Network threat rule generation method based on threat intelligence

Abstract

The invention relates to a network threat rule generation method based on threat intelligence, and relates to the field of network security. According to the method, open source network threat intelligence is crawled; guiding a multi-modal language model to convert open source network threat intelligence of an image class into a text class through an image analysis cue word; unifying the format of the local content to obtain initial network threat intelligence; the initial network threat intelligence is filtered in an auxiliary mode through a language model; the intelligent agent identifies a first type of entities and a second type of entities from the filtered network threat intelligence in a voting mode and establishes a relation; creating a cue word by using a sigma rule to control an intelligent agent to perform sigma rule creation based on the filtered network threat intelligence block, and extracting a first type of entities and a second type of entities associated with each other from the network threat intelligence block; and optimizing the cue word by using the sigma rule, and verifying the cue word by using the sigma rule to control the language model used by the agent to optimize and verify the generated sigma rule.

Description

Technical Field

[0001] The present invention relates to the technical field of network threat rule construction, and in particular, to a method for generating network threat rules based on threat intelligence. Background Art

[0002] Sigma rules are a common signature format and a set of security event detection rules for log analysis tools to help security analysts analyze and identify abnormal network behaviors. Sigma rules contain a set of customized rules for different attack patterns. Each Sigma rule in the rule set triggers an alarm based on conditions. The structure of each Sigma rule can be divided into three main parts: the header, options, and detection query part. Among them, the header contains basic information of the Sigma rule, such as the rule ID, title, description, author, and date. This information is crucial for understanding the background, purpose, and source of the rule. The options part defines the context requirements of the rule, such as the process creation time, using a specific process ID, etc. The detection query part is the core of the rule definition, which describes the specific conditions to be detected. These conditions are usually fields and their values in the log source, and precise matching is performed using fields and values in various log sources. The log source can be from the operating system, application, or any other log generation source. These fields, combined with corresponding values, define the conditions for detecting security threats. Sigma rules provide a series of condition combinations and logical operators to create richer rule expressions. The condition combination uses logical operators and, or, not to connect different rule selection parts to build complex detection scenarios. In addition, the rule set can build hierarchies and dependencies, allowing related rules to be organized together to form a hierarchical structure. This structure helps manage a large number of rules and can improve the readability and maintainability of the rules. The relationships between rule sets can be inclusion and dependency.

[0003] Open-source network threat intelligence is an important source for forming network threat Sigma rules. However, open-source network threat intelligence usually appears in an unstructured format and contains image information, which requires further manual analysis and processing to form formatted Sigma rules. Limited by the unstructured and image form of open-source network threat intelligence, the traditional method of automatically analyzing open-source network threat intelligence by regular means to form Sigma rules is restricted. With the development of natural language technology, natural language processing technology is used for open-source network threat intelligence analysis, and effective content of Sigma rules is extracted from open-source network threat intelligence text using advanced natural language models. However, in order to make these models adapt to the network threat field and the semantics of the network threat intelligence field, a large amount of preprocessing and fine-tuning are required. Summary of the Invention

[0004] To solve the above technical problems or at least partially solve the above technical problems, the present invention provides a method for generating network threat rules based on threat intelligence.

[0005] In a first aspect, the present invention provides a method for generating network threat rules based on threat intelligence, including: Using a network crawling tool to crawl open-source network threat intelligence web pages from open-source network threat intelligence sources; Guiding a multi-modal language model through image analysis prompts to convert image-based open-source network threat intelligence in the crawled web page elements related to open-source network threat intelligence into text-based; Converting the textified content in the web page elements related to open-source network threat intelligence into a unified text format to obtain initial network threat intelligence; Analyzing, through a language model, keywords indicating redundant content in the title of the initial network threat intelligence. For a target title with keywords indicating redundant content, excluding duplicate and redundant content in the initial network threat intelligence according to the position of the target title in the text structure hierarchy divided by all titles to obtain filtered network threat intelligence; Providing the filtered network threat intelligence to at least one language model-based agent. The agent uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entity and the second type of entity from the filtered network threat intelligence and establish a connection; the first type of entity is an entity necessary to form the detection query part of the Sigma rule, and the first type of entity includes: API or process call, request parameters of the API or process call, intrusion indicators, log sources, and event sources; the second type of entity provides context information of the network threat intelligence, and the second type of entity includes the title and description in the Sigma rule, threat techniques and tactics, false positives, and threat levels; Using the Sigma rule creation prompt to control the language model used by the agent to create Sigma rules based on the associated first type of entity and second type of entity extracted from the network threat intelligence block; Using the Sigma rule optimization prompt to control the language model used by the agent to optimize the generated Sigma rules; Using the Sigma rule verification prompt to control the language model used by the agent to verify the generated and optimized Sigma rules.

