Information fusion method and device and electronic equipment

Abstract

The invention provides an information fusion method and apparatus, and an electronic device. The method comprises the steps of obtaining APT organization portrait information of multiple sources; alias list construction and merging are carried out on the APT organization portrait information of the multiple sources, and a preliminary fusion result of the APT organization portraits is obtained; the preliminary fusion result comprises a plurality of tissue sets; and constructing a graph data structure comprising directed edges based on the relationship among the organization aliases, the organization names and the plurality of organization sets in the APT organization portrait information of the plurality of sources, and obtaining a multi-source APT organization fusion result. According to the method, the APT organization portrait information of multiple sources is processed into the fusion result of the graph data structure, the relation of APT organizations of different sources can be visually represented, meanwhile, new nodes and edges can be easily added, and the method is suitable for a multi-source APT organization fusion task with the data source needing to be continuously expanded.

Description

Technical Field

[0001] This application relates to the field of network security technologies, and in particular, to an information fusion method, apparatus, and electronic device. Background Art

[0002] In recent years, network security threats have undergone earth-shaking changes. The use of advanced attack methods to conduct continuous and targeted network attacks on certain institutions has caused advanced persistent threats (APTs) to gradually attract the attention of researchers at home and abroad. Different from traditional network attack means, the attack targets of APTs have changed from common service interruptions to stealing target intellectual property rights and sensitive data, and have characteristics such as strong phasing, long duration, and diverse attack paths.

[0003] The actors who implement APT attacks are usually attackers or attack organizations with high resources, technologies, and organizational capabilities, which can be called APT organizations. Given the harm of APT attacks, many domestic and foreign manufacturers and institutions have collected and sorted out APT organization information and constructed APT organization portraits to better prevent APT attacks. However, different manufacturers have different naming rules for the APT organizations they have discovered, resulting in many different APT names actually pointing to the same threat organization, making it difficult to effectively integrate APT organization portrait information from different sources, weakening the correct relevance of attack behaviors, and at the same time reducing the quality of APT organization portraits. Summary of the Invention

[0004] The purpose of this application is to provide an information fusion method, apparatus, and electronic device, which can process APT organization portrait information from multiple sources into a fusion result in a graph data structure, which can intuitively represent the relationships between APT organizations from different sources, and at the same time has flexibility and scalability, and can easily add new nodes and edges to adapt to dynamically changing data sets, especially suitable for multi-source APT organization fusion tasks where data sources need to be continuously expanded.

[0005] In a first aspect, this application provides an information fusion method, the method including: obtaining APT organization portrait information from multiple sources; the APT organization portrait information including: multiple attributes and corresponding attribute values; the attributes at least including: organization name, organization alias; constructing and merging alias lists for the APT organization portrait information from multiple sources to obtain a preliminary fusion result of the APT organization portrait; the preliminary fusion result including: multiple organization sets; constructing a graph data structure including directed edges based on the relationships between the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources to obtain a multi-source APT organization fusion result; wherein, there are directed edges between mutually similar organization aliases in the graph data structure, and different organizations with the same or similar organization aliases belong to the same organization set.

[0006] Further, the step of constructing and merging the alias lists for the APT organization portrait information from multiple sources to obtain the preliminary fusion result of the APT organization portrait includes: obtaining the alias lists corresponding to the APT organization portrait information from multiple sources respectively; constructing a dictionary based on the alias lists from multiple sources, where the keys of the dictionary are the list elements and the key values are the list identifiers; and based on the dictionary, using the depth-first algorithm to attribute the key values with at least one identical element to the same organization set to obtain the preliminary fusion result of the APT organization portrait.

[0007] Further, before the step of constructing and merging the alias lists for the APT organization portrait information from multiple sources to obtain the preliminary fusion result of the APT organization portrait, it also includes: if the identifiers of the same attribute in the APT organization portrait information from different sources are different, modifying the identifiers to be consistent.

[0008] Further, the step of constructing a dictionary based on the alias lists from multiple sources includes: sorting the alias lists from multiple sources to determine the serial number corresponding to each alias list; determining the serial number as the list identifier corresponding to the alias list; and constructing a dictionary with the list elements as keys and the key values corresponding to the list identifiers.

