and can implement communication through a wired method (such as USB, network cable, etc.) or through a wireless method (such as a mobile network, WIFI, Bluetooth, etc.); A bus 1405, which transmits information between various components of the device (such as the processor 1401, the memory 1402, the input / output interface 1403, and the communication interface 1404); Among them, the processor 1401, the memory 1402, the input / output interface 1403, and the communication interface 1404 are communicatively connected to each other inside the device through the bus 1405.

[0132] An embodiment of the present disclosure also provides a computer-readable storage medium storing a computer program, which when executed by a processor implements the above multi-source intelligence fusion processing method.

[0133] As a non-transitory computer-readable storage medium, a memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0134] The embodiments described in the embodiments of the present disclosure are for more clearly illustrating the technical solutions of the embodiments of the present disclosure, and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those skilled in the art will know that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present disclosure are equally applicable to similar technical problems.

[0135] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present disclosure, and may include more or fewer steps than those shown in the figures, or combine some steps, or different steps.

[0136] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] Those of ordinary skill in the art can understand that all or some of the steps in the above-disclosed methods, and the functional modules / units in the devices and equipment, can be implemented as software, firmware, hardware, and appropriate combinations thereof.

[0138] The terms "first", "second", "third", "fourth", etc. (if any) in the description of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product or device comprising a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0139] It should be understood that in the present disclosure, "at least one (item)" means one or more, and "a plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that there can be three relationships. For example, "A and / or B" can mean: only A exists, only B exists, and both A and B exist at the same time. Among them, A and B can be singular or plural. The character " / " generally means that the associated objects before and after are in an "or" relationship. "At least one (one) of the following" or its similar expression means any combination of these items, including any combination of single item (one) or plural items (ones). For example, at least one (one) of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0140] In several embodiments provided by the present disclosure, it should be understood that the disclosed apparatus and method can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the above-mentioned division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another apparatus, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection to each other can be through some interfaces. The indirect coupling or communication connection of the apparatus or unit can be in an electrical, mechanical or other form.

[0141] The units described above as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place, or they can be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] In addition, in each of the embodiments of the present disclosure, each functional unit may be integrated into one processing unit, may exist separately as individual physical units, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0143] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present disclosure. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical discs that can store programs.

[0144] The preferred embodiments of the embodiments of the present disclosure have been described above with reference to the accompanying drawings. However, this does not limit the scope of the rights of the embodiments of the present disclosure. Any modifications, equivalent replacements, and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present disclosure shall fall within the scope of the rights of the embodiments of the present disclosure.

Claims

1. A multi-source intelligence fusion processing method, characterized in that: include: Acquire target address information to be detected, and acquire first network threat intelligence data corresponding to the target address information from an internal intelligence source, and acquire second network threat intelligence data corresponding to the target address information from multiple external intelligence sources respectively; Performing a quality assessment on each of the external intelligence sources under a plurality of different intelligence source quality assessment dimensions to obtain a plurality of quality assessment scores, and weighting the plurality of quality assessment scores to obtain a comprehensive quality score corresponding to each of the external intelligence sources; When the first network threat intelligence data determines that the target address information is unknown address information, determining the determination results of each of the second network threat intelligence data on the target address information, and assigning different count values ​​to each of the external intelligence sources based on the different determination results; Determine the weighting coefficient of the corresponding external intelligence source based on the comprehensive quality score, and perform weighted fusion according to the weighting coefficient and the corresponding count value under each external intelligence source to obtain a multi-source intelligence fusion value; The malicious address determination result of the target address information is determined based on the size of the multi-source intelligence fusion value.

2. The multi-source intelligence fusion processing method according to claim 1 is characterized in that: The allocating different count values ​​to each of the external intelligence sources based on different determination results includes: Determine a first quantity of the target address information as malicious address information from the determination results corresponding to each of the external intelligence sources; Determine a second number of the external intelligence sources, and determine a proportion of the target address information determined to be the malicious address information among the plurality of the external intelligence sources according to the first number and the second number; When the determination ratio reaches a preset ratio, and the quality comprehensive score corresponding to the external intelligence source that determines that the target address information is the malicious address information reaches a preset score, the target address information is determined to be the malicious address information; When the judgment ratio is lower than the preset ratio, or the comprehensive quality score corresponding to the external intelligence source that judges the target address information as malicious address information is lower than the preset score, different counting values ​​are assigned to each external intelligence source based on different judgment results.

3. The multi-source intelligence fusion processing method according to claim 2 is characterized in that: The multi-source intelligence fusion processing method also includes: Determining an internal confidence level of the internal intelligence source from the first network threat intelligence data, wherein the internal confidence level has a value between 0 and 1; Obtain a preset voting ratio adjustment coefficient and a basic voting threshold, determine the difference between 1 and the internal confidence, multiply the difference by the voting ratio adjustment coefficient to obtain a product, and obtain the preset ratio based on the sum of the product and the basic voting threshold.

4. The multi-source intelligence fusion processing method according to claim 1 is characterized in that: The determining of the corresponding weighting coefficient of the external intelligence source based on the comprehensive quality score includes: Accumulate the comprehensive quality scores of multiple external intelligence sources to obtain a total quality score; The ratio of the comprehensive quality score of each external intelligence source to the total quality score is used as the weighting coefficient of the corresponding external intelligence source.

5. The multi-source intelligence fusion processing method according to claim 1 is characterized in that: The multi-source intelligence fusion processing method also includes: When the first network threat intelligence data determines that the target address information is malicious address information, and the internal confidence of the internal intelligence source is greater than a preset confidence threshold, determining the determination results of each of the second network threat intelligence data on the target address information; When the determination result under any one of the external intelligence sources also determines that the target address information is the malicious address information, it is determined that the target address information is the malicious address information.

