A method for generating network threat rules based on threat intelligence

Abstract

The present invention relates to a method for generating network threat rules based on threat intelligence, and relates to the field of network security. This application crawls open-source network threat intelligence; uses image analysis prompts to guide a multi-modal language model to convert image-based open-source network threat intelligence into text-based; unifies the content format to obtain initial network threat intelligence; uses a language model to assist in filtering the initial network threat intelligence; an agent uses a voting method to identify the first type of entity and the second type of entity from the filtered network threat intelligence and establish a connection; uses Sigma rules to create prompts to control the agent to create Sigma rules based on the associated first type of entity and the second type of entity extracted from the network threat intelligence block in the filtered network threat intelligence block; uses Sigma rules to optimize prompts, and Sigma rule verification prompts control the language model used by the agent to optimize and verify the generated Sigma rules.

Description

Technical Field

[0001] The present invention relates to the technical field of network threat rule construction, and in particular to a method for generating network threat rules based on threat intelligence. Background Art

[0002] Sigma rules are a common signature format, a set of security event detection rules for log analysis tools, which help security analysts analyze and identify abnormal behaviors in the network. Sigma rules contain a set of customized rules for different attack patterns. Each Sigma rule in the rule set triggers an alarm based on conditions, and the structure of each Sigma rule can be divided into three main parts: the header, options, and detection query part. Among them, the header contains the basic information of the Sigma rule, such as the rule id, title, description, author, and date. This information is crucial for understanding the background, purpose, and source of the rule. The options part defines the context requirements of the rule, such as the process creation time, using a specific process ID, etc. The detection query part is the core of the rule definition, which describes the specific conditions to be detected. These conditions are usually fields and their values in the log source, and precise matching is performed using fields and values in various log sources. The log source can be from an operating system, an application, or any other log generation source. These fields, combined with the corresponding values, define the conditions for detecting security threats. Sigma rules provide a series of condition combinations and logical operators to create richer rule expressions. Condition combinations use logical operators and, or, not to connect different rule selection parts to build complex detection scenarios. In addition, the rule set can build hierarchical and dependency relationships, allowing related rules to be organized together to form a hierarchical structure. This structure helps manage a large number of rules and can improve the readability and maintainability of the rules. The relationships between rule sets can be inclusion and dependency.

[0003] Open-source network threat intelligence is an important source for forming network threat Sigma rules. However, open-source network threat intelligence usually appears in an unstructured format and contains image information, and needs to be further analyzed and processed manually to form formatted Sigma rules. Limited by the unstructured and image form of open-source network threat intelligence, the traditional method of automatically analyzing open-source network threat intelligence by regular means to form Sigma rules is restricted. With the development of natural language technology, natural language processing technology is used for open-source network threat intelligence analysis, and effective content of Sigma rules is extracted from open-source network threat intelligence texts using advanced natural language models. However, in order to make these models adapt to the network threat field and the semantics of the network threat intelligence field, a large amount of preprocessing and fine-tuning are required. Summary of the Invention

[0004] To solve the above technical problems or at least partially solve the above technical problems, the present invention provides a method for generating network threat rules based on threat intelligence.

[0005] In a first aspect, the present invention provides a method for generating network threat rules based on threat intelligence, including:

[0006] Using a web crawler tool to crawl open-source network threat intelligence web pages from open-source network threat intelligence sources;

[0007] Guiding a multi-modal language model through image analysis prompts to convert image-based open-source network threat intelligence in the crawled web page elements related to open-source network threat intelligence into text-based;

[0008] Converting the text content in the web page elements related to open-source network threat intelligence into a unified text format to obtain initial network threat intelligence;

[0009] Analyzing keywords indicating redundant content in the title of the initial network threat intelligence through a language model. For a target title with keywords indicating redundant content, excluding duplicate and redundant content in the initial network threat intelligence according to the position of the target title in the text structure hierarchy divided by all titles to obtain filtered network threat intelligence;

[0010] Providing the filtered network threat intelligence to at least one language model-based agent. The agent uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entities and the second type of entities from the filtered network threat intelligence and establish connections; the first type of entities are the entities necessary to form the detection query part of the Sigma rule, and the first type of entities include: API or process call, request parameters of API or process call, intrusion indicators, log sources and event sources; the second type of entities provide context information of network threat intelligence, and the second type of entities include the title and description in the Sigma rule, threat techniques and tactics, false positives and threat levels;

[0011] Using a Sigma rule creation prompt to control the language model used by the agent to create Sigma rules based on the filtered network threat intelligence block and the associated first type of entities and second type of entities extracted from the network threat intelligence block;

[0012] Using a Sigma rule optimization prompt to control the language model used by the agent to optimize the generated Sigma rules;

[0013] Using a Sigma rule verification prompt to control the language model used by the agent to verify the generated and optimized Sigma rules.

