Information source credibility processing method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides an information source credibility processing method and device, a storage medium and electronic equipment, and the method comprises the steps: determining the time attenuation weight of a specified information source based on the publishing time of historical information provided by the specified information source in a historical time period; determining a parameter value of each timeliness parameter in the group of timeliness parameters of the specified intelligence source, and determining a parameter value of each validity parameter in the group of validity parameters of the specified intelligence source; adjusting the parameter value of each timeliness parameter of the specified intelligence source by using the time decay weight to obtain the adjusted parameter value of each timeliness parameter of the specified intelligence source; and determining a fusion result obtained by fusing the adjusted parameter value of each timeliness parameter of the specified intelligence source and the parameter value of each validity parameter of the specified intelligence source as the credibility of the specified intelligence source. According to the method and the device, the problems of low accuracy and large limitation of an information source credibility evaluation method are solved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security. Specifically, the embodiments of the present application relate to a method and device for processing the credibility of an information source, a storage medium, and an electronic device. Background Art

[0002] In the field of network security, threat intelligence is an important information resource for detecting, preventing, and responding to various network attacks. Information sources can come from multiple channels, such as security vendors, intelligence agencies, community cooperation, etc. However, the quality and credibility of threat intelligence vary significantly depending on the information source. Some information sources may provide accurate and credible intelligence, while others may have false alarms or false intelligence. The credibility of an information source plays a decisive role in the quality of the intelligence it provides. At this time, it is necessary to evaluate the credibility of the information source.

[0003] The evaluation methods of traditional threat intelligence platforms for information sources are relatively simple, mainly relying on static rules or limited historical data to determine whether to trust a certain information source. This method cannot effectively adjust the evaluation strategy in the face of a rapidly changing threat environment, has great limitations, and the evaluation of credibility is not accurate enough. It can be seen that the information source credibility evaluation method in the related technology has problems of low accuracy and large limitations. Summary of the Invention

[0004] The embodiments of the present application provide a method and device for processing the credibility of an information source, a storage medium, and an electronic device, so as to at least solve the technical problems of low accuracy and large limitations existing in the information source credibility evaluation method in the related technology.

[0005] According to one aspect of the embodiments of the present application, a method for processing the credibility of an information source is provided, including: determining the time decay weight of a specified information source based on the release time of historical intelligence provided by the specified information source within a historical time period; determining the parameter value of each timeliness parameter in a group of timeliness parameters of the specified information source, and determining the parameter value of each validity parameter in a group of validity parameters of the specified information source; adjusting the parameter value of each timeliness parameter of the specified information source by using the time decay weight to obtain the adjusted parameter value of each timeliness parameter of the specified information source; and determining the fusion result of fusing the adjusted parameter value of each timeliness parameter of the specified information source and the parameter value of each validity parameter of the specified information source as the credibility of the specified information source.

[0006] According to another aspect of the embodiments of the present application, there is also provided a computing device for the credibility of an information source, including: a first determination unit, configured to determine the time decay weight of the specified information source based on the release time of the historical information provided by the specified information source within a historical time period; a second determination unit, configured to determine the parameter value of each timeliness parameter in a group of timeliness parameters of the specified information source, and determine the parameter value of each validity parameter in a group of validity parameters of the specified information source; an adjustment unit, configured to adjust the parameter value of each timeliness parameter by using the time decay weight to obtain the adjusted parameter value of each timeliness parameter; a third determination unit, configured to determine the fusion result of fusing the adjusted parameter value of each timeliness parameter and the parameter value of each validity parameter as the credibility of the specified information source.

[0007] In an exemplary embodiment, the first determination unit includes: a first determination module, configured to determine, as the time weight of each historical information, the value with the natural logarithm as the base and the reference value corresponding to each historical information of the specified information source within the historical time period as the exponent, where the reference value corresponding to each historical information is the product of a specified decay rate and the number of days of release of each historical information, and the specified decay rate is a negative constant; a second determination module, configured to determine the average value of the time weights of each historical information as the time decay weight.

[0008] In an exemplary embodiment, the specified information source is one of a plurality of information sources; the second determination unit includes: a third determination module, configured to, when the group of timeliness parameters includes a dynamicity parameter, determine, as the parameter value of the dynamicity parameter of the specified information source, the quotient of the number of updates of the historical information provided by the specified information source within the historical time period divided by the number of updates of the historical information provided by the plurality of information sources within the historical time period; a fourth determination module, configured to, when the group of timeliness parameters includes a timeliness parameter, determine, as the parameter value of the timeliness parameter of the specified information source, the quotient of the number of first-release historical information provided by the specified information source within the historical time period divided by the number of updates of the historical information provided by the specified information source within the historical time period, where the first-release historical information is the historical information first released by the plurality of information sources.

[0009] In an exemplary embodiment, the specified information source is one of a plurality of information sources; the second determination unit includes: a fifth determination module, configured to, when the set of timeliness parameters includes a hit rate, divide the number of historical information hits of the specified information source in the historical time period by the total number of queries of the specified information source in the historical time period, and determine the quotient as the parameter value of the hit rate of the specified information source, where the historical information hits are historical information marked as correct; a sixth determination module, configured to, when the set of timeliness parameters includes a false alarm rate, divide the number of times the historical information provided by the specified information source in the historical time period is mislabeled as threat information by the total number of times the historical information provided by the specified information source in the historical time period is labeled as threat information, and determine the quotient as the parameter value of the false alarm rate of the specified information source; a seventh determination module, configured to, when the set of timeliness parameters includes a richness parameter, divide the number of fields in the information provided by the specified information source by the number of fields included in the union of the fields in the information provided by the plurality of information sources, and determine the quotient as the parameter value of the richness parameter of the specified information source; an eighth determination module, configured to, when the set of timeliness parameters includes an information source attribute, determine the attribute value of the information source attribute corresponding to the information source type of the specified information source as the parameter value of the information source attribute of the specified information source, where the information source type of the specified information source is one of a set of information source types, and each information source type in the set of information source types has a corresponding parameter value of the information source attribute.

[0010] In an exemplary embodiment, the adjustment unit includes: a ninth determination module, configured to multiply the parameter value of each timeliness parameter of the specified information source by the time decay weight, and determine the result as the adjusted parameter value of each timeliness parameter of the specified information source.