[0009] Further, the step of constructing a graph data structure including directed edges based on the relationship between the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources to obtain the multi-source APT organization fusion result includes: storing the values corresponding to the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources as nodes in the graph data structure respectively; and adding directed edges with a specified name between the nodes in the graph data structure according to the relationship between the organization alias and the organization name, and the relationship between the organization name and the organization set to form the graph data structure.

[0010] Further, the step of adding directed edges with a specified name between the nodes in the graph data structure according to the relationship between the organization alias and the organization name, and the relationship between the organization name and the organization set to form the graph data structure includes: naming the directed edge from the organization alias to the organization name as the first specified name, which is used to indicate that the alias belongs to the organization name; and naming the directed edge from the organization name to the organization set as the second specified name, which is used to indicate that the organization name is a member of the organization set.

[0011] Further, after the step of adding directed edges corresponding to a specified name between nodes in the graph data structure according to the relationship between the organization alias and the organization name, and the relationship between the organization name and the organization set, the method further includes: calculating the similarity between every two organization aliases in the graph data structure; for two organization aliases whose similarity exceeds a threshold, adding a directed edge labeled with a third specified name between the two organization aliases, where the third specified name indicates that the two organization aliases are similar.

[0012] Further, the step of calculating the similarity between every two organization aliases in the graph data structure includes: for every two organization aliases in the graph data structure, performing the following steps: removing a specific pattern string from the strings corresponding to the two organization aliases; calculating the edit distance between the two strings after removing the specific pattern string; determining the similarity between the two organization aliases based on the edit distance.

[0013] Further, the step of determining the similarity between two organization aliases based on the edit distance includes: using the ratio of the edit distance to a target value as the similarity between the two organization aliases; where the target value is the maximum string length among the string lengths of the two organization aliases.

[0014] In a second aspect, the present application further provides an information fusion device, including: an information acquisition module, configured to acquire APT organization portrait information from multiple sources; the APT organization portrait information includes: multiple attributes and corresponding attribute values; the attributes at least include: organization name, organization alias; a first fusion module, configured to construct and merge an alias list for the APT organization portrait information from multiple sources to obtain a preliminary fusion result of the APT organization portrait; the preliminary fusion result includes: multiple organization sets; a second fusion module, configured to construct a graph data structure including directed edges based on the relationships between the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources to obtain a multi-source APT organization fusion result; where there are directed edges between organization aliases that are similar to each other in the graph data structure, and different organizations with the same or similar organization aliases belong to the same organization set.

[0015] In a third aspect, the present application further provides an electronic device, including a processor and a memory, where the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the method described in the first aspect above.

[0016] In a fourth aspect, the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are called and executed by a processor, the computer-executable instructions cause the processor to implement the method described in the first aspect above.

[0017] In the information fusion method, device and electronic device provided by the present application, first, APT organization portrait information from multiple sources is obtained; the APT organization portrait information includes: multiple attributes and corresponding attribute values; the attributes at least include: organization name, organization alias; then, an alias list is constructed and merged for the APT organization portrait information from multiple sources to obtain a preliminary fusion result of the APT organization portrait; the preliminary fusion result includes: multiple organization sets; finally, based on the relationship between the organization aliases, organization names in the APT organization portrait information from multiple sources and the multiple organization sets, a graph data structure including directed edges is constructed to obtain a multi-source APT organization fusion result; wherein, there are directed edges between mutually similar organization aliases in the graph data structure, and different organizations with the same or similar organization aliases belong to the same organization set. The present application processes the APT organization portrait information from multiple sources into a fusion result of a graph data structure, which can realize the association of names pointing to the same APT organization; in addition, the graph data structure can intuitively represent the relationship between APT organizations from different sources, and at the same time has flexibility and scalability, and can quickly add new nodes and edges to adapt to dynamically changing data sets, especially suitable for multi-source APT organization fusion tasks where the data source needs to be continuously expanded. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings required for use in the description of the specific embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0019] Figure 1 It is a flowchart of an information fusion method provided by an embodiment of the present application;

[0020] Figure 2 It is a flowchart of another information fusion method provided by an embodiment of the present application;

[0021] Figure 3 It is a schematic diagram of organization information provided by an embodiment of the present application;

[0022] Figure 4 It is a schematic diagram of a multi-source APT organization fusion result provided by an embodiment of the present application;

[0023] Figure 5 It is a structural block diagram of an information fusion device provided by an embodiment of the present application;

[0024] Figure 6 It is a schematic structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0025] The technical solution of the present application will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative work belong to the scope of protection of the present application.