[0006] Furthermore, the image analysis prompt defines the multi-modal language model as a cybersecurity analysis expert specialized in text analysis of images from threat intelligence sources; defines the task of the multi-modal language model as providing text analysis of images; and defines the task requirements as follows: giving an image description in text form, presenting the image description in a format closely matching the appearance of the image, ensuring that the output description is relevant to and accurately reflects the image content, ensuring that the output description is complete, and not adding any information about the potential use or interpretation of the data, suggestions, or opinions.

[0007] Furthermore, when converting the textual content in web page elements related to open-source cyber threat intelligence into a unified text format to obtain the initial cyber threat intelligence, the unified text format preserves the spaces, paragraphs, and code segments of the open-source cyber threat intelligence content in the web page elements to retain the original layout of the textual content; the unified text format marks the titles of the web page elements to utilize the marked titles to construct the corresponding hierarchical structure according to the content within the original HTML page; for HTML code containing tables and nested lists, the unified text format retains its structural attributes.

[0008] Furthermore, when providing the filtered cyber threat intelligence to at least one language model-based agent, the agent uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entities and the second type of entities from the filtered cyber threat intelligence, and establishing connections includes: Segmenting the filtered cyber threat intelligence into semantically complete chunks through a text segmentation tool, with the content within each filtered cyber threat intelligence chunk being semantically unified; The first type of entity extraction prompt guides the language model used by the agent to extract the corresponding first type of entities from the filtered cyber threat intelligence chunks. The agent votes based on the results of the first type of entities it extracts itself. If the vote count for any first type of entity exceeds the set vote threshold, then the filtered cyber threat intelligence chunk contains that first type of entity; Centering around the filtered cyber threat intelligence chunks from which the first type of entities have been extracted, combining a set number of filtered cyber threat intelligence chunks before and after the text format to construct a context chunk; Using the second type of entity extraction prompt to guide the language model used by the agent to extract the corresponding second type of entities from the context chunk with reference to the extracted first type of entities, and constructing connections with the corresponding first type of entities.

[0009] Furthermore, for API or process calls in the first type of entities, extraction prompts are used to guide the language model used by the agent to extract the explicitly mentioned API calls or process calls from the filtered network threat intelligence blocks. The agent votes based on the extraction results of the API or process calls it extracts itself. If the vote count for any API or process call exceeds the set vote threshold, the filtered network threat intelligence block contains the entity of that API or process call. Among them, the content of the extraction prompts for the API or process calls includes: controlling the language model used by the agent to use the words involved in the API or process calls to extract the API or process call entities in a word-matching manner; and further guiding the language model used by the agent to extract the API or process call entities in a way of API or process call semantic relevance analysis.

[0010] Furthermore, in order to guide the language model used by the agent to extract the API or process call entities in a way of API or process call semantic relevance analysis, a corresponding knowledge base is constructed for the agent. The knowledge base is a vectorized database that supports the language model used by the agent. The knowledge base includes the semantic descriptions of network operations and the corresponding API or process calls for the network operation semantic descriptions. After providing the filtered network threat intelligence block to the language model used by the agent, the filtered network threat intelligence block is vectorized as a query. The language model used by the agent matches the topk results in the knowledge base that are most similar to the vectorized query and predicts the candidate API or process calls to be voted on based on the topk results.

[0011] Furthermore, for the extraction of threat techniques and tactics in the second type of entities, a prompt dictionary needs to be configured for the agent. The prompt dictionary contains the mappings between the API or process calls in the first type of entities and the threat techniques and tactics, as well as the mappings between the threat techniques and tactics and the API or process calls. The language model used by the agent extracts the threat technique and tactic labels corresponding to the API or process calls with reference to the prompt dictionary according to the content of the context block and the extracted semantics.