[0014] Furthermore, the image analysis prompt defines the multi-modal language model as a cybersecurity analysis expert, specifically for text analysis of images from threat intelligence sources; defines the task of the multi-modal language model as providing text analysis of images; defines the task requirements including: giving an image description in text form, presenting the image description in a format closely matching the appearance of the image, ensuring that the output description is relevant to and accurately reflects the image content, ensuring that the output description is complete, and not adding any information about the potential use or interpretation of the data, suggestions or opinions.

[0015] Furthermore, in the process of converting the textual content in web page elements related to open-source cyber threat intelligence into a unified text format to obtain the initial cyber threat intelligence, the unified text format preserves the spaces, paragraphs, and code segments of the open-source cyber threat intelligence content in the web page elements to retain the original layout of the textual content; the unified text format marks the titles of the web page elements to utilize the marked titles to construct the corresponding hierarchical structure according to the content within the original HTML page; for HTML codes containing tables and nested lists, the unified text format preserves their structural attributes.

[0016] Furthermore, providing the filtered cyber threat intelligence to at least one language model-based agent, the agent uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entities and the second type of entities from the filtered cyber threat intelligence, and establishing connections includes:

[0017] Segmenting the filtered cyber threat intelligence into semantically complete blocks through a text segmentation tool, and the content within each filtered cyber threat intelligence block is unified semantically;

[0018] The first type of entity extraction prompt guides the language model used by the agent to extract the corresponding first type of entities from the filtered cyber threat intelligence blocks. The agent votes based on the results of the first type of entities it extracts itself. If the vote count of any first type of entity exceeds the set vote threshold, then the filtered cyber threat intelligence block contains that first type of entity;

[0019] Taking the filtered cyber threat intelligence blocks from which the first type of entities have been extracted as the center, combining a set number of filtered cyber threat intelligence blocks before and after the text format to construct a context block;

[0020] Using the second type of entity extraction prompt to guide the language model used by the agent to extract the corresponding second type of entities from the context block by referring to the extracted first type of entities, and establishing connections with the corresponding first type of entities.

[0021] Further, for API or process calls in the first type of entities, extract prompting words through the API or process calls to guide the language model used by the agent to extract the explicitly mentioned API calls or process calls from the filtered network threat intelligence blocks. The agent votes based on the extraction results of the API or process calls it extracts itself. If the vote count of any API or process call exceeds the set vote threshold, the filtered network threat intelligence block contains the entity of that API or process call. Among them, the content of the prompting words for API or process call extraction includes: controlling the language model used by the agent to use the words involved in the API or process call to extract the API or process call entity in a word-matching manner; and further guiding the language model used by the agent to extract the API or process call entity in a way of API or process call semantic relevance analysis.

[0022] Further, to guide the language model used by the agent to extract the API or process call entity in a way of API or process call semantic relevance analysis, build a corresponding knowledge base for the agent. The knowledge base is a vectorized database that supports the language model used by the agent. The knowledge base includes the semantic descriptions of network operations and the corresponding API or process calls for the network operation semantic descriptions. After providing the filtered network threat intelligence block to the language model used by the agent, the filtered network threat intelligence block is vectorized as a query. The language model used by the agent matches the topk results most similar to the vectorized query from the knowledge base and predicts the candidate API or process calls to be voted on based on the topk results.

[0023] Further, the extraction of threat techniques and tactics in the second type of entities requires configuring a prompting dictionary for the agent. The prompting dictionary contains the mapping between the API or process calls in the first type of entities and the threat techniques and tactics, and the mapping between the threat techniques and tactics and the API or process calls. The language model used by the agent extracts the threat technique and tactic labels corresponding to the API or process calls according to the content of the context block and the extracted semantics, referring to the prompting dictionary.