[0011] In an exemplary embodiment, the third determination unit includes: a tenth determination module, configured to determine the result of weighted summation of the adjusted parameter value of each timeliness parameter of the specified information source and the parameter value of each validity parameter of the specified information source as the credibility of the specified information source.

[0012] In an exemplary embodiment, the specified information source is one of a plurality of information sources; the apparatus further includes: an execution unit, configured to aggregate the information provided by the plurality of information sources based on the credibility of each information source in the plurality of information sources, determine the information to be processed in the information provided by the plurality of information sources, and perform network security processing corresponding to the information to be processed, where the information to be processed is threat information, and the credibility of the information source providing the information to be processed is greater than or equal to a credibility threshold, and there is no information source with a higher credibility than the information source providing the information to be processed that provides information contrary to the information to be processed.

[0013] According to another aspect of the embodiments of the present application, there is also provided a computer-readable storage medium, in which a computer program is stored, where the computer program is configured to execute the steps in any one of the above method embodiments when running.

[0014] According to another aspect of the embodiments of the present application, there is provided a computer program product or a computer program, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps in any one of the above method embodiments.

[0015] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including a memory and a processor, a computer program is stored in the memory, and the processor is configured to execute the steps in any one of the above method embodiments through the computer program.

[0016] Through this application, based on the release time of the historical information provided by a specified information source within a historical time period, determine the time decay weight of the specified information source; determine the parameter value of each timeliness parameter in a set of timeliness parameters of the specified information source, and determine the parameter value of each validity parameter in a set of validity parameters of the specified information source; use the time decay weight to adjust the parameter value of each timeliness parameter of the specified information source to obtain the adjusted parameter value of each timeliness parameter of the specified information source; determine the fusion result of fusing the adjusted parameter value of each timeliness parameter of the specified information source and the parameter value of each validity parameter of the specified information source as the credibility of the specified information source. Since the time decay weight is introduced in the credibility evaluation, it can dynamically reflect the value change of information at different time points, and the credibility is determined by fusing a set of timeliness parameters and a set of validity parameters, comprehensively considering multiple indicators in various aspects in the credibility evaluation. Therefore, it can solve the technical problems of low accuracy and large limitations existing in the information source credibility evaluation method in the related art, and achieve the technical effect of improving the accuracy of credibility evaluation. Brief Description of the Drawings

[0017] Figure 1 is a schematic diagram of an application scenario of a method for processing the credibility of an information source according to an embodiment of the present application.

[0018] Figure 2 is a schematic flowchart of an optional method for processing the credibility of an information source according to an embodiment of the present application.

[0019] Figure 3 is a schematic diagram of an optional method for processing the credibility of an information source according to an embodiment of the present application.

[0020] Figure 4 is a schematic flowchart of another optional method for processing the credibility of an information source according to an embodiment of the present application.

[0021] Figure 5 is a structural block diagram of an optional device for processing the credibility of an information source according to an embodiment of the present application.

[0022] Figure 6 is a structural block diagram of a computer system of an optional electronic device according to an embodiment of the present application. Detailed Description of the Embodiment

[0023] To enable those skilled in the art to better understand the solution of this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only a part of the embodiments of this application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the scope of protection of this application.

[0024] It should be noted that the terms "first", "second", etc. in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of this application described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products, or devices.

[0025] According to one aspect of the embodiments of this application, a method for processing the credibility of an information source is provided. Optionally, in this embodiment, the above method for processing the credibility of an information source can be but is not limited to being applied to a hardware environment such as Figure 1 shown in the figure, including a terminal device 102 and a server 104. The server 104 can be connected to the terminal device 102 through a network and can be used to provide services (such as application services, etc.) for the terminal device 102 or a client installed on the terminal device 102. A database can be set up on the server 104 or independently of the server 104 to provide data storage services for the server 104.

[0026] The above network can include but is not limited to at least one of the following: a wired network, a wireless network. The above wired network can include but is not limited to at least one of the following: a wide area network, a metropolitan area network, a local area network. The above wireless network can include but is not limited to at least one of the following: Wireless Fidelity (WIFI for short), Bluetooth. The terminal device 102 can be but is not limited to a personal computer (PC for short), a mobile phone, a tablet computer, etc. The server 104 can be but is not limited to a cloud server, a server cluster, or other server types.

[0027] The method for processing the credibility of an information source according to an embodiment of the present application can be executed by the server 104, or can be executed by the terminal device 102, or can also be jointly executed by the server 104 and the terminal device 102. Among them, when the terminal device 102 executes the method for processing the credibility of an information source according to an embodiment of the present application, it can also be executed by a client installed thereon.

[0028] Taking the execution of the method for processing the credibility of an information source in this embodiment by the terminal device 102 as an example, Figure 2 is a schematic flowchart of an optional method for processing the credibility of an information source according to an embodiment of the present application, as Figure 2 shown, the process of this method may include the following steps S202 to S208.

[0029] Step S202: Determine the time decay weight of the specified information source based on the release time of the historical information provided by the specified information source within the historical time period.

[0030] Step S204: Determine the parameter value of each timeliness parameter in a set of timeliness parameters of the specified information source, and determine the parameter value of each validity parameter in a set of validity parameters of the specified information source.

[0031] Step S206: Adjust the parameter value of each timeliness parameter of the specified information source using the time decay weight to obtain the adjusted parameter value of each timeliness parameter of the specified information source.

[0032] Step S208: Determine the fusion result of fusing the adjusted parameter value of each timeliness parameter of the specified information source and the parameter value of each validity parameter of the specified information source as the credibility of the specified information source.

[0033] The method for processing the credibility of an information source in this embodiment can be applied to the field of network security and applied to the scenario of evaluating the credibility of an information source that provides threat intelligence. In the field of network security, threat intelligence refers to information and knowledge about current and potential network threats obtained through system collection, analysis, and sharing. The content of threat intelligence can include attackers, attack tools, attack techniques, attack targets, and context information of attack activities. Reliable threat intelligence helps to identify, understand, and defend against network attacks in advance, thereby reducing the impact and response time of security incidents.

[0034] Threat intelligence can be provided by multiple intelligence sources. With the increasing complexity of cyber - attack methods, security protection relies on multi - source threat intelligence. Intelligence sources can come from various channels, such as security vendors, intelligence agencies, community cooperation, etc. However, there are significant differences in the quality and credibility of the intelligence provided by different intelligence sources. In related technologies, intelligence aggregation platforms usually lack an effective credibility assessment of intelligence sources when using intelligence, unable to ensure that the relied - upon intelligence sources have sufficient credibility, which may lead to making wrong security decisions using low - quality intelligence sources, thereby increasing network security risks.