[0026] Currently, there are the following two ways to construct an APT organization portrait:

[0027] The first one: The method for constructing an APT organization portrait based on a knowledge graph. By collecting APT organization threat intelligence information, through natural language processing, the unstructured data and semi-structured data collected are transformed into key intelligence of structured data that can be used. The key intelligence is extracted and saved in the form of triples, an APT threat intelligence graph database is built, and through the intelligence storage of the graph database, an APT organization portrait graph is constructed. This method focuses on the collection and collation of APT organization threat intelligence and storing it in the graph database, but does not give the fusion techniques for multi-source APT organization information. After the graph is constructed, the scalability is not good, and it is difficult to effectively associate APT organizations with different names.

[0028] The second one: The construction of a knowledge graph for network APT detection based on semi-supervised guidance. By collecting a large amount of open-source APT threat data, the acquisition of APT knowledge is realized by using a deep learning cascade model structure. Then, aiming at the multi-source heterogeneity of the data, a semi-supervised Bootstrap knowledge fusion method is adopted to automatically construct an APT knowledge graph. Next, aiming at the accuracy of APT attack detection and recognition, an APT attack detection scheme based on the Bert+BiLSTM+Self-Attention+CRF model is proposed. The Bert model extracts text features, the BILSTM extracts the relationship between the input statement and the context, the Self-Attention mechanism is fused to focus on the semantics in the context and the relationship between APT entities, and the CRF model extracts the globally optimal output label sequence according to the dependency relationship between the labels to obtain the APT attack named entity. The focus of this technology is on the research of APT knowledge acquisition and APT attack detection schemes. Deep learning models are used to identify attack events, and triple data is obtained and formed into an APT knowledge graph. In the process of graph fusion, a semi-supervised Bootstrapping scheme is adopted. This scheme needs to complete the representation learning of the graph when performing entity alignment and requires a large number of manual annotations to obtain an entity alignment data set. This process consumes a large amount of human resources and still cannot guarantee the quality of the final entity alignment.

[0029] Based on this, the embodiments of the present application provide an information fusion method, apparatus, and electronic device, which process APT organization portrait information from multiple sources into a fusion result in a graph data structure, and can associate the names pointing to the same APT organization; using the graph data structure can intuitively represent the relationships of APT organizations from different sources, and at the same time has flexibility and scalability, and can easily add new nodes and edges to adapt to dynamically changing data sets, especially suitable for the multi-source APT organization fusion task where the data source needs to be continuously expanded.

[0030] To facilitate the understanding of this embodiment, first, a detailed introduction to an information fusion method disclosed in the embodiments of the present application will be given.

[0031] Figure 1 The following is a flowchart of an information fusion method provided by the embodiments of the present application. The method specifically includes the following steps:

[0032] Step S102, obtain APT organization portrait information from multiple sources; the APT organization portrait information includes: multiple attributes and corresponding attribute values; the attributes at least include: organization name, organization alias.

[0033] In specific implementation, APT organization portrait information can be collected from multiple sources, such as public platforms like Malpedia and Etda. In this embodiment, the collection method of multi-source APT organizations is not limited. Theoretically, the richer the data collection sources of APT organization portraits, the more and more comprehensive APT organization information can be provided by the finally fused APT organization portraits. An APT organization portrait information usually includes attribute values corresponding to multiple attributes; the multiple attributes can include: organization name, organization alias, and the organization name is the original name of the organization; further, the multiple attributes can also include: the country to which the APT organization belongs, the attacking country, the targeted industry name, description information, attack means, etc.