[0024] Furthermore, the content of the Sigma rule creation prompt includes: defining the role: as a cybersecurity analysis expert, specifically used to generate Sigma rules from the context of open-source cyber threat intelligence; defining the task: converting the cyber threat intelligence context containing the following elements into Sigma rules: the analysis content describing attack techniques and tactics in open-source cyber threat intelligence; events in open-source cyber threat intelligence grouped by log sources or event sources, the first type of entity and the second type of entity involved in the events; defining the task requirements: all provided event names, IDs, event sources, and corresponding techniques and tactics must be used; no key information can be omitted; each event name appears in only one Sigma rule; extracting the details in the cyber threat intelligence context that can be converted into parameters; merging Sigma rules with the same techniques and tactics; the generated Sigma rules are strictly formatted.

[0025] Furthermore, in the process of optimizing the generated Sigma rules using the Sigma rule optimization prompt for the language model used by the prompt control agent, the content of the Sigma rule optimization prompt includes: merging the detection query fields in the Sigma rules with the same detection query criteria and consistent conditional logic; splitting the detection query fields with the same detection query criteria but inconsistent conditional logic.

[0026] Furthermore, in the process of verifying the generated and optimized Sigma rules using the Sigma rule verification prompt for the language model used by the prompt control agent, the content of the Sigma rule verification prompt includes: referring to the provided Sigma rule format to verify whether the format of the generated and optimized Sigma rules is in line with the Sigma rule format requirements; referring to the provided open-source cyber threat intelligence to verify whether the metadata in the generated and optimized Sigma rules conforms to the original open-source cyber threat intelligence content; referring to the provided open-source cyber threat intelligence to verify the accuracy of the conditions in the Sigma rules.

[0027] In a second aspect, the present invention provides a cyber threat rule generation device based on threat intelligence, including: at least one processing unit, the processing unit is connected to a storage unit through a bus unit, the storage unit stores a computer program, and when the computer program is executed by the processing unit, the cyber threat rule generation method based on threat intelligence as described above is implemented.

[0028] In a third aspect, the present invention provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the cyber threat rule generation method based on threat intelligence as described above is implemented.

[0029] The above technical solutions provided by the embodiments of the present invention have the following advantages compared with the prior art:

[0030] This application crawls open-source cyber threat intelligence; uses image analysis prompts to guide a multi-modal language model to convert the crawled open-source cyber threat intelligence of the image type into text type; converts the textified content into a unified text format to obtain initial cyber threat intelligence; uses a language model to assist in filtering the initial cyber threat intelligence; provides the filtered cyber threat intelligence to at least one language model-based agent, and the agent uses voting to identify the first type of entity and the second type of entity from the filtered cyber threat intelligence and establish connections; uses Sigma rules to create prompts to control the agent to create Sigma rules based on the associated first type of entity and second type of entity extracted from the cyber threat intelligence block in the filtered cyber threat intelligence block. This application uses agents constructed by a multi-modal language model and a language model to automatically generate Sigma rules according to multi-modal cyber threat intelligence. It achieved 92% precision and 96% recall in the task of extracting key APIs or process calls in the first type of entity, and 98% precision and 97% recall in the task of extracting key intrusion indicators in the first type of entity. In addition, 98.28% of the generated Sigma rule candidates were successfully compiled. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings herein are incorporated into the specification and constitute a part of this specification, showing embodiments consistent with the present invention, and are used together with the specification to explain the principles of the present invention.

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or in the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0033] Figure 1 It is a flowchart of a method for generating cyber threat rules based on threat intelligence provided by an embodiment of the present invention;

[0034] Figure 2 It is an architecture diagram of a method for generating cyber threat rules based on threat intelligence provided by an embodiment of the present invention;

[0035] Figure 3 It is a flowchart of providing the filtered cyber threat intelligence to at least one language model-based agent, and the agent uses the semantic analysis ability of the language model and the voting of multiple agents to identify the first type of entity and the second type of entity from the filtered cyber threat intelligence and establish connections provided by an embodiment of the present invention;

[0036] Figure 4 It is a schematic diagram of a device for generating cyber threat rules based on threat intelligence provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0037] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part rather than all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without any creative efforts shall fall within the scope of protection of the present invention.

[0038] It should be noted that, in this article, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements not only includes those elements but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the phrase "comprising a..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0039] Embodiment 1

[0040] As Figure 1 and Figure 2 shown, the technology of the present invention implements a method for generating network threat rules based on threat intelligence, including:

[0041] S100, crawling open-source network threat intelligence web pages from open-source network threat intelligence sources through a network crawling tool.