[0035] To evaluate the credibility of intelligence sources, first, it is necessary to determine how to evaluate the credibility of intelligence sources. The reliability, timeliness, false - alarm rate, etc. of different intelligence sources vary, and it is necessary to effectively quantify and evaluate the credibility of intelligence sources so as to preferentially use high - credibility intelligence sources during intelligence aggregation. Second, it is also necessary to determine how to dynamically adapt to intelligence changes. Threat intelligence is time - sensitive, and its value changes over time. It is necessary to introduce time factors to ensure that the effectiveness of intelligence can be dynamically evaluated and the reliance on outdated information can be reduced. Finally, it is also necessary to improve the evaluation accuracy of intelligence sources. In threat intelligence evaluation, it is necessary to combine multiple indicators (such as hit rate, false - alarm rate, update frequency, etc.) and historical data to establish an accurate and objective intelligence credibility evaluation model to achieve a high - precision evaluation of credibility.

[0036] In related technologies, the evaluation methods of traditional threat intelligence platforms for intelligence sources are relatively simple. They mainly rely on static rules or limited historical data to decide whether to trust a certain intelligence source. For example: Weight assignment based on experience: Assign fixed weights to different intelligence sources according to historical experience, but this method lacks the ability of dynamic adjustment and cannot adapt to the change of the quality of intelligence sources; Simple hit - rate or false - alarm rate statistics: Conduct simple evaluations by calculating the hit rate or false - alarm rate of intelligence, but this method ignores the influence of the timeliness and multi - dimensional factors of intelligence. In addition, the evaluation methods in related technologies also lack time factors, do not consider the time decay of intelligence, and cannot dynamically reflect the value change of intelligence at different time points. The above - mentioned evaluation methods cannot effectively adjust the evaluation strategy in the face of a rapidly changing threat environment and have great limitations.

[0037] To at least partially solve the above - mentioned technical problems, in this embodiment, time - decay weights are introduced into the calculation process of the credibility of intelligence sources, and combined with a set of timeliness parameters and a set of effectiveness parameters to achieve a comprehensive evaluation of the credibility of intelligence sources.

[0038] First, determine the time decay weight of the specified information source based on the release time of the historical information provided by the specified information source within the historical time period. Optionally, the above release time may include the release time of new information and the update time of old information. Here, the time decay weight can make the newer information have a higher weight, and the weight of the old information gradually decays over time. It should be noted that a time decay weight is obtained from the information of all historical information provided by an information source within the specified historical time period, and is used to evaluate the information source itself, rather than the historical information of the information source. Here, the specified historical time period can be set according to experience. Taking the specified historical time period as one month as an example, at this time, it is necessary to determine the time decay weight of the specified information source based on all historical information released and updated by the specified information source in the most recent month.

[0039] Then, confirm the parameter values of each parameter in a set of timeliness parameters and a set of validity parameters of the specified information source. Here, the timeliness parameters are a set of parameters strongly related to the timeliness of information. For example, the timeliness parameters can evaluate the update speed and freshness of information. For example, the update frequency or the timeliness of releasing information, etc.; the validity parameters have nothing to do with timeliness and can be used to measure information such as the accuracy of information. For example, the validity parameters can include the hit rate (the proportion of information verified as a real attack) and the false alarm rate (the ratio of information verified as a wrongly marked threat), etc.

[0040] For the timeliness parameters, it is necessary to adjust the parameter value of each parameter in combination with the above time decay weight. Here, the time decay weight can be directly multiplied by the parameter value of each parameter to obtain the adjusted parameter value.

[0041] After adjusting the timeliness parameters, the adjusted parameter values of each timeliness parameter of the specified information source and the parameter values of each validity parameter of the specified information source can be fused, and the fusion result is determined as the credibility of the specified information source. Here, the fusion method can be set according to experience. For example, the parameter values can be directly added or added with weights, and the added result is used as the fusion result. This embodiment does not make any limitations in this regard.

[0042] Through the embodiments provided in this application, based on the release time of the historical information provided by a specified information source within a historical time period, determine the time decay weight of the specified information source; determine the parameter value of each timeliness parameter in a group of timeliness parameters of the specified information source, and determine the parameter value of each validity parameter in a group of validity parameters of the specified information source; use the time decay weight to adjust the parameter value of each timeliness parameter of the specified information source to obtain the adjusted parameter value of each timeliness parameter of the specified information source; determine the fusion result of fusing the adjusted parameter value of each timeliness parameter of the specified information source and the parameter value of each validity parameter of the specified information source as the credibility of the specified information source. This solves the problems of low accuracy and large limitations existing in the information source credibility evaluation method in the related art, improves the accuracy of information source credibility evaluation, and reduces the limitations of information source credibility evaluation.

[0043] In an exemplary embodiment, based on the release time of the historical information provided by a specified information source within a historical time period, determining the time decay weight of the specified information source includes: determining, as the time weight of each historical information, the value with the natural logarithm as the base and the reference value corresponding to each historical information of the specified information source within the historical time period as the exponent, where the reference value corresponding to each historical information is the product of a specified decay rate and the number of days of release of each historical information, and the specified decay rate is a negative constant; determining the average value of the time weights of each historical information as the time decay weight.

[0044] In order to introduce the time factor in the evaluation, through the time decay model, the value of the information can be dynamically adjusted using exponential decay. Here, the time decay model assumes that the value of the information gradually decreases over time. Therefore, for the information within the historical time period, a lower weight is given to the old information, and a higher weight is given to the newer information.

[0045] In this embodiment, using the exponential decay function (Exponential Decay Function), first determine, as the time weight of each historical information, the value with the natural logarithm as the base and the reference value corresponding to each historical information of the specified information source within the historical time period as the exponent, and then determine the average value of the time weights of each historical information as the time decay weight of the information source. Here, the reference value corresponding to each historical information is the product of a specified decay rate and the number of days of release of each historical information, as shown in formula (1):

[0046] ; (1)

[0047] Among them, Reference Value(i) is the reference value corresponding to the i-th piece of information among all the historical information provided by the specified information source within the historical time period; To specify the decay rate, which is a preset constant less than 0. The specific value of the specified decay rate can be set according to experience and is used to control the decay speed. Moreover, the smaller the value of the specified decay rate, the faster the decay. Optionally, its value can be default set to -0.001; t i is the number of days since the release of the i-th piece of intelligence. Here, the number of days since release refers to the number of days between the release or last update time (if there is an update) of this piece of intelligence and the day of credibility assessment, and its minimum value (when less than one day) is 0.