[0034] Step S104, construct and merge alias lists for the APT organization portrait information from multiple sources to obtain a preliminary fusion result of the APT organization portraits; the preliminary fusion result includes: multiple organization sets.

[0035] This step mainly makes a preliminary division of the APT organization portrait information from multiple sources according to the name (including the organization name and alias) to determine multiple organization sets, that is, multiple groups.

[0036] Exemplarily, the implementation process of step S104 can include: constructing an alias list, forming a dictionary based on the constructed multiple alias lists, and grouping organizations based on the dictionary. The specific implementation process will be described in detail later.

[0037] Step S106: Based on the relationships among the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources, construct a graph data structure including directed edges to obtain the multi-source APT organization fusion result.

[0038] Among them, there are directed edges between mutually similar organization aliases in the graph data structure, and different organizations with the same or similar organization aliases belong to the same organization set. In this step, mainly the above three types of information, namely: organization aliases, organization names, and organization sets, are used as nodes respectively to construct a graph data structure including directed edges. The construction of the directed edges is based on the relationships among the above three types of information. The multi-source APT organization fusion result obtained in this way can intuitively represent the relationships of APT organizations from different sources.

[0039] In the information fusion method provided by the embodiments of the present application, the APT organization portrait information from multiple sources is initially fused through the construction and merging of the alias list, that is, organization division is performed to determine multiple organization sets, and then based on the organization name, organization alias, and organization set, it is processed into a fusion result of a graph data structure including directed edges. In this way, the naming pointing to the same APT organization can be associated; using the graph data structure to represent the multi-source APT organization fusion result can intuitively represent the relationships of APT organizations from different sources, and at the same time has flexibility and scalability, and new nodes and edges can be easily added to adapt to the dynamically changing data set, especially suitable for the multi-source APT organization fusion task where the data source needs to be continuously expanded.

[0040] The embodiments of the present application also provide another information fusion method, which is implemented on the basis of the above embodiments; this embodiment focuses on describing the initial fusion process and the final fusion process.

[0041] See Figure 2 As shown, the entire processing flow includes the following steps:

[0042] (1) Multi-source APT organization search.

[0043] That is, obtain the APT organization portrait information from multiple sources; the APT organization portrait information includes: multiple attributes and corresponding attribute values; the attributes at least include: organization name, organization alias.

[0044] (2) Attribute alignment to obtain the attribute alignment result.

[0045] Specifically, it can be detected whether the expression methods of the attributes in the APT organization portrait information from multiple sources are consistent. If the identifiers of the same attribute in the APT organization portrait information from different sources are different, the identifiers are modified to be consistent.

[0046] For example, if Source 1 describes the country to which an APT belongs using the field "Nation", and Source 2 uses the field "Country" to describe the country to which an APT belongs, then uniformly name the description field for the country to which all sources' APTs belong as "Country". This step can eliminate the ambiguity between the naming specifications of different sources, so as to associate the names pointing to the same APT organization later.

[0047] (3) Select key attributes to form an alias list.

[0048] That is, the step of obtaining the alias lists corresponding to the APT organization portrait information from multiple sources. The specific process can include the following: For the APT organization portrait information of each source, extract the organization name and organization alias from the APT organization portrait information to form an alias list.

[0049] Such as Figure 3 a piece of data from Malpedia as shown; where "synonyms" represents the alias information of the "UAC-0020" organization collected by this source. Then use the elements among them to construct the alias list of the organization, and name it Alias_list. This Alias_list needs to include the original name of the organization. For example, the Alias_list obtained from the above data is: ["Vermin", "SickSync", "UAC-0020"].

[0050] (4) Obtain the preliminary fusion result of APT organizations through the depth-first search algorithm.

[0051] Specifically, it is achieved through the following steps:

[0052] (4.1) Based on the alias lists from multiple sources, construct a dictionary; the keys of the dictionary are the list elements, and the key values are the list identifiers.

[0053] Sort the alias lists from multiple sources to determine the serial number corresponding to each alias list; determine the serial number as the list identifier corresponding to the alias list; construct a dictionary with the list elements as keys and the key values corresponding to the list identifiers as the key values.