[0042] The network crawling tool crawls the web page code of the open-source network threat intelligence source; irrelevant web page elements in the web page are excluded by checking web page elements, and web page elements related to open-source network threat intelligence in the web page are determined.

[0043] S200, guiding a multi-modal language model through image analysis prompts to convert image-based open-source network threat intelligence in web page elements related to open-source network threat intelligence into text-based.

[0044] In addition to carrying open-source cyber threat intelligence in text form, web page elements may also contain open-source cyber threat intelligence in image form. This application controls a multimodal language model to convert open-source cyber threat intelligence in image form into text form through image analysis prompts. An example of an image analysis prompt includes: Role: As a cybersecurity analyst, specifically for text analysis of images from threat intelligence sources. Task: Provide a text analysis of the provided image. Task requirements: Give an image description in text form, with the main focus being on extracting information from the image that helps understand the attack. The description should be presented in a format that matches the content in the image. Ensure that the output description is relevant to and accurately reflects the image content, and ensure that the output description is complete. Do not add any information about the potential use or interpretation of the data, suggestions, or opinions. Exemplary multimodal language models such as: Qwen-VL, CogVLM2, CogAgent, gpt-4o.

[0045] S300, convert the text content in web page elements related to open-source cyber threat intelligence into a unified text format to obtain initial cyber threat intelligence. During the process, the unified text format maintains the spaces, paragraphs, and code segments of the open-source cyber threat intelligence content in the web page elements to retain the original layout of the text content; the unified text format marks the titles of the web page elements to utilize the marked titles to construct a corresponding hierarchical structure according to the content within the original HTML page; for HTML codes containing tables and nested lists, the unified text format retains their structural attributes.

[0046] S400, analyze the keywords indicating redundant content in the titles of the initial cyber threat intelligence through a language model. For the target titles with keywords indicating redundant content, exclude the duplicate and redundant content in the initial cyber threat intelligence according to the position of the target titles in the text structure hierarchy divided by all titles, to obtain the filtered cyber threat intelligence.

[0047] In the specific implementation process, use the language model to identify and locate the keywords indicating redundant content in the titles at all levels, such as "abstract", "introduction", "overview", "conclusion"; define the level of the title where the keyword is located, and delete the title at that level and the redundant content below that level. The content corresponding to "abstract", "introduction", "overview", "conclusion" is often a summary of some more specific cyber threat intelligence content, does not participate in the generation of Sigma rules, and belongs to redundant information.

[0048] S500, provide the filtered network threat intelligence to at least one language model-based agent. The agent uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entities and the second type of entities from the filtered network threat intelligence and establish associations. The first type of entities are the entities necessary to form the detection query part of the Sigma rule. The first type of entities include: API or process calls, request parameters of API or process calls, intrusion indicators, log sources, and event sources; the second type of entities provide context information of network threat intelligence; the second type of entities include the title and description in the Sigma rule, threat techniques and tactics, false positives, and threat levels.

[0049] In the specific implementation process, such as Figure 3 shown, step S500 includes the following processes:

[0050] S501, split the filtered network threat intelligence into semantically complete blocks through a text segmentation tool, and the content within each filtered network threat intelligence block is unified semantically; the way of splitting by semantics is conducive to the language model more accurately extracting the first type of entities and the second type of entities.

[0051] Then, in S502, the first type of entity extraction prompt words guide the language model used by the agent to extract the corresponding first type of entities from the filtered network threat intelligence blocks. The agent votes based on the results of the first type of entities extracted by itself. If the vote count of any first type of entity exceeds the set vote threshold, the filtered network threat intelligence block contains that first type of entity.

[0052] Taking API or process calls as an example: For API or process calls in the first type of entity, the prompt words are extracted through the API or process calls to guide the language model used by the agent to extract the explicitly mentioned API calls or process calls from the filtered network threat intelligence blocks. The agent votes based on the extraction results of the API or process calls it extracts itself. If the vote count of any API or process call exceeds the set vote threshold, the filtered network threat intelligence block contains the API or process call entity. The content of the prompt words for extracting the API or process calls includes: controlling the language model to use the words involved in these process calls such as Get, Call, Request, Create, Register to extract the API or process call entity in a word matching manner; and further guiding the language model to extract the API or process call entity in a way of API or process call semantic relevance analysis. In order to achieve guiding the language model to extract the API or process call entity in a way of API or process call semantic relevance analysis. This application constructs a corresponding knowledge base for the agent. The knowledge base is a vectorized database that supports the language model recognition. The knowledge base includes the semantic descriptions of network operations and the corresponding API or process calls for the network operation semantic descriptions. For example, the semantic description is "the attacker uses xxx to download malicious payloads", and the possible API calls involved in the semantic description are "urllib.request.urlretrieve" or "requests.get". After providing the filtered network threat intelligence block to the language model of the agent, the filtered network threat intelligence block is vectorized as a query, and the language model matches the topk results in the knowledge base that are most similar to the vectorized query, and predicts the candidate API or process calls to be voted based on the topk results.