[0048] It should be noted that all historical intelligence provided by the specified information source within the historical time period includes: the intelligence released by the specified information source within the historical time period, and the updates to the released intelligence by the specified information source within the historical time period. If the specified information source updates the same piece of intelligence multiple times (not less than twice) within the historical time period or releases and updates the same piece of intelligence within the historical time period, for the intelligence meeting the above conditions, only the last update is taken as a historical intelligence provided by the specified information source within the historical time period, and different versions of the same piece of intelligence are not counted repeatedly.

[0049] After obtaining the reference value of each historical intelligence, the time weight of each historical intelligence is the value with the natural logarithm as the base and the reference value corresponding to each historical intelligence of the specified information source within the historical time period as the exponent, as shown in formula (2):

[0050] ; (2)

[0051] Among them, Time Weight(i) is the time weight of the i-th piece of intelligence among all historical intelligence provided by the specified information source within the historical time period.

[0052] Finally, the average value of the time weights of each historical intelligence can be determined as the time decay weight, as shown in formula (3):

[0053] ; (3)

[0054] Among them, Decay Weight is the time decay weight, and n is the total number of historical intelligence provided by the specified information source within the historical time period.

[0055] Combining the above formula (1), formula (2) and formula (3), the time decay weight is as shown in formula (4):

[0056] ; (4)

[0057] Through this embodiment, the introduction of time weight calculation based on the natural logarithm ensures that the timeliness of intelligence value can be correctly reflected and avoids the influence of outdated intelligence on the accuracy of overall credibility assessment.

[0058] In an exemplary embodiment, a designated information source is one of a plurality of information sources; parameter values of each timeliness parameter in a set of timeliness parameters of the designated information source are determined, including: when the set of timeliness parameters includes a dynamic parameter, a quotient obtained by dividing the number of updates of historical information provided by the designated information source within a historical time period by the number of updates of historical information provided by the plurality of information sources within the historical time period is determined as the parameter value of the dynamic parameter of the designated information source; when the set of timeliness parameters includes a timeliness parameter, a quotient obtained by dividing the number of first-release historical information provided by the designated information source within the historical time period by the number of updates of historical information provided by the designated information source within the historical time period is determined as the parameter value of the timeliness parameter of the designated information source, where the first-release historical information is historical information first released by the plurality of information sources.

[0059] Here, a set of timeliness parameters may include a dynamic parameter, or a timeliness parameter, or both a dynamic parameter and a timeliness parameter. The plurality of information sources are all information sources that provide information within a historical time period, and the designated information source is one of the above-mentioned plurality of information sources.

[0060] In this embodiment, taking the plurality of information sources including information source A, information source B, and information source C, and the designated information source being information source A as an example. When the set of timeliness parameters includes a dynamic parameter, the parameter value of the dynamic parameter of the designated information source is a quotient obtained by dividing the number of updates of historical information provided by the designated information source within a historical time period by the number of updates of historical information provided by the plurality of information sources within the historical time period, as shown in formula (6):

[0061] dyn = number of updates of the designated information source / total number of updates of the plurality of information sources; (6)

[0062] Wherein, dyn is the parameter value of the dynamic parameter of the designated information source, the number of updates of the designated information source is the number of updates of historical information provided by the designated information source within a historical time period, and the total number of updates of the plurality of information sources is the sum of the number of updates of historical information provided by all information sources within the historical time period.

[0063] It should be noted that the above-mentioned number of updates includes the sum of the number of newly released information and the number of updates of old information within a historical time period. For example, if information source A has released 10 pieces of information and updated 5 pieces of old information within a historical time period, the number of updates of historical information provided by information source A within the historical time period is 15.

[0064] For example, taking the update quantity of information source A as 15, the update quantity of information source B as 10, and the update quantity of information source C as 5 as an example. At this time, the parameter value of the dynamic parameter of information source A is 15 / (15 + 10 + 5) = 0.5.

[0065] In the case where a set of timeliness parameters includes a dynamic parameter, the parameter value of the timeliness parameter of a specified information source is the quotient obtained by dividing the quantity of the first-release historical information provided by the specified information source within a historical time period by the update quantity of the historical information provided by the specified information source within the historical time period, as shown in formula (7):

[0066] tim = the first-release update quantity of the specified information source / the update quantity of the specified information source; (7)

[0067] Among them, tim is the parameter value of the timeliness parameter of the specified information source, and the first-release update quantity of the specified information source is the quantity of the first-release historical information provided by the specified information source within a historical time period. Here, the quantity of the first-release historical information provided by the specified information source refers to the number of times the specified information source first publishes non-public information. For example, if an item of information is first released by information source A at 10:00, by information source B at 10:30, and by information source C at 11:00, then this item of information is the first-release historical information provided by information source A.

[0068] Through this embodiment, by evaluating the dynamic and timeliness parameters, the accuracy of the information source credibility evaluation is improved, thereby improving the overall performance and security protection ability of the threat intelligence platform.

[0069] In an exemplary embodiment, a designated information source is one of multiple information sources; the parameter values of each validity parameter in a set of validity parameters of the designated information source are determined, including: when a set of timeliness parameters includes a hit rate, the quotient obtained by dividing the number of historical information hits of the designated information source within a historical time period by the total number of queries of the designated information source within the historical time period is determined as the parameter value of the hit rate of the designated information source, where the historical information hits are historical information marked as correct. When a set of timeliness parameters includes a false alarm rate, the quotient obtained by dividing the number of times the historical information provided by the designated information source is mislabeled as threat information within a historical time period by the total number of times the historical information provided by the designated information source is labeled as threat information within the historical time period is determined as the parameter value of the false alarm rate of the designated information source. When a set of timeliness parameters includes a richness parameter, the quotient obtained by dividing the number of fields in the information provided by the designated information source by the number of fields included in the union of the fields in the information provided by multiple information sources is determined as the parameter value of the richness parameter of the designated information source. When a set of timeliness parameters includes information source attributes, the attribute value of the information source attribute corresponding to the information source type of the designated information source is determined as the parameter value of the information source attribute of the designated information source, where the information source type of the designated information source is one of a set of information source types, and each information source type in the set of information source types has a corresponding parameter value of the information source attribute.