[0054] For example, according to all the Alias_lists, construct a dictionary Element_to_number. The key of the dictionary is the element in the Alias_list, and the value of the dictionary is the identification number corresponding to the Alias_list.

[0055] (4.2) Based on the dictionary, use the depth-first algorithm to assign the key values with at least one same element to the same organization set to obtain the preliminary fusion result of the APT organization portrait.

[0056] It can be considered that the APT organization portrait information from different sources with the same alias should belong to the same item. Using the depth-first algorithm, according to all the Alias_list data in the dictionary, the APT organization information identifiers that belong to the same item are stored in a tuple. For example, if the APT organization information with identifiers 5, 100, and 900 belongs to the same item, then (5, 100, 900) is obtained and named Group.

[0057] Depth-First Search (DFS) is an algorithm used to traverse or search graph or tree data structures. The algorithm searches the branches of the graph as deeply as possible until the end is reached, and then backtracks to continue searching the next path. DFS can be implemented using a stack data structure, either recursively or with an explicit stack.

[0058] So far, the preliminary fusion of the APT organization portrait has been completed, that is, the different organization information with the same alias is associated with Group. Here, Group can be identified with a number as the ID of each Group.

[0059] Since the organization information with slightly different aliases may also be related. For example, the alias information in one source is "red_october", and in another source, it is recorded as "RedOctober". These two aliases should belong to the same APT organization, but due to different naming standards in different sources, the association cannot be completed through the above steps. Further fusion of different APT organization information is required.

[0060] (5) Similarity screening to generate a graph data structure.

[0061] This step corresponds to the step of "constructing a graph data structure including directed edges based on the relationships between organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources to obtain the multi-source APT organization fusion result". The specific implementation process can include the following:

[0062] (5.1) Store the values corresponding to the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources as nodes in the graph data structure.

[0063] Store the organization alias, APT organization name, and organization set Group as nodes in the graph data structure respectively. Using the relationship between the organization alias and the APT organization name, and the relationship information between the APT organization name and the organization set Group, add directed edges in the graph data structure;

[0064] (5.2) Add directed edges corresponding to the specified name in the graph data structure according to the relationship between the organization alias and the organization name, and the relationship between the organization name and the organization set, to form the graph data structure.

[0065] (5.2.1) Name the directed edge from the organization alias to the organization name as the first specified name, indicating that the alias belongs to the organization name.

[0066] As an example, the directed edge from the organization alias to the APT organization name can be named "ATTRIBUTE", which can be used to indicate that the organization alias belongs to the APT organization.

[0067] (5.2.2) Name the directed edge from the organization name to the organization set as the second specified name, indicating that the organization name is a member of the organization set.

[0068] As an example, the directed edge from the APT organization name to the organization set Group can be named "IS", which can be used to indicate that the organization name is a member of the organization set Group.

[0069] (5.2.3) Calculate the similarity between every two organization aliases in the graph data structure; for two organization aliases whose similarity exceeds the threshold, add a directed edge labeled with the third specified name between the two organization aliases, and the third specified name indicates that the two organization aliases are similar, that is, it indicates that the similarity between the two organization aliases exceeds the threshold.

[0070] In this embodiment, the similarity threshold can be set according to expert experience. In particular, the similarity threshold can be set to 0.9. If the calculated similarity between two APT organization names name1 and name2 is greater than the similarity threshold, then add a directed edge from name1 to name2 in the graph data structure and name it "SIMILARITY" (alternatively, it can also be from name2 to name1, and only one directed edge needs to be added between name1 and name2).

[0071] The process of calculating the similarity between every two alias strings is described in detail below.

[0072] There are various ways to measure the similarity of strings. In this embodiment, the method for calculating the string similarity is not limited. In particular, the normalized edit distance between strings can be selected as the measurement index for string similarity.

[0073] In some examples, the process of calculating the similarity between every two alias strings is as follows:

[0074] For every two organization aliases in the graph data structure, the following steps are performed:

[0075] A. Remove specific pattern strings from the strings corresponding to two organizational aliases.

[0076] Here, the specific pattern string can be a character in the string of the organizational alias that interferes with the similarity calculation.