[0053] In one example, there are 9 agents set, and the vote threshold is set to 5. If 6 out of 9 agents extract the GetNetUser call from a filtered network threat intelligence block, the vote count obtained by the GetNetUser call is 6, which exceeds the vote threshold of 5. In another example, there is one agent set, and the vote threshold is set to 5. The process of the agent extracting entities from a filtered network threat intelligence block is executed 9 times. If the GetNetUser call is extracted 6 times, the vote count obtained by the GetNetUser call is 6.

[0054] In a preferred example, since the accuracy of guiding the language model to extract the API or process call entity in a way of API or process call semantic relevance analysis is lower, a higher vote threshold is set during voting to improve its accuracy.

[0055] S503. Center around the filtered network threat intelligence block of the first type of entity, and construct a context block by combining a set number of filtered network threat intelligence blocks before and after the text format.

[0056] S504. Use the extraction prompt words of the second type of entity to guide the language model used by the agent to extract the corresponding second type of entity from the context block by referring to the first type of entity extracted. The second type of entity is the context information of the network threat intelligence. To avoid the loss of context information, in this application, the filtered network threat intelligence block of the first type of entity is centered, and a set number of filtered network threat intelligence blocks before and after the text format are combined to construct a context block, the second type of entity is extracted from the context block, and the connection with the corresponding first type of entity is constructed.

[0057] In the specific implementation process, the language model used by the agent can complete the extraction of the title, description, false alarm, and threat level in the second type of entity based on its semantic analysis ability. For the extraction of the threat techniques and tactics in the second type of entity, a prompt dictionary needs to be configured in the agent. The prompt dictionary contains the mapping between the API or process call and the threat techniques and tactics, and the mapping between the threat techniques and tactics and the API or process call. The language model used by the agent extracts the threat techniques and tactics labels corresponding to the API or process call according to the content of the context block and the extracted semantics by referring to the prompt dictionary.

[0058] In one implementation, the extraction of the second type of entity also goes through voting, and the principle of voting is the same as that of the first type of entity voting process, which will not be elaborated here.

[0059] S600. Use the Sigma rule creation prompt words to control the language model used by the agent to create Sigma rules based on the filtered network threat intelligence block, the associated first type of entity and the second type of entity extracted from the network threat intelligence block.

[0060] The content of the Sigma rule creation prompt words includes:

[0061] Role: As a cybersecurity analysis expert, specifically used to generate Sigma rules from the open-source network threat intelligence context.

[0062] Task: Convert the network threat intelligence context containing the following elements into Sigma rules: the analysis content describing the attack techniques and tactics in the open-source network threat intelligence; the events in the open-source network threat intelligence grouped by the log source or event source, the first type of entity and the second type of entity involved in the events.

[0063] Task requirements: All provided event names, IDs, event sources, and corresponding tactics and techniques must be used; no key information can be omitted; each event name should only appear in one Sigma rule; extract details in the context of cyber threat intelligence that can be converted into parameters; merge Sigma rules with the same tactics and techniques; the generated Sigma rules should be strictly formatted.

[0064] In the specific implementation process, the filtered cyber threat intelligence block, the associated first-class entities and second-class entities extracted from the cyber threat intelligence block, together with the Sigma rule creation prompt words, are provided to the language model used by the agent. Based on the filtered cyber threat intelligence block, the associated first-class entities and second-class entities extracted from the cyber threat intelligence block, the agent's language model creates a preliminary Sigma rule according to the content of the Sigma rule creation prompt words.