[0012] Furthermore, the content of the Sigma rule creation prompt includes: Defining the role: As a cybersecurity analysis expert, it is specifically used to generate Sigma rules from the context of open-source cyber threat intelligence; Defining the task: Transforming the cyber threat intelligence context containing the following elements into Sigma rules: the analysis content describing attack techniques and tactics in open-source cyber threat intelligence; events in open-source cyber threat intelligence grouped by log sources or event sources, the first type of entity and the second type of entity involved in the events; Defining the task requirements: All provided event names, IDs, event sources, and the corresponding techniques and tactics must be used; no key information can be omitted; each event name should only appear in one Sigma rule; Extract the details in the cyber threat intelligence context that can be transformed into parameters; Merge Sigma rules with the same techniques and tactics; The generated Sigma rules are strictly formatted.

[0013] Furthermore, in the process of optimizing the generated Sigma rules using the Sigma rule optimization prompt for the language model used by the prompt control agent, the content of the Sigma rule optimization prompt includes: Merging the detection query fields in the Sigma rules with the same detection query criteria and consistent conditional logic; Splitting the detection query fields with the same detection query criteria but inconsistent conditional logic.

[0014] Furthermore, in the process of verifying the generated and optimized Sigma rules using the Sigma rule verification prompt for the language model used by the prompt control agent, the content of the Sigma rule verification prompt includes: Referring to the provided Sigma rule format to verify whether the format of the generated and optimized Sigma rules is in line with the Sigma rule format requirements; Referring to the provided open-source cyber threat intelligence to verify whether the metadata in the generated and optimized Sigma rules conforms to the original open-source cyber threat intelligence content; Referring to the provided open-source cyber threat intelligence to verify the accuracy of the conditions in the Sigma rules.

[0015] In a second aspect, the present invention provides a cyber threat rule generation device based on threat intelligence, including: at least one processing unit, the processing unit is connected to a storage unit through a bus unit, the storage unit stores a computer program, and when the computer program is executed by the processing unit, the cyber threat rule generation method based on threat intelligence as described above is implemented.

[0016] In a third aspect, the present invention provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the cyber threat rule generation method based on threat intelligence as described above is implemented.

[0017] The above technical solutions provided by the embodiments of the present invention have the following advantages compared with the prior art: This application crawls open-source cyber threat intelligence; uses image analysis prompts to guide a multi-modal language model to convert the crawled open-source cyber threat intelligence of the image type into text type; converts the textified content into a unified text format to obtain initial cyber threat intelligence; filters the initial cyber threat intelligence with the assistance of a language model; provides the filtered cyber threat intelligence to at least one language model-based agent, and the agent uses voting to identify the first type of entities and the second type of entities from the filtered cyber threat intelligence and establish associations; uses Sigma rules to create prompts to control the agent to create Sigma rules based on the associated first type of entities and the second type of entities extracted from the cyber threat intelligence block in the filtered cyber threat intelligence block. This application uses agents constructed by a multi-modal language model and a language model to automatically generate Sigma rules according to multi-modal cyber threat intelligence. It achieves 92% precision and 96% recall rate in the extraction task of key APIs or process calls in the first type of entities, and 98% precision and 97% recall rate in the extraction task of key intrusion indicators in the first type of entities. In addition, 98.28% of the generated Sigma rule candidates are successfully compiled. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings here are incorporated into the specification and form a part of this specification, showing embodiments consistent with the present invention, and are used together with the specification to explain the principles of the present invention.

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or in the prior art, the following will briefly introduce the accompanying drawings required for use in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0020] Figure 1 It is a flowchart of a method for generating network threat rules based on threat intelligence provided by an embodiment of the present invention; Figure 2 It is an architecture diagram of a method for generating network threat rules based on threat intelligence provided by an embodiment of the present invention; Figure 3 It is a flowchart of providing the filtered cyber threat intelligence to at least one language model-based agent, and the agent uses the semantic analysis ability of the language model and the voting of multiple agents to identify the first type of entities and the second type of entities from the filtered cyber threat intelligence and establish associations provided by an embodiment of the present invention; Figure 4 It is a schematic diagram of a device for generating network threat rules based on threat intelligence provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0022] It should be noted that in this document, the term "including", "comprising", or any other variant thereof is intended to cover a non-exclusive inclusion, such that a process, method, article, or device including a series of elements not only includes those elements but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article, or device. Without further limitation, an element defined by the phrase "including a..." does not exclude the existence of additional identical elements in the process, method, article, or device including the said element.