[0077] When calculating the edit distance between two alias characters, it is necessary to remove the common specific pattern strings in the alias characters, because such pattern strings will increase the similarity between characters, but often have little significance for judging the alias pointing of APT organizations. For example, for the two names APT-C-19 and APT-C-12, only one character is different, but they obviously point to different APT organizations. "APT-C-" is a common specific pattern string that needs to be removed.

[0078] In this embodiment, the specific pattern strings to be removed can be summarized first and a specific pattern string list, patten_list, can be formed. For each APT organizational alias name, use regular matching to remove the specific pattern strings in the pattern_list and record the specific pattern strings removed by the alias.

[0079] B. Calculate the edit distance between the two strings after removing the specific pattern strings.

[0080] Exemplarily, first compare whether the same specific pattern string is removed from each pair of names. If so, calculate the edit distance between the corresponding name’ (name’ represents the alias after removing the specific pattern string) of each pair of names; if not, calculate the edit distance between the two names.

[0081] The edit distance, also known as the Levenshtein distance. This distance is defined as the minimum number of edit operations (inserting, deleting, or replacing characters) between two strings to make one string become the other string.

[0082] C. Use the ratio between the edit distance and the target value as the similarity between the two organizational aliases; where the target value is the maximum string length among the string lengths of the two organizational aliases.

[0083] For example, use the following specified formula to normalize the edit distance to between 0 and 1 as a measure of similarity:

[0084]

[0085] Among them, a represents the string length of the first organizational alias among the two organizational aliases, b represents the string length of the second organizational alias among the two organizational aliases, the denominator of the formula is the maximum value of the string length a and the string length b, and the numerator is the edit distance between a and b.

[0086] In some examples, a graph data structure constructed by adopting the foregoing steps may be referred to Figure 4 as shown in the figure: Among them, node 1141 and node 154 respectively represent the identifiers corresponding to the organization set; node Bouncing_Golf having a directed edge with node 1141 and node Domestic Kitten having a directed edge with node 154 respectively represent the names of APT organizations; other nodes all represent organization aliases.

[0087] (6) Manually review to obtain the final multi-source APT organization fusion result.

[0088] In some examples, after the steps of obtaining the multi-source APT organization fusion result, it further includes: presenting the graph data structure to a specified user; updating the graph data structure according to the modification operation of the directed edge in the graph data structure by the specified user; the modification operation includes deletion or addition of a directed edge.

[0089] In the graph data structure, manually review the two nodes linked by the "SIMILARITY" edge to verify whether they point to the same APT organization. If so, retain the "SIMILARITY" directed edge; if not, remove the edge from the graph structure.

[0090] In this way, the updated graph data structure integrates multi-source APT organization information, is richer in content, has a more accurate alias correlation between APT organizations, and is easy to expand new sources.

[0091] For example Figure 4 in the figure, the string names of the two nodes are "Bouncing_Golf" and "Bouncing Golf" respectively, and they obviously point to the same APT organization, so the "SIMILARITY" directed edge between node Bouncing_Golf and node Bouncing Golf is retained. When all the "SIMILARITY" directed edges are reviewed, the final multi-source APT organization fusion result is obtained. The information fusion method provided by the embodiments of the present application can be applied to the following multiple scenarios: collection and collation of APT organization portraits; APT traceability, APT correlation analysis; supplementation of new aliases for APT organizations; construction of APT organization knowledge graphs; construction of APT organization portrait professional knowledge bases; construction of APT organization intelligent expert protection measure Q&A systems.

[0092] The information fusion method provided in this embodiment can collect information from multiple APT organization information sources, use the alias string itself and the similarity of alias strings as the main evidence for APT organization association, set a similarity threshold to screen the similarity of APT organization names, construct a graph data structure to store multiple different types of nodes and the association relationships between nodes, and manually review the association relationships of APT organizations in the graph data structure to update the multi-source fusion result of APT organization information.

[0093] In summary, the advantages of the embodiments of the present application are as follows:

[0094] First, collect APT organization information from multiple sources, and fuse the APT organization information from multiple sources with a complete set of solutions, so that the APT organization information obtained after fusion is more comprehensive. At the same time, in this embodiment, a graph database is used for the fusion operation in an interactive manner with humans, which not only ensures the accuracy of information fusion, but also reduces the work intensity of humans when performing information fusion, simplifies the manual operation steps, and makes the process of manual review more intuitive.