[0065] S700, use the Sigma rule optimization prompt words to control the language model used by the agent to optimize the generated Sigma rule. The content of the Sigma rule optimization prompt words includes: merging the detection query fields in the Sigma rule with the same detection query criteria and consistent conditional logic. Splitting the detection query fields with the same detection query criteria but inconsistent conditional logic. There may be some situations in the generated Sigma rule where the detection query criteria are the same, and the conditional logic is consistent but divided into different detection query fields. Through the language analysis ability of the language model used by the agent, the detection query fields in the Sigma rule with the same detection query criteria and consistent conditional logic are merged. Similarly, there may be some situations in the generated Sigma rule where the detection query criteria are the same, but the conditional logic is inconsistent but divided into the same detection query field. Through the language analysis ability of the language model used by the agent, the detection query fields in the Sigma rule with the same detection query criteria and inconsistent conditional logic are split, and the conditional logic is adjusted adaptively.

[0066] S800, use the Sigma rule verification prompt words to control the language model used by the agent to verify the generated and optimized Sigma rule. The content of the Sigma rule verification prompt words includes: referring to the provided Sigma rule format to verify whether the format of the generated and optimized Sigma rule is in line with the Sigma rule format requirements; referring to the provided open-source cyber threat intelligence to verify whether the metadata in the generated and optimized Sigma rule conforms to the original open-source cyber threat intelligence content; referring to the provided open-source cyber threat intelligence to verify the accuracy of the conditions in the Sigma rule.

[0067] It should be noted that the language model used solely for the filtering task and the language model used by the agent can be the same or different. Examples are gml, deepseek, and qwen.

[0068] Example 2

[0069] Refer to Figure 4 As shown, an embodiment of the present invention provides a network threat rule generation device based on threat intelligence, including: at least one processing unit, the processing unit is connected to a storage unit through a bus unit, and the storage unit is used as a computer-readable storage medium, which can be used to store software programs, computer-executable programs, and modules, such as the software programs, computer-executable programs, and modules corresponding to a network threat rule generation method based on threat intelligence in an embodiment of the present invention. The processing unit realizes the above-mentioned network threat rule generation method based on threat intelligence by running the software programs, computer-executable programs, and modules stored in the storage unit, including:

[0070] Crawl open-source network threat intelligence web pages from open-source network threat intelligence sources through a network crawling tool;

[0071] Guide a multi-modal language model through image analysis prompts to convert image-based open-source network threat intelligence in web page elements related to open-source network threat intelligence into text-based;[[ID=lo]]

[0072] Convert the text content in the web page elements related to open-source network threat intelligence into a unified text format to obtain initial network threat intelligence;

[0073] Analyze the keywords indicating redundant content in the title of the initial network threat intelligence through a language model. For the target title with keywords indicating redundant content, exclude the duplicate and redundant content in the initial network threat intelligence according to the position of the target title in the text structure hierarchy divided by all titles to obtain filtered network threat intelligence;

[0074] Provide the filtered network threat intelligence to at least one language model-based agent. The agent uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entities and the second type of entities from the filtered network threat intelligence and establish connections; the first type of entities are the entities necessary to form the detection query part of the Sigma rule, and the first type of entities include: API or process call, request parameters of API or process call, intrusion indicators, log sources, and event sources; the second type of entities provide context information of network threat intelligence, and the second type of entities include the title and description in the Sigma rule, threat techniques and tactics, false positives, and threat levels;

[0075] Use the Sigma rule to create prompts to control the language model used by the agent to create Sigma rules based on the associated first type of entities and second type of entities extracted from the network threat intelligence block in the filtered network threat intelligence block.

[0076] Certainly, the storage unit in the apparatus for implementing the method for generating network threat rules based on threat intelligence provided in the embodiments of the present invention stores a computer program that is not limited to the method operations described above, and can also execute the related operations in the method for generating network threat rules based on threat intelligence provided in any embodiment of the present invention.

[0077] Embodiment 3

[0078] The embodiments of the present invention provide a computer-readable storage medium storing a computer program, which when executed, implements the described method for generating network threat rules based on threat intelligence, including:

[0079] Crawling open-source network threat intelligence web pages from open-source network threat intelligence sources through a network crawling tool;

[0080] Guiding a multimodal language model through image analysis prompts to convert image-based open-source network threat intelligence in web page elements related to open-source network threat intelligence into text-based;

[0081] Converting the textified content in web page elements related to open-source network threat intelligence into a unified text format to obtain initial network threat intelligence;

[0082] Analyzing keywords indicating redundant content in the title of the initial network threat intelligence through a language model. For a target title with keywords indicating redundant content, excluding duplicate and redundant content in the initial network threat intelligence according to the position of the target title in the text structure hierarchy divided by all titles to obtain filtered network threat intelligence;