[0023] Embodiment 1 As Figure 1 and Figure 2 shown, the technical solution of the present invention realizes a method for generating network threat rules based on threat intelligence, including: S100, crawling open-source network threat intelligence web pages from open-source network threat intelligence sources through a network crawling tool.

[0024] The network crawling tool crawls the web page code of the open-source network threat intelligence source; irrelevant web page elements in the web page are excluded by checking web page elements, and web page elements related to open-source network threat intelligence in the web page are determined.

[0025] S200, guiding a multi-modal language model through image analysis prompts to convert image-based open-source network threat intelligence in web page elements related to open-source network threat intelligence into text-based.

[0026] In addition to carrying open-source cyber threat intelligence in text form, web page elements may also contain open-source cyber threat intelligence in image form. In this application, image analysis prompts are used to control a multi-modal language model to convert open-source cyber threat intelligence in image form into text form. An example of an image analysis prompt includes: Role: As a cybersecurity analyst, specifically for text analysis of images from threat intelligence sources. Task: Provide a text analysis of the provided image. Task requirements: Give an image description in text form, with the main focus being on extracting information from the image that helps understand the attack. The description should be presented in a format that matches the content in the image. Ensure that the output description is relevant to the image content and accurately reflects it, and ensure that the output description is complete. Do not add any information about the potential use of the data or interpretations, suggestions, or opinions. Exemplary multi-modal language models such as: Qwen-VL, CogVLM2, CogAgent, gpt-4o.

[0027] S300, convert the text content in web page elements related to open-source cyber threat intelligence into a unified text format to obtain initial cyber threat intelligence. During the process, the unified text format preserves the spaces, paragraphs, and code segments of the open-source cyber threat intelligence content in the web page elements to retain the original layout of the text content; the unified text format marks the titles of the web page elements to utilize the marked titles to construct a corresponding hierarchical structure according to the content within the original HTML page; for HTML codes containing tables and nested lists, the unified text format preserves their structural attributes.

[0028] S400, analyze the keywords indicating redundant content in the titles of the initial cyber threat intelligence through a language model. For target titles with keywords indicating redundant content, exclude the duplicate and redundant content in the initial cyber threat intelligence according to the position of the target title in the text structure hierarchy divided by all titles, to obtain filtered cyber threat intelligence.

[0029] In the specific implementation process, use a language model to identify and locate the keywords indicating redundant content in each level of the title, such as "abstract", "introduction", "overview", "conclusion"; define the level of the title where the keyword is located, and delete the title at that level and the redundant content below it. The content corresponding to "abstract", "introduction", "overview", "conclusion" is often a summary of some more specific cyber threat intelligence content, does not participate in the generation of Sigma rules, and belongs to redundant information.

[0030] S500 provides the filtered network threat intelligence to at least one language model-based agent. The agent uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entities and the second type of entities from the filtered network threat intelligence and establish connections. The first type of entities are the entities necessary to form the detection query part of the Sigma rule. The first type of entities include: API or process calls, request parameters of API or process calls, intrusion indicators, log sources, and event sources; the second type of entities provide context information of network threat intelligence; the second type of entities include the title and description in the Sigma rule, threat techniques and tactics, false positives, and threat levels.

[0031] In the specific implementation process, such as Figure 3 shown, step S500 includes the following process: S501, split the filtered network threat intelligence into semantically complete chunks through a text segmentation tool, and the content within each filtered network threat intelligence chunk is unified semantically; the method of splitting by semantics is beneficial for the language model to more accurately extract the first type of entities and the second type of entities.

[0032] Then, in S502, the first type of entity extraction prompt words guide the language model used by the agent to extract the corresponding first type of entities from the filtered network threat intelligence chunks. The agent votes according to the results of the first type of entities extracted by itself. If the vote count of any first type of entity exceeds the set vote threshold, the filtered network threat intelligence chunk contains that first type of entity.