[0070] Here, a set of validity parameters includes at least one of the following: hit rate, false alarm rate, richness parameter, and information source attributes. The hit rate can be used to evaluate the accuracy of the information provided by the designated information source, the false alarm rate can be used to evaluate the error rate of the information provided by the designated information source, the richness parameter can be used to evaluate the integrity and detail of the information provided by the designated information source, and the information source attributes can be used to evaluate the nature of the information source. In practical applications, the specific content of a set of validity parameters can be selected and set according to the evaluation needs.

[0071] When a set of timeliness parameters includes a hit rate, the parameter value of the hit rate of the designated information source is the quotient obtained by dividing the number of historical information hits of the designated information source within a historical time period by the total number of queries of the designated information source within the historical time period, as shown in formula (8):

[0072] sco = number of hits of the designated information source / total number of queries of the designated information source; (8)

[0073] Where sco is the parameter value of the hit rate of the designated information source, the number of hits of the designated information source is the number of historical information hits of the designated information source within a historical time period, and the total number of queries of the designated information source is the total number of queries of the designated information source within the historical time period.

[0074] It should be noted that the hit historical intelligence is the historical intelligence marked as correct, that is, the historical intelligence verified as accurate. For example, when an intelligence source provides intelligence related to a malicious IP, if the system or manual inspection determines that the IP intelligence is accurate, the intelligence can be marked as accurate and counted as one hit for the intelligence source.

[0075] In the case where a set of timeliness parameters includes the false alarm rate, the parameter value of the false alarm rate of a specified intelligence source is the quotient of the number of historical intelligence provided by the specified intelligence source that is mislabeled as threat intelligence in the historical time period divided by the total number of historical intelligence provided by the specified intelligence source that is labeled as threat intelligence in the historical time period, as shown in formula (9):

[0076] mis = the number of times the specified intelligence source is mislabeled / the number of times the specified intelligence source is labeled; (9)

[0077] Among them, mis is the parameter value of the false alarm rate of the specified intelligence source. The number of times the specified intelligence source is mislabeled is the number of historical intelligence provided by the specified intelligence source that is mislabeled as threat intelligence in the historical time period, and the number of times the specified intelligence source is labeled is the total number of historical intelligence provided by the specified intelligence source that is labeled as threat intelligence in the historical time period.

[0078] It should be noted that an intelligence being mislabeled as threat intelligence means that due to intelligence errors, it is marked as threat malicious information by the system or manually, and in subsequent actual verification and information auditing, it is found that this piece of intelligence does not pose a real threat. At this time, the intelligence is determined to be mislabeled as threat intelligence.

[0079] In the case where a set of timeliness parameters includes the richness parameter, the parameter value of the richness parameter of a specified intelligence source is the quotient of the number of fields in the intelligence provided by the specified intelligence source and the number of fields included in the union of the fields in the intelligence provided by multiple intelligence sources. Here, the union of the fields in the intelligence provided by multiple intelligence sources refers to the sum of all fields in the intelligence provided by multiple intelligence sources. For example, as Figure 3 shown, the intelligence provided by intelligence source A includes field A and field B, the intelligence provided by intelligence source B includes field A and field C, and the intelligence provided by intelligence source C includes field B, field D, and field E. At this time, the union of the fields in the intelligence provided by the above three intelligence sources includes five fields: field A, field B, field C, field D, and field E, and the richness parameter of intelligence source A is 2 / 5 = 0.4.

[0080] It should be noted that the richness parameter is based on the fields given by the manufacturer (i.e., the intelligence source) in the corresponding handover document. For example, when providing intelligence, the marked information intelligence can include fields such as attack IP, attack payload, attack title, and attack time.

[0081] When a set of timeliness parameters includes the information source attributes, the parameter value of the information source attribute of the specified information source is the attribute value of the information source attribute corresponding to the information source type of the specified information source. Among them, the information source type of the specified information source is one of a set of information source types. Optionally, a set of information source types may include regulatory agency information, manufacturer information, endogenous information, open source information, etc. In addition, each information source type in a set of information source types has a corresponding parameter value of the information source attribute. Here, the parameter value of the information source attribute corresponding to each information source type may be a preset fixed value or a value set by the user for the information source, which is not limited in this embodiment. For example, when a set of information source types includes regulatory agency information, manufacturer information, endogenous information, and open source information, the corresponding parameter values of the information source attributes may be 1, 1, 1, and 0.7 respectively.

[0082] Through this embodiment, by confirming a set of validity parameters, the validity of the information source can be evaluated more comprehensively, and more solid data support can be provided for the integration and utilization of threat intelligence.

[0083] In an exemplary embodiment, the time decay weight is used to adjust the parameter value of each timeliness parameter of the specified information source to obtain the adjusted parameter value of each timeliness parameter of the specified information source, including: determining the product of the parameter value of each timeliness parameter of the specified information source and the time decay weight as the adjusted parameter value of each timeliness parameter of the specified information source.

[0084] For timeliness parameters, their effective value gradually decreases over time. In order to enable the credibility assessment to dynamically adapt to the timeliness changes of threat intelligence, improve the accuracy of intelligence assessment, and reduce the dependence on outdated information, the time decay weight can be used to adjust the timeliness parameters.

[0085] When a set of timeliness parameters includes the dynamicity parameter, the parameter value of the adjusted dynamicity parameter is shown in formula (10):

[0086] dyn decayed =Decay Weight×dyn; (10)

[0087] Wherein, dyn decayed is the parameter value of the dynamically decayed dynamicity parameter, that is, the parameter value of the adjusted dynamicity parameter, Decay Weight is the time decay weight of the specified information source, and dyn is the parameter value of the dynamicity parameter of the specified information source.

[0088] When a set of timeliness parameters includes the timeliness parameter, the parameter value of the adjusted timeliness parameter is shown in formula (11):

[0089] tim decayed = Decay Weight × tim; (11)

[0090] Among them, tim decayed is the parameter value of the timeliness parameter after time decay, that is, the parameter value of the adjusted timeliness parameter, and tim is the parameter value of the timeliness parameter of the specified information source.