[0083] [[ID=(21)]]Providing the filtered network threat intelligence to at least one language model-based agent, which uses the semantic analysis ability of the language model and the method of multi-agent voting to identify the first type of entities and the second type of entities from the filtered network threat intelligence and establish connections; the first type of entities are the entities necessary to form the detection query part of the Sigma rule, and the first type of entities include: API or process call, request parameters of the API or process call, intrusion indicators, log sources, and event sources; the second type of entities provide context information for network threat intelligence, and the second type of entities include the title and description in the Sigma rule, threat techniques and tactics, false positives, and threat levels;

[0084] Using the Sigma rule creation prompt to control the language model used by the agent to create Sigma rules based on the associated first type of entities and second type of entities extracted from the network threat intelligence block in the filtered network threat intelligence block.

[0085] A computer-readable storage medium provided by an embodiment of the present invention, the computer program stored therein is not limited to the method operations as described above, and can also execute the related operations in a method for generating network threat rules based on threat intelligence provided by any embodiment of the present invention.

[0086] In the embodiments provided by the present invention, it should be understood that the disclosed structures and methods can be implemented in other ways. For example, the structural embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces, and the indirect couplings or communication connections of structures or units can be in electrical, mechanical or other forms.

[0087] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they can be located in one place, or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0088] In addition, the functional units in each embodiment of the present invention can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units.

[0089] The above are only specific embodiments of the present invention, enabling those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for generating network threat rules based on threat intelligence, characterized in that: include: Use web crawling tools to crawl open source threat intelligence web pages from open source threat intelligence sources; The multimodal language model is guided by image analysis prompt words to convert the image-based open source network threat intelligence in the crawled web page elements related to open source network threat intelligence into text-based open source network threat intelligence; Convert the textual content in web page elements related to open source cyber threat intelligence into a unified text format to obtain initial cyber threat intelligence; The language model is used to analyze keywords representing redundant content in the initial network threat intelligence titles. For target titles containing keywords representing redundant content, the redundant content in the initial network threat intelligence is removed based on the position of the target title in the text structure hierarchy of all titles to obtain filtered network threat intelligence. Providing the filtered network threat intelligence to at least one language model-based intelligent agent, which uses the semantic analysis capability of the language model and a multi-agent voting method to identify the first category of entities and the second category of entities from the filtered network threat intelligence and establish connections between them; The first type of entities are necessary to form the query part of the Sigma rule detection. The first type of entities include: API or process calls, API or process call request parameters, intrusion indicators, log sources, and event sources. The second type of entities provide contextual information for network threat intelligence. The second type of entities include the title and description in the Sigma rule, threat techniques and tactics, false positives, and threat levels. The language model used to create prompt words to control the intelligent agent is based on the filtered network threat intelligence block, and the sigma rules are created based on the associated first-category entities and second-category entities extracted from the network threat intelligence block; Utilize the Sigma rule optimization prompt word control agent to optimize the generated Sigma rule using the language model; The generated and optimized sigma rules are verified by using the language model used by the sigma rule verification prompt words to control the intelligent agent.

2. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: The image analysis prompt word defines a multimodal language model as a network security analysis expert, which is specifically used to perform text analysis on images from threat intelligence sources; defines the task of the multimodal language model as providing text analysis of images; defines the task requirements to include: giving an image description in the form of text, presenting the image description in a format that closely matches the appearance of the image, ensuring that the output description is relevant to and accurately reflects the image content, and ensuring that the output description is complete and does not add any potential uses or explanations, suggestions or opinions about the data.

3. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: The textual content in web page elements related to open source network threat intelligence is converted into a unified text format to obtain initial network threat intelligence. In the process, the unified text format maintains the spaces, paragraphs and code segments of the open source network threat intelligence content in the web page elements to retain the original layout of the textual content; the unified text format marks the titles of the web page elements to use the marked titles to build a corresponding hierarchical structure by maintaining the content in the original HTML page; for HTML codes containing tables and nested lists, the unified text format retains their structural properties.

4. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: Providing the filtered network threat intelligence to at least one language model-based intelligent agent, wherein the intelligent agent utilizes the semantic analysis capability of the language model and a multi-agent voting method to identify the first type of entity and the second type of entity from the filtered network threat intelligence and establish a connection, includes: The filtered network threat intelligence is segmented into semantically complete blocks using text segmentation tools. The content within each filtered network threat intelligence block is semantically unified. The first-category entity extraction prompt guides the language model used by the agent to extract the corresponding first-category entities from the filtered network threat intelligence block. The agent votes based on the first-category entity results it has extracted. If the number of votes for any first-category entity exceeds the set vote threshold, the first-category entity is included in the filtered network threat intelligence block. Centering on the filtered cyber threat intelligence block that extracts the first type of entity, a context block is constructed by combining a set number of filtered cyber threat intelligence blocks before and after the text format; The second-category entity extraction prompt words are used to guide the language model used by the intelligent agent to refer to the extracted first-category entities to extract corresponding second-category entities from the context block and build connections between them and the corresponding first-category entities.

5. The method for generating network threat rules based on threat intelligence according to claim 4, characterized in that: For API or process calls in the first category of entities, the language model used by the intelligent agent is guided by API or process call extraction prompt words to extract the explicitly mentioned API calls or process calls from the filtered network threat intelligence block. The intelligent agent votes based on the API or process call extraction results extracted by itself. If the number of votes for any API or process call exceeds the set vote threshold, the API or process call entity is included in the filtered network threat intelligence block; wherein, the content of the API or process call extraction prompt words includes: controlling the language model used by the intelligent agent to use the words involved in the API or process call to extract the API or process call entity in a word matching manner; and further guiding the language model used by the intelligent agent to extract the API or process call entity in a way of API or process call semantic relevance analysis.

6. The method for generating network threat rules based on threat intelligence according to claim 5, characterized in that: In order to guide the language model used by the intelligent agent to extract API or process call entities according to the semantic correlation analysis of API or process calls, a corresponding knowledge base is constructed for the intelligent agent. The knowledge base is a vectorized database that supports the recognition of the language model used by the intelligent agent. The knowledge base includes semantic descriptions of network operations and API or process calls corresponding to the semantic descriptions of network operations; after providing the filtered network threat intelligence block to the language model used by the intelligent agent, the filtered network threat intelligence block is vectorized as a query, and the language model used by the intelligent agent matches the topk results most similar to the vectorized query from the knowledge base, and predicts the candidate API or process calls to be voted based on the topk results.

7. The method for generating network threat rules based on threat intelligence according to claim 5, characterized in that: The extraction of threat techniques and tactics from the second type of entities requires configuring a prompt dictionary in the intelligent agent. The prompt dictionary contains the mapping between API or process calls and threat techniques and tactics in the first type of entities, and the mapping between threat techniques and tactics and API or process calls. The language model used by the intelligent agent extracts the threat technique and tactics labels corresponding to the API or process calls based on the content of the context block and the extracted semantics, and refers to the prompt dictionary.

8. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: The content of the Sigma rule creation prompt words includes: defining the role: as a network security analysis expert, specifically used to generate Sigma rules from the open source network threat intelligence context; defining the task: converting the network threat intelligence context containing the following elements into Sigma rules: analysis content describing attack techniques and tactics in the open source network threat intelligence; events in the open source network threat intelligence grouped by log sources or event sources, and the first and second category entities involved in the events; defining the task requirements: all provided event names, IDs, event sources and techniques and tactics corresponding to the events must be used; no key information is allowed to be omitted; each event name only appears in one Sigma rule; extracting details that can be converted into parameters in the network threat intelligence context; merging Sigma rules with the same techniques and tactics; the generated Sigma rules are strictly formatted.

9. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: In the process of optimizing the generated sigma rules using the language model used by the control agent using sigma rule optimization prompts, the sigma rule optimization prompts used include: merging detection query fields with the same detection query criteria and consistent conditional logic in the sigma rules; and splitting detection query fields with the same detection query criteria but inconsistent conditional logic.

10. The method for generating network threat rules based on threat intelligence according to claim 1, characterized in that: In the process of using the Sigma rule verification prompt words to control the language model used by the intelligent agent to verify the generated and optimized Sigma rules, the content of the Sigma rule verification prompt words used includes: referring to the provided Sigma rule format to verify whether the format of the generated and optimized Sigma rule is true and meets the Sigma rule format requirements; referring to the provided open source network threat intelligence to verify whether the metadata in the generated and optimized Sigma rule is consistent with the original open source network threat intelligence content; referring to the provided open source network threat intelligence to verify the accuracy of the conditions in the Sigma rule.

Images