6. The multi-source intelligence fusion processing method according to claim 1 is characterized in that: The step of performing quality assessment on each of the external intelligence sources under multiple different intelligence source quality assessment dimensions to obtain multiple quality assessment scores, and weighting the multiple quality assessment scores to obtain a comprehensive quality score corresponding to each of the external intelligence sources, includes: Performing a quality assessment on each of the external intelligence sources based on intelligence update time, intelligence source confidence, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability, to obtain an intelligence update time score, an intelligence source confidence score, an intelligence source comprehensiveness score, an intelligence source authority score, and an intelligence source stability score for each of the external intelligence sources; Multiple of the intelligence update time score, the intelligence source confidence score, the intelligence source comprehensiveness score, the intelligence source authority score and the intelligence source stability score are weighted to obtain a comprehensive quality score corresponding to each of the external intelligence sources.

7. The multi-source intelligence fusion processing method according to claim 6 is characterized in that: The quality assessment of each external intelligence source is performed based on intelligence update time, intelligence source confidence, intelligence source comprehensiveness, intelligence source authority, and intelligence source stability to obtain an intelligence update time score, intelligence source confidence score, intelligence source comprehensiveness score, intelligence source authority score, and intelligence source stability score for each external intelligence source, including: Based on the difference between the current time and the update time of each of the second network threat intelligence data, the corresponding first deduction step value is rounded down according to the preset step time interval, and the corresponding first deduction step value is deducted in sequence based on the preset initial time score to obtain the intelligence update time score that changes in a step-by-step manner under each of the external intelligence sources; Obtaining the external confidence of each of the external intelligence sources, and mapping the external confidence to a confidence value of a corresponding confidence level, to obtain an intelligence source confidence score under each of the external intelligence sources; Ranking the plurality of external intelligence sources under the dimensions of the comprehensiveness of the plurality of intelligence sources to obtain a comprehensiveness ranking, and determining the second deduction step value corresponding to each of the external intelligence sources according to the comprehensiveness ranking, and deducting the corresponding second deduction step value in sequence based on the preset initial comprehensiveness score to obtain a step-by-step intelligence source comprehensiveness score for each of the external intelligence sources; Ranking the plurality of external intelligence sources under the plurality of intelligence source authority dimensions to obtain an authority ranking, and determining the third deduction step value corresponding to each of the external intelligence sources according to the authority ranking, and deducting the corresponding third deduction step value in sequence based on the preset initial authority score to obtain an intelligence source authority score that changes in a step-by-step manner under each of the external intelligence sources; Determine the intelligence update frequency, error volatility score and historical stability score of each of the external intelligence sources, and weight the intelligence update frequency, error volatility score and historical stability score to obtain the intelligence source stability score for each of the external intelligence sources.

8. The multi-source intelligence fusion processing method according to claim 1 is characterized in that: The obtaining of first network threat intelligence data corresponding to the target address information from an internal intelligence source, and obtaining second network threat intelligence data corresponding to the target address information from multiple external intelligence sources respectively, include: Acquire multiple different types of preset fields from the internal intelligence source and multiple external intelligence sources respectively, wherein the preset fields include an information source field, a maliciousness level field, an intelligence threat type field, an intelligence threat level field, and a confidence level field; Performing data cleaning and formatting processing on the preset fields of the same type to obtain a plurality of target fields after data cleaning and formatting processing; The first network threat intelligence data is obtained based on the multiple target fields corresponding to the internal intelligence source, and the corresponding second network threat intelligence data is obtained based on the multiple target fields corresponding to each of the external intelligence sources.

9. The multi-source intelligence fusion processing method according to claim 1, characterized in that: After determining the malicious address determination result of the target address information based on the size of the multi-source intelligence fusion value, the multi-source intelligence fusion processing method further includes: receiving an intelligence sharing request from a target terminal; Parsing the intelligence sharing request, determining the sharing authority of the target terminal, and selecting sharing information from the first network threat intelligence data, the second network threat intelligence data, and the malicious address determination result based on the sharing authority; The shared information is sent to the target terminal.

10. A multi-source intelligence fusion processing device, characterized in that: include: A data acquisition module, used to acquire target address information to be detected, and acquire first network threat intelligence data corresponding to the target address information from an internal intelligence source, and acquire second network threat intelligence data corresponding to the target address information from multiple external intelligence sources respectively; A quality assessment module, used to perform quality assessment on each of the external intelligence sources under multiple different intelligence source quality assessment dimensions to obtain multiple quality assessment scores, and weight the multiple quality assessment scores to obtain a comprehensive quality score corresponding to each of the external intelligence sources; a preliminary determination module, configured to determine, when the first network threat intelligence data determines that the target address information is unknown address information, a determination result of each of the second network threat intelligence data on the target address information, and assign different count values ​​to each of the external intelligence sources based on different determination results; A multi-source fusion module, used to determine the weighting coefficient of the corresponding external intelligence source based on the comprehensive quality score, and perform weighted fusion according to the weighting coefficient and the corresponding count value under each external intelligence source to obtain a multi-source intelligence fusion value; The malicious determination module is used to determine the malicious address determination result of the target address information based on the size of the multi-source intelligence fusion value.

11. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the multi-source intelligence fusion processing method according to any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the multi-source intelligence fusion processing method according to any one of claims 1 to 9 is implemented.

Images