[0091] Through this embodiment, the parameter values of each timeliness parameter are adjusted using the time decay weight, making the adjusted parameter values more in line with the timeliness changes of actual intelligence and improving the accuracy of credibility evaluation.

[0092] In an exemplary embodiment, the fusion result of fusing the parameter values of each adjusted timeliness parameter of the specified information source and the parameter values of each validity parameter of the specified information source is determined as the credibility of the specified information source, including: determining the result of weighted summation of the parameter values of each adjusted timeliness parameter of the specified information source and the parameter values of each validity parameter of the specified information source as the credibility of the specified information source.

[0093] In order to combine the parameter values of the timeliness parameter and the validity parameter in the foregoing embodiments to obtain a credibility that can comprehensively reflect the reliability of the specified information source, a weighted summation method can be used. Multiply each parameter value by its corresponding weight and add them up to finally obtain the credibility of the specified information source. Here, the weights corresponding to each parameter value can be set according to experience. For example, they can be manually set values or values obtained based on historical credibility. Optionally, the hit rate and false alarm rate have higher priorities and their weight values are also higher; the dynamicity parameter and timeliness parameter have medium priorities and their weight values are also medium; the richness parameter and information source attribute have lower priorities and their weight values are also lower.

[0094] In this embodiment, taking a group of timeliness parameters including the dynamicity parameter and the timeliness parameter, and a group of timeliness parameters including the hit rate, false alarm rate, richness parameter, and information source attribute as an example, the credibility is shown in formula (12):

[0095] C decayed = ω1 × dyn decayed + ω2 × tim decayed + ω3 × sco + ω4 × mis + ω5 × div + ω6 × sor; (12)

[0096] Among them, C decayed is the credibility of the specified information source combined with the time decay weight, ω1 to ω6 are the weight coefficients of each parameter, dyn decayed is the parameter value of the dynamicity parameter after time decay, tim decayedis the parameter value of the timeliness parameter after time decay, sco is the parameter value of the hit rate, mis is the parameter value of the false alarm rate, div is the parameter value of the richness parameter, and sor is the parameter value of the information source attribute. In particular, the false alarm rate will reduce the credibility score, and the weight coefficient ω4 of the false alarm rate is negative.

[0097] Through this embodiment, adding each parameter weighted to obtain the credibility of the specified information source can obtain the credibility that comprehensively considers various indicators of the information source. This credibility can dynamically adapt to the timeliness change of threat intelligence and improve the accuracy of information source credibility evaluation.

[0098] In an exemplary embodiment, the specified information source is one of multiple information sources; the above method further includes: aggregating the intelligence provided by multiple information sources based on the credibility of each information source in multiple information sources, determining the intelligence to be processed in the intelligence provided by multiple information sources, and performing network security processing corresponding to the intelligence to be processed, where the intelligence to be processed is threat intelligence, and the credibility of the information source providing the intelligence to be processed is greater than or equal to the credibility threshold, and there is no information source with a higher credibility than the information source providing the intelligence to be processed providing intelligence contrary to the intelligence to be processed.

[0099] In order to effectively utilize the credibility determined in the foregoing embodiment, after obtaining the credibility of multiple information sources, the intelligence provided by multiple information sources can be aggregated according to the credibility. In this embodiment, only the intelligence provided by the information source with a credibility greater than or equal to the credibility threshold is processed. Here, the credibility threshold can be set according to experience. For example, it can be a preset fixed value, or the median or average of the credibility of multiple information sources, etc. This embodiment does not limit this.

[0100] In addition, when there is a conflict in the intelligence provided by different information sources, the intelligence provided by the information source with a higher credibility shall prevail, and the intelligence contrary to the above conflict intelligence provided by the information source with a higher credibility shall not be used as the intelligence to be processed, nor will it be subjected to subsequent network security processing. Optionally, the above network security processing corresponds to the type of the intelligence to be processed, and the methods of network security processing may include: firewall rule update, intrusion detection system (IDS) signature library update, black / white list maintenance, etc.

[0101] Through this embodiment, aggregating and processing threat intelligence based on the credibility of multiple information sources can screen and utilize high-quality intelligence, reduce the risk of intelligence misuse, and improve the efficiency and accuracy of network security processing.

[0102] The following explains the processing method of the information source credibility in the embodiments of the present application in combination with optional examples. Figure 4It is a schematic flowchart of the method for processing the credibility of an information source in this optional example. As Figure 4 shown, the flowchart of the method for processing the credibility of the information source may include the following steps S402 to S408.

[0103] Step S402, calculate the time decay weight of the specified information source.

[0104] Step S404, calculate a set of timeliness parameters and a set of validity parameters of the specified information source.

[0105] Step S406, perform time decay on a set of timeliness parameters of the specified information source using the time decay weight.

[0106] Step S408, fuse the time-decayed timeliness parameters and a set of validity parameters to obtain the credibility of the specified information source.

[0107] Through this optional example, introducing the time factor in the credibility assessment ensures that the system can dynamically evaluate the effectiveness of information, reduce the dependence on outdated information, and improve the accuracy of the credibility assessment.

[0108] It should be noted that for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should know that this application is not limited by the described action sequence, because according to this application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0109] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of this application, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as a read-only memory (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to enable a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in various embodiments of this application.

[0110] According to another aspect of the embodiments of the present application, a processing device for the credibility of an information source is further provided. This processing device for the credibility of an information source can be used to implement the method for processing the credibility of an information source provided in the above embodiments, and those that have been described will not be repeated. As used hereinafter, the term "module" can be a combination of software and / or hardware that can achieve a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.

[0111] Figure 5 FIG. is a structural block diagram of an optional processing device for the credibility of an information source according to an embodiment of the present application. As Figure 5 shown in the figure, the processing device for the credibility of an information source includes a first determination unit 502, a second determination unit 504, an adjustment unit 506, and a third determination unit 508.

[0112] The first determination unit 502 is configured to determine the time decay weight of the specified information source based on the release time of the historical information provided by the specified information source within the historical time period.

[0113] The second determination unit 504 is configured to determine the parameter value of each timeliness parameter in a group of timeliness parameters of the specified information source, and determine the parameter value of each validity parameter in a group of validity parameters of the specified information source.