[0033] Taking API or process calls as an example: For API or process calls in the first type of entity, the prompt words are extracted through the API or process calls to guide the language model used by the agent to extract the explicitly mentioned API calls or process calls from the filtered network threat intelligence blocks. The agent votes based on the extraction results of the API or process calls it extracts itself. If the vote count for any API or process call exceeds the set vote threshold, the filtered network threat intelligence block contains the API or process call entity. The content of the prompt words for extracting the API or process calls includes: controlling the language model to use the words involved in these process calls such as Get, Call, Request, Create, Register to extract the API or process call entity in a word-matching manner; and further guiding the language model to extract the API or process call entity in a way of API or process call semantic relevance analysis. In order to implement guiding the language model to extract the API or process call entity in a way of API or process call semantic relevance analysis. The present application constructs a corresponding knowledge base for the agent. The knowledge base is a vectorized database that supports language model recognition. The knowledge base includes semantic descriptions of network operations and the corresponding API or process calls for the network operation semantic descriptions. For example, the semantic description is "the attacker uses xxx to download malicious payloads", and the possible API calls involved in the semantic description are "urllib.request.urlretrieve" or "requests.get". After providing the filtered network threat intelligence block to the language model of the agent, the filtered network threat intelligence block is vectorized as a query, and the language model matches the topk results in the knowledge base that are most similar to the vectorized query, and predicts the candidate API or process calls to be voted based on the topk results.

[0034] In one example, there are 9 agents set, and the vote threshold is set to 5. If 6 out of 9 agents extract the GetNetUser call from a filtered network threat intelligence block, the number of votes obtained by the GetNetUser call is 6, exceeding the vote threshold of 5. In another example, there is one agent set, and the vote threshold is set to 5. The process of the agent extracting entities from a filtered network threat intelligence block is executed 9 times. If the GetNetUser call is extracted 6 times, the number of votes obtained by the GetNetUser call is 6.

[0035] In a preferred example, since the accuracy of guiding the language model to extract the API or process call entity in a way of API or process call semantic relevance analysis is lower, a higher vote threshold is set during voting to improve its accuracy.

[0036] S503. Center around the filtered network threat intelligence block of the first type of entity, and construct a context block by combining a set number of filtered network threat intelligence blocks before and after the text format.

[0037] S504. Use the extraction prompt words of the second type of entity to guide the language model used by the agent to extract the corresponding second type of entity from the context block with reference to the first type of entity extracted. The second type of entity is the context information of the network threat intelligence. To avoid loss of context information, in this application, the filtered network threat intelligence block of the first type of entity is centered, and a set number of filtered network threat intelligence blocks before and after the text format are combined to construct a context block. The second type of entity is extracted from the context block, and the connection with the corresponding first type of entity is constructed.

[0038] In the specific implementation process, the language model used by the agent can complete the extraction of the title, description, false alarm, and threat level in the second type of entity based on its semantic analysis ability. For the extraction of the threat techniques and tactics in the second type of entity, a prompt dictionary needs to be configured in the agent. The prompt dictionary contains the mapping between API or process calls and threat techniques and tactics, and the mapping between threat techniques and tactics and API or process calls. The language model used by the agent extracts the threat technique and tactic labels corresponding to the API or process calls with reference to the content of the context block and the extracted semantics.

[0039] In one implementation, the extraction of the second type of entity also goes through voting. The principle of voting is the same as that of the first type of entity voting process, so it will not be elaborated here.

[0040] S600. Use the Sigma rule creation prompt words to control the language model used by the agent to create Sigma rules based on the filtered network threat intelligence block, the associated first type of entity and second type of entity extracted from the network threat intelligence block.

[0041] The content of the Sigma rule creation prompt words includes: Role: As a network security analysis expert, specifically used to generate Sigma rules from the open-source network threat intelligence context.

[0042] Task: Convert the network threat intelligence context containing the following elements into Sigma rules: the analysis content describing the attack techniques and tactics in the open-source network threat intelligence; the events in the open-source network threat intelligence grouped by log source or event source, the first type of entity and the second type of entity involved in the events. Task requirements: Must use all provided event names, IDs, event sources, and the techniques and tactics corresponding to the events; prohibit omitting any key information; each event name appears only in one Sigma rule; extract the details in the network threat intelligence context that can be converted into parameters; merge Sigma rules with the same techniques and tactics; the generated Sigma rules are strictly formatted.

[0043] In the specific implementation process, the filtered network threat intelligence blocks, the associated first-type entities and second-type entities extracted from the network threat intelligence blocks, and the Sigma rules are used to create prompt words and provided to the language model used by the agent. The language model used by the agent is based on the filtered network threat intelligence blocks, the associated first-type entities and second-type entities extracted from the network threat intelligence blocks, and preliminarily creates Sigma rules according to the content of the prompt words created by the Sigma rules.