[0095] Second, in this embodiment, before manual review, string similarity is used to set a similarity threshold to screen the APT organization names to be reviewed, which greatly reduces the workload of manual review and effectively increases the feasibility of the solution.

[0096] Finally, in this embodiment, the advantages of intuitive and easy-to-expand graph data structure are utilized, and the convenience of fusing more APT organization information sources is retained. When new APT organization information sources need to be incorporated, corresponding nodes and relationship edges can be directly added to the graph structure.

[0097] Based on the above method embodiments, the embodiments of the present application also provide an information fusion device. Refer to Figure 5 As shown, the device includes: an information acquisition module 52, configured to acquire APT organization portrait information from multiple sources; the APT organization portrait information includes: multiple attributes and corresponding attribute values; the attributes at least include: organization name, organization alias; a first fusion module 54, configured to construct and merge an alias list for the APT organization portrait information from multiple sources to obtain a preliminary fusion result of the APT organization portrait; the preliminary fusion result includes: multiple organization sets; a second fusion module 56, configured to construct a graph data structure including directed edges based on the relationship between the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources to obtain a multi-source APT organization fusion result; wherein, there are directed edges between organization aliases that are similar to each other in the graph data structure, and different organizations with the same or similar organization aliases belong to the same organization set.

[0098] Further, the first fusion module 54 is configured to obtain alias lists corresponding to APT organization portrait information from multiple sources; construct a dictionary based on the alias lists from multiple sources, where the keys of the dictionary are list elements and the key values are list identifiers; based on the dictionary, use the depth-first algorithm to attribute the key values with at least one identical element to the same organization set, so as to obtain a preliminary fusion result of the APT organization portrait.

[0099] Further, the first fusion module 54 is configured to: if the identifiers of the same attribute in the APT organization portrait information from different sources are different, modify the identifiers to be consistent.

[0100] Further, the first fusion module 54 is configured to sort the alias lists from multiple sources, determine the serial number corresponding to each alias list, determine the serial number as the list identifier corresponding to the alias list, and construct a dictionary with the list element as the key and the key value corresponding to the list identifier as the value.

[0101] Further, the step of constructing a graph data structure including directed edges based on the relationships among the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources to obtain a multi-source APT organization fusion result includes: storing the values corresponding to the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources as nodes in the graph data structure; adding directed edges with a specified name between the nodes in the graph data structure according to the relationship between the organization alias and the organization name, and the relationship between the organization name and the organization set, so as to form a graph data structure.

[0102] Further, the second fusion module 56 is configured to name the directed edge from the organization alias to the organization name as a first specified name, which is used to indicate that the alias belongs to the organization name; and name the directed edge from the organization name to the organization set as a second specified name, which is used to indicate that the organization name is a member of the organization set.

[0103] [[ID=##]]Further, the second fusion module 56 is configured to: calculate the similarity between every two organization aliases in the graph data structure; for two organization aliases whose similarity exceeds the threshold, add a directed edge marked with a third specified name between the two organization aliases, and the third specified name indicates that the two aliases are similar.

[0104] Further, the second fusion module 56 is configured to: for every two organization aliases in the graph data structure, perform the following steps: remove the specific pattern string in the strings corresponding to the two organization aliases; calculate the edit distance between the two strings after removing the specific pattern string; and determine the similarity between the two organization aliases based on the edit distance.

[0105] Further, the second fusion module 56 is configured to: use the ratio between the edit distance and the target value as the similarity between two organization aliases; where the target value is the maximum string length among the string lengths of the two organization aliases.

[0106] The device provided in the embodiment of the present application has the same implementation principle and the same technical effects as those in the foregoing method embodiment. For a brief description, for the parts not mentioned in the embodiment of the device, reference may be made to the corresponding content in the foregoing method embodiment.

[0107] The embodiment of the present application also provides an electronic device, as Figure 6 shown, which is a schematic structural diagram of the electronic device. Among them, the electronic device includes a processor 61 and a memory 60. The memory 60 stores computer-executable instructions that can be executed by the processor 61, and the processor 61 executes the computer-executable instructions to implement the above information fusion method.