[0114] The adjustment unit 506 is configured to adjust the parameter value of each timeliness parameter using the time decay weight to obtain the adjusted parameter value of each timeliness parameter.

[0115] The third determination unit 508 is configured to determine the fusion result of fusing the adjusted parameter value of each timeliness parameter and the parameter value of each validity parameter as the credibility of the specified information source.

[0116] It should be noted that the first determination unit 502 in this embodiment can be used to execute the above step S202, the second determination unit 504 in this embodiment can be used to execute the above step S204, the adjustment unit 506 in this embodiment can be used to execute the above step S206, and the third determination unit 508 in this embodiment can be used to execute the above step S208.

[0117] Through the embodiments provided in this application, based on the release time of the historical information provided by a specified information source within a historical time period, determine the time decay weight of the specified information source; determine the parameter value of each timeliness parameter in a set of timeliness parameters of the specified information source, and determine the parameter value of each validity parameter in a set of validity parameters of the specified information source; use the time decay weight to adjust the parameter value of each timeliness parameter of the specified information source to obtain the adjusted parameter value of each timeliness parameter of the specified information source; determine the fusion result of fusing the adjusted parameter value of each timeliness parameter of the specified information source and the parameter value of each validity parameter of the specified information source as the credibility of the specified information source. This solves the problems of low accuracy and large limitations existing in the information source credibility evaluation method in the related art, improves the accuracy of information source credibility evaluation, and reduces the limitations of information source credibility evaluation.

[0118] In an exemplary embodiment, the first determination unit includes: a first determination module, configured to determine, as the time weight of each historical information, the value with the natural logarithm as the base and the reference value corresponding to each historical information of the specified information source within the historical time period as the exponent, where the reference value corresponding to each historical information is the product of the specified decay rate and the number of days of release of each historical information, and the specified decay rate is a constant less than zero; a second determination module, configured to determine the average value of the time weights of each historical information as the time decay weight.

[0119] In an exemplary embodiment, the specified information source is one of multiple information sources; the second determination unit includes: a third determination module, configured to, when a set of timeliness parameters includes a dynamicity parameter, determine the quotient of the number of updated historical information provided by the specified information source within the historical time period divided by the number of updated historical information provided by multiple information sources within the historical time period as the parameter value of the dynamicity parameter of the specified information source; a fourth determination module, configured to, when a set of timeliness parameters includes a timeliness parameter, determine the quotient of the number of first-release historical information provided by the specified information source within the historical time period divided by the number of updated historical information provided by the specified information source within the historical time period as the parameter value of the timeliness parameter of the specified information source, where the first-release historical information is the historical information first released by multiple information sources.

[0120] In an exemplary embodiment, a specified information source is one of a plurality of information sources; the second determination unit includes: a fifth determination module, configured to, when a set of timeliness parameters includes a hit rate, determine the quotient of the number of historical information hits of the specified information source in a historical time period divided by the total number of queries of the specified information source in the historical time period as the parameter value of the hit rate of the specified information source, where the historical information hits are historical information marked as correct; a sixth determination module, configured to, when a set of timeliness parameters includes a false alarm rate, determine the quotient of the number of times the historical information provided by the specified information source in the historical time period is mislabeled as threat information divided by the total number of times the historical information provided by the specified information source in the historical time period is labeled as threat information as the parameter value of the false alarm rate of the specified information source; a seventh determination module, configured to, when a set of timeliness parameters includes a richness parameter, determine the quotient of the number of fields in the information provided by the specified information source and the number of fields included in the union of the fields in the information provided by the plurality of information sources as the parameter value of the richness parameter of the specified information source; an eighth determination module, configured to, when a set of timeliness parameters includes an information source attribute, determine the attribute value of the information source attribute corresponding to the information source type of the specified information source as the parameter value of the information source attribute of the specified information source, where the information source type of the specified information source is one of a set of information source types, and each information source type in the set of information source types has a corresponding parameter value of the information source attribute.

[0121] In an exemplary embodiment, the adjustment unit includes: a ninth determination module, configured to determine the product of the parameter value of each timeliness parameter of the specified information source and the time decay weight as the adjusted parameter value of each timeliness parameter of the specified information source.

[0122] In an exemplary embodiment, the third determination unit includes: a tenth determination module, configured to determine the result of weighted summation of the adjusted parameter values of each timeliness parameter of the specified information source and the parameter values of each validity parameter of the specified information source as the credibility of the specified information source.

[0123] In an exemplary embodiment, a specified information source is one of a plurality of information sources; the above device further includes: an execution unit, configured to aggregate the information provided by the plurality of information sources based on the credibility of each information source in the plurality of information sources, determine the information to be processed in the information provided by the plurality of information sources, and perform network security processing corresponding to the information to be processed, where the information to be processed is threat information, the credibility of the information source providing the information to be processed is greater than or equal to a credibility threshold, and no information source with a higher credibility than the information source providing the information to be processed provides information contrary to the information to be processed.

[0124] It should be noted that the above-mentioned modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to this: the above-mentioned modules are all located in the same processor; or, the above-mentioned modules are respectively located in different processors in any combination form.

[0125] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein when the program runs, it executes the steps in any one of the above method embodiments.

[0126] In an exemplary embodiment, the above computer-readable storage medium may include, but is not limited to: various media such as USB flash drives, ROMs, RAMs, mobile hard disks, magnetic disks, or optical discs that can store computer programs.

[0127] According to another aspect of the embodiments of the present application, an electronic device is provided, including a memory, a processor, and a computer program stored on the memory and executable on the processor. The processor is configured to execute the steps in any one of the above method embodiments through the computer program. In an exemplary embodiment, the above electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the above processor, and the input / output device is connected to the above processor.

[0128] The specific examples in this embodiment may refer to the examples described in the above embodiments and exemplary embodiments, and will not be repeated here.

[0129] According to another aspect of the embodiments of the present application, a computer program product is further provided. The computer program product includes computer programs / instructions, and the computer programs / instructions include program codes for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit 601, it executes various functions provided by the embodiments of the present application. The serial numbers of the above embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0130] Figure 6 Schematically shows a block diagram of a computer system of an electronic device for implementing the embodiments of the present application. As Figure 6As shown, computer system 600 includes a Central Processing Unit (CPU) 601, which can perform various appropriate actions and processes according to the programs stored in ROM 602 or the programs loaded into RAM 603 from storage section 608. In random access memory 603, various programs and data required for system operation are also stored. The central processing unit 601, read-only memory 602, and random access memory 603 are connected to each other via bus 604. An Input / Output (I / O) interface 605 is also connected to bus 604.