[0044] S700, use the Sigma rule optimization prompt words to control the language model used by the agent to optimize the generated Sigma rules. Among them, the content of the Sigma rule optimization prompt words includes: merging the detection query fields with the same detection query criteria and consistent conditional logic in the Sigma rules. Splitting the detection query fields with the same detection query criteria but inconsistent conditional logic. There may be some situations in the generated Sigma rules where the detection query criteria are the same, and the conditional logic is consistent but divided into different detection query fields. The language analysis ability of the language model used by the agent is used to merge the detection query fields with the same detection query criteria and consistent conditional logic in the Sigma rules. Similarly, there may be some situations in the generated Sigma rules where the detection query criteria are the same, but the conditional logic is inconsistent but divided into the same detection query field. The language analysis ability of the language model used by the agent is used to split the detection query fields with the same detection query criteria and inconsistent conditional logic in the Sigma rules, and adaptively adjust the conditional logic.

[0045] S800, use the Sigma rule verification prompt words to control the language model used by the agent to verify the generated and optimized Sigma rules. The content of the Sigma rule verification prompt words includes: referring to the provided Sigma rule format to verify whether the format of the generated and optimized Sigma rules is in line with the Sigma rule format requirements; referring to the provided open-source network threat intelligence to verify whether the metadata in the generated and optimized Sigma rules conforms to the content of the original open-source network threat intelligence; referring to the provided open-source network threat intelligence to verify the accuracy of the conditions in the Sigma rules.

[0046] It should be noted that the language model used solely for the filtering task and the language model used by the agent can be the same or different. Examples are gml, deepseek, and qwen.

[0047] Embodiment 2 Refer to Figure 4As shown in the figure, an embodiment of the present invention provides a network threat rule generation device based on threat intelligence, including: at least one processing unit, which is connected to a storage unit through a bus unit. The storage unit, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the software programs, computer-executable programs, and modules corresponding to a network threat rule generation method based on threat intelligence in an embodiment of the present invention. The processing unit realizes the above-mentioned network threat rule generation method based on threat intelligence by running the software programs, computer-executable programs, and modules stored in the storage unit, including: Crawl open-source network threat intelligence web pages from open-source network threat intelligence sources through a network crawling tool; Use image analysis prompts to guide a multi-modal language model to convert image-based open-source network threat intelligence in web page elements related to open-source network threat intelligence into text-based; Convert the text content in web page elements related to open-source network threat intelligence into a unified text format to obtain initial network threat intelligence; Analyze keywords indicating redundant content in the title of the initial network threat intelligence through a language model. For target titles with keywords indicating redundant content, exclude duplicate and redundant content in the initial network threat intelligence according to the position of the target title in the text structure hierarchy divided by all titles to obtain filtered network threat intelligence; Provide the filtered network threat intelligence to at least one language model-based agent. The agent uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entities and the second type of entities from the filtered network threat intelligence and establish connections; the first type of entities are the entities necessary to form the detection query part of the Sigma rule, and the first type of entities include: API or process call, request parameters of API or process call, intrusion indicators, log sources, and event sources; the second type of entities provide context information of network threat intelligence, and the second type of entities include the title and description in the Sigma rule, threat techniques and tactics, false positives, and threat levels; Use Sigma rule creation prompts to control the language model used by the agent to create Sigma rules based on the associated first type of entities and the second type of entities extracted from the filtered network threat intelligence block.

[0048] Of course, the computer program stored in the storage unit of the device for implementing the network threat rule generation method based on threat intelligence provided by an embodiment of the present invention is not limited to the method operations described above, and can also execute related operations in a network threat rule generation method based on threat intelligence provided by any embodiment of the present invention.