[0108] In Figure 6 the shown embodiment, the electronic device further includes a bus 62 and a communication interface 63. Among them, the processor 61, the communication interface 63, and the memory 60 are connected through the bus 62.

[0109] Among them, the memory 60 may include a high-speed random access memory (RAM, Random Access Memory), and may also include a non-volatile memory, such as at least one disk memory. Through at least one communication interface 63 (which may be wired or wireless), a communication connection is realized between the system network element and at least one other network element, and the Internet, a wide area network, a local area network, a metropolitan area network, etc. can be used. The bus 62 may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 62 can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience of representation, Figure 6 only a bidirectional arrow is used in

[0110] The processor 61 may be an integrated circuit chip with the ability to process signals. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in the processor 61 or the instructions in the form of software. The above-mentioned processor 61 may be a general-purpose processor, including a central processing unit (CPU for short), a network processor (NP for short), etc.; it may also be a digital signal processor (DSP for short), an application specific integrated circuit (ASIC for short), a field-programmable gate array (FPGA for short) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed and completed by the hardware decoding processor, or executed and completed by the combination of the hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. This storage medium is located in the memory, and the processor 61 reads the information in the memory and combines its hardware to complete the steps of the information fusion method in the foregoing embodiments.

[0111] The embodiments of the present application also provide a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by the processor, the computer-executable instructions cause the processor to implement the above information fusion method. For the specific implementation, reference can be made to the foregoing method embodiments, and details are not described herein again.

[0112] The computer program product of the method, device and electronic device provided by the embodiments of the present application includes a computer-readable storage medium storing program codes. The instructions included in the program codes can be used to execute the method described in the foregoing method embodiments. For the specific implementation, reference can be made to the method embodiments, and details are not described herein again.

[0113] Unless otherwise specifically stated, the relative steps, numerical expressions and values of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0114] When the above-mentioned functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium executable by a processor. Based on such understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application. The foregoing storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs.

[0115] The embodiments or examples of the present disclosure are not exhaustive. They are only illustrations of some embodiments or examples and do not constitute specific limitations on the protection scope of the present disclosure. Without contradiction, each step in an embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the solution after removing some steps in an embodiment or example can also be implemented as an independent example, and the order of the steps in an embodiment or example can be exchanged arbitrarily. In addition, the optional ways or optional examples in an embodiment or example can be combined arbitrarily; furthermore, the embodiments or examples can be combined arbitrarily. For example, some or all of the steps of different embodiments or examples can be combined arbitrarily, and an embodiment or example can be combined arbitrarily with the optional ways or optional examples of other embodiments or examples.

[0116] In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be construed as indicating or implying relative importance.

[0117] Finally, it should be noted that the above-mentioned embodiments are only specific implementation manners of this application, used to illustrate the technical solution of this application, rather than limiting it. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: any person skilled in the art within the technical scope disclosed by this application can still modify the technical solutions recorded in the foregoing embodiments, or can easily think of changes, or perform equivalent replacements on some of the technical features; and these modifications, changes, or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application and should all be covered within the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

1. An information fusion method, characterized in that, The method includes: Obtaining APT organization portrait information from multiple sources; the APT organization portrait information includes: multiple attributes and corresponding attribute values; the attributes at least include: organization name, organization alias; Constructing and merging alias lists for the APT organization portrait information from multiple sources to obtain a preliminary fusion result of the APT organization portrait; the preliminary fusion result includes: multiple organization sets; Based on the relationships between the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources, constructing a graph data structure including directed edges to obtain a multi-source APT organization fusion result; wherein, there are directed edges between mutually similar organization aliases in the graph data structure, and different organizations with the same or similar organization aliases belong to the same organization set.

2. The method according to claim 1, characterized in that The step of constructing and merging alias lists for the APT organization portrait information from multiple sources to obtain a preliminary fusion result of the APT organization portrait includes: Obtaining the alias lists corresponding to the APT organization portrait information from multiple sources respectively; Constructing