[0131] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including, for example, a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), etc. and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a local area network card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed so that a computer program read from it can be installed into the storage section 608 as needed.

[0132] Specifically, according to an embodiment of the present application, the processes described in each method flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program codes for executing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from the network through the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit 601, various functions defined in the system of the present application are executed.

[0133] It should be noted that Figure 6 The computer system 600 of the electronic device shown is only an example and should not impose any restrictions on the functions and scope of use of the embodiments of the present application.

[0134] Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present application can be implemented by a general-purpose computing device. They can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. They can be implemented by program codes executable by the computing device. Thus, they can be stored in a storage device and executed by the computing device. And in some cases, the steps shown or described can be executed in a different order from here, or they can be separately made into individual integrated circuit modules, or multiple modules or steps among them can be made into a single integrated circuit module to implement. In this way, the present application is not limited to any specific combination of hardware and software.

[0135] The above are only the preferred embodiments of the present application and are not used to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for processing the credibility of an information source, characterized in that, Including: Determine the time decay weight of the specified information source based on the release time of the historical information provided by the specified information source within the historical time period; Determine the parameter value of each timeliness parameter in a set of timeliness parameters of the specified information source, and determine the parameter value of each validity parameter in a set of validity parameters of the specified information source; Use the time decay weight to adjust the parameter value of each timeliness parameter of the specified information source to obtain the adjusted parameter value of each timeliness parameter of the specified information source; Determine the credibility of the specified information source as the fusion result of fusing the adjusted parameter value of each timeliness parameter of the specified information source and the parameter value of each validity parameter of the specified information source.

2. The method according to claim 1, wherein The determining the time decay weight of the specified information source based on the release time of the historical information provided by the specified information source within the historical time period includes: Determine the time weight of each historical information as the value with the natural logarithm as the base and the reference value corresponding to each historical information of the specified information source within the historical time period as the exponent, where the reference value corresponding to each historical information is the product of the specified decay rate and the number of days since the release of each historical information, and the specified decay rate is a constant less than zero; Determine the average value of the time weights of each historical information as the time decay weight.

3. The method according to claim 1, characterized in that, The specified information source is one of multiple information sources; the determining the parameter value of each timeliness parameter in a set of timeliness parameters of the specified information source includes: When the set of timeliness parameters includes a dynamic parameter, determine the parameter value of the dynamic parameter of the specified information source as the quotient of the number of updated historical information provided by the specified information source within the historical time period divided by the number of updated historical information provided by the multiple information sources within the historical time period; When the set of timeliness parameters includes a timeliness parameter, determine the parameter value of the timeliness parameter of the specified information source as the quotient of the number of first-release historical information provided by the specified information source within the historical time period divided by the number of updated historical information provided by the specified information source within the historical time period, where the first-release historical information is the historical information first released by the multiple information sources.

4. The method according to claim 1, characterized in that The specified information source is one of multiple information sources; the determining the parameter value of each validity parameter in a set of validity parameters of the specified information source includes: When the set of timeliness parameters includes a hit rate, determine the parameter value of the hit rate of the specified information source as the quotient of the number of hit historical information of the specified information source within the historical time period divided by the total number of query times of the specified information source within the historical time period, where the hit historical information is the historical information marked as correct; When the set of timeliness parameters includes a false alarm rate, the quotient obtained by dividing the number of times the historical intelligence provided by the specified information source within the historical time period is mislabeled as threat intelligence by the total number of times the historical intelligence provided by the specified information source within the historical time period is labeled as threat intelligence is determined as the parameter value of the false alarm rate of the specified information source; When the set of timeliness parameters includes a richness parameter, the quotient obtained by dividing the number of fields in the intelligence provided by the specified information source by the number of fields included in the union of the fields in the intelligence provided by the multiple information sources is determined as the parameter value of the richness parameter of the specified information source; When the set of timeliness parameters includes information source attributes, the attribute value of the information source attribute corresponding to the information source type of the specified information source is determined as the parameter value of the information source attribute of the specified information source, where the information source type of the specified information source is one of a set of information source types, and each information source type in the set of information source types has a corresponding parameter value of the information source attribute.

5. The method according to claim 1, characterized in that, The adjusting the parameter value of each timeliness parameter of the specified information source using the time decay weight to obtain the adjusted parameter value of each timeliness parameter of the specified information source includes: Determining the product of the parameter value of each timeliness parameter of the specified information source and the time decay weight as the adjusted parameter value of each timeliness parameter of the specified information source.

6. The method according to claim 1, wherein The fusion result obtained by fusing the adjusted parameter value of each timeliness parameter of the specified information source and the parameter value of each validity parameter of the specified information source is determined as the credibility of the specified information source, including: Determining the result of weighted summation of the adjusted parameter value of each timeliness parameter of the specified information source and the parameter value of each validity parameter of the specified information source as the credibility of the specified information source.

7. The method according to any one of claims 1 to 6, characterized in that The specified information source is one of multiple information sources; the method further includes: Based on the credibility of each information source among the multiple information sources, aggregating the information provided by the multiple information sources, determining the information to be processed in the information provided by the multiple information sources, and performing network security processing corresponding to the information to be processed, where the information to be processed is threat intelligence, and the credibility of the information source providing the information to be processed is greater than or equal to the credibility threshold, and there is no information source with a higher credibility than the information source providing the information to be processed providing information contrary to the information to be processed.

8. A computing device for calculating the credibility of an information source, characterized in that, Including: A first determination unit for determining the time decay weight of the specified information source based on the release time of the historical intelligence provided by the specified information source within the historical time period; A second determination unit for determining the parameter value of each timeliness parameter in a set of timeliness parameters of the specified information source, and determining the parameter value of each validity parameter in a set of validity parameters of the specified information source; An adjustment unit, configured to adjust the parameter value of each timeliness parameter by using the time decay weight to obtain the adjusted parameter value of each timeliness parameter; A third determination unit, configured to determine the fusion result of fusing the adjusted parameter value of each timeliness parameter and the parameter value of each validity parameter as the credibility of the specified information source.

9. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images