[0049] Embodiment 3 An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which when executed, implements the method for generating network threat rules based on threat intelligence, including: Crawl open-source network threat intelligence web pages from open-source network threat intelligence sources through a network crawling tool; Use image analysis prompts to guide a multi-modal language model to convert image-based open-source network threat intelligence in web page elements related to open-source network threat intelligence into text-based; Convert the text content in web page elements related to open-source network threat intelligence into a unified text format to obtain initial network threat intelligence; Analyze keywords indicating redundant content in the title of the initial network threat intelligence through a language model. For a target title with keywords indicating redundant content, exclude duplicate and redundant content in the initial network threat intelligence according to the position of the target title in the text structure hierarchy divided by all titles to obtain filtered network threat intelligence; Provide the filtered network threat intelligence to at least one language model-based agent. The agent uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entities and the second type of entities from the filtered network threat intelligence and establish associations; the first type of entities are the entities necessary to form the detection query part of the Sigma rule, and the first type of entities include: API or process call, request parameters of the API or process call, intrusion indicator, log source, and event source; the second type of entities provide context information of the network threat intelligence, and the second type of entities include the title and description in the Sigma rule, threat techniques and tactics, false positives, and threat levels; Use the Sigma rule creation prompt to control the language model used by the agent to create Sigma rules based on the associated first type of entities and the second type of entities extracted from the filtered network threat intelligence block.

[0050] The computer program stored in the computer-readable storage medium provided by the embodiment of the present invention is not limited to the method operations described above, and can also execute related operations in a method for generating network threat rules based on threat intelligence provided by any embodiment of the present invention.

[0051] In the embodiments provided by the present invention, it should be understood that the disclosed structures and methods can be implemented in other ways. For example, the structural embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other can be through some interfaces, and the indirect coupling or communication connection of structures or units can be in electrical, mechanical or other forms.

[0052] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0053] In addition, the functional units in various embodiments of the present invention can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units.

[0054] The above are only specific embodiments of the present invention, enabling those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art. The general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but rather to the broadest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for generating network threat rules based on threat intelligence, characterized in that: include: Use web crawling tools to crawl open source network threat intelligence web pages from open source network threat intelligence sources; The image analysis prompt words are used to guide the multimodal language model to convert the image-based open source network threat intelligence in the crawled web page elements related to the open source network threat intelligence into text-based open source network threat intelligence. Convert the textual content in web page elements related to open source network threat intelligence into a unified text format to obtain initial network threat intelligence; The keywords representing redundant content in the initial network threat intelligence titles are analyzed by language model. For target titles with keywords representing redundant content, the repeated and redundant content in the initial network threat intelligence is eliminated according to the position of the target title in the text structure hierarchy divided by all titles to obtain filtered network threat intelligence. Providing the filtered network threat intelligence to at least one language model-based intelligent agent, which uses the semantic analysis capability of the language model and a multi-agent voting method to identify the first category entity and the second category entity from the filtered network threat intelligence and establish a connection; The first type of entities are the entities necessary to form the query part of the Sigma rule detection. The first type of entities include: API or process calls, request parameters of API or process calls, intrusion indicators, log sources, and event sources; The second type of entities provide contextual information of network threat intelligence. The second type of entities include the title and description in the Sigma rule, threat techniques and tactics, false positives, and threat levels; The language model used by the prompt word control agent is created by using the sigma rule, and the sigma rule is created based on the associated first-category entities and second-category entities extracted from the network threat intelligence block after filtering; The language model used by the Sigma rule optimization prompt word control agent is used to optimize the generated Sigma rule; The language model used by the Sigma rule verification prompt word control agent is used to verify the generated and optimized Sigma rules.

2. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: The image analysis prompt defines a multimodal language model as a network security analysis expert, which is specifically used to perform text analysis on images from threat intelligence sources; defines the task of the multimodal language model to provide text analysis of images; defines the task requirements to include: giving an image description in the form of text, presenting the image description in a format that closely matches the image appearance, ensuring that the output description is relevant to and accurately reflects the image content, and ensuring that the output description is complete without adding any potential uses or explanations, suggestions or opinions about the data.

3. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: The textual content in the web page elements related to the open source network threat intelligence is converted into a unified text format to obtain the initial network threat intelligence. In the process, the unified text format maintains the spaces, paragraphs and code segments of the open source network threat intelligence content in the web page elements to retain the original layout of the textual content; the unified text format marks the titles of the web page elements to use the marked titles to build a corresponding hierarchical structure by maintaining the original HTML page content; for HTML codes containing tables and nested lists, the unified text format retains their structural attributes.

4. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: The step of providing the filtered network threat intelligence to at least one intelligent agent based on a language model, wherein the intelligent agent uses the semantic analysis capability of the language model and a multi-agent voting method to identify the first type of entity and the second type of entity from the filtered network threat intelligence and establish a connection includes: The filtered network threat intelligence is segmented into semantically complete blocks using a text segmentation tool, and the content in each filtered network threat intelligence block is semantically unified; The first-category entity extraction prompt word guides the language model used by the intelligent agent to extract the corresponding first-category entity from the filtered network threat intelligence block. The intelligent agent votes according to the first-category entity results extracted by itself. If the number of votes for any first-category entity exceeds the set vote threshold, the first-category entity is included in the filtered network threat intelligence block; Centering on the filtered cyber threat intelligence block that extracts the first type of entity, a context block is constructed by combining a set number of filtered cyber threat intelligence blocks before and after the text format; The second-category entity extraction prompt words are used to guide the language model used by the intelligent agent to refer to the extracted first-category entities to extract corresponding second-category entities from the context block and build connections with the corresponding first-category entities.

5. The method for generating network threat rules based on threat intelligence according to claim 4, characterized in that: For the API or process calls in the first category of entities, the language model used by the intelligent agent is guided by the API or process call extraction prompt words to extract the explicitly mentioned API calls or process calls from the filtered network threat intelligence block, and the intelligent agent votes according to the API or process call extraction results extracted by itself. If the number of votes for any API or process call exceeds the set vote threshold, the filtered network threat intelligence block includes the API or process call entity; wherein the content of the API or process call extraction prompt words includes: controlling the language model used by the intelligent agent to use the words involved in the API or process call to extract the API or process call entity in a word matching manner; and further guiding the language model used by the intelligent agent to extract the API or process call entity in a way of API or process call semantic relevance analysis.

6. The method for generating network threat rules based on threat intelligence according to claim 5, characterized in that: In order to guide the language model used by the intelligent agent to extract API or process call entities in accordance with the API or process call semantic correlation analysis, a corresponding knowledge base is constructed for the intelligent agent. The knowledge base is a vectorized database that supports the recognition of the language model used by the intelligent agent. The knowledge base includes semantic descriptions of network operations and API or process calls corresponding to the semantic descriptions of network operations. After providing the filtered network threat intelligence block to the language model used by the intelligent agent, the filtered network threat intelligence block is vectorized as a query, and the language model used by the intelligent agent matches the topk results most similar to the vectorized query from the knowledge base, and predicts the candidate API or process calls to be voted based on the topk results.

7. The method for generating network threat rules based on threat intelligence according to claim 5, characterized in that: The extraction of threat techniques and tactics in the second category of entities requires configuring a prompt dictionary in the intelligent agent. The prompt dictionary contains the mapping between API or process calls and threat techniques and tactics in the first category of entities, and the mapping between threat techniques and tactics and API or process calls. The language model used by the intelligent agent extracts the threat technique and tactic labels of the corresponding API or process calls based on the content of the context block and the extracted semantics, with reference to the prompt dictionary.

8. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: The content of the Sigma rule creation prompt words includes: defining the role: as a network security analysis expert, specifically used to generate Sigma rules from the context of open source network threat intelligence; defining the task: converting the network threat intelligence context containing the following elements into Sigma rules: analysis content describing attack techniques and tactics in open source network threat intelligence; events in open source network threat intelligence grouped by log sources or event sources, and the first and second category entities involved in the events; defining the task requirements: all provided event names, IDs, event sources and techniques and tactics corresponding to the events must be used; no key information shall be omitted; each event name only appears in one Sigma rule; extracting details that can be converted into parameters in the network threat intelligence context; merging Sigma rules with the same techniques and tactics; the generated Sigma rules are strictly formatted.

9. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: In the process of optimizing the generated sigma rules by using the language model used by the sigma rule optimization prompt words to control the intelligent agent, the content of the sigma rule optimization prompt words used includes: merging the detection query fields with the same detection query standards and consistent conditional logic in the sigma rules; splitting the detection query fields with the same detection query standards but inconsistent conditional logic.

10. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: In the process of using the Sigma rule verification prompt words to control the language model used by the intelligent agent to verify the generated and optimized Sigma rules, the contents of the Sigma rule verification prompt words used include: referring to the provided Sigma rule format to verify whether the format of the generated and optimized Sigma rules is true and meets the Sigma rule format requirements; referring to the provided open source network threat intelligence to verify whether the metadata in the generated and optimized Sigma rules conforms to the original open source network threat intelligence content; referring to the provided open source network threat intelligence to verify the accuracy of the conditions in the Sigma rules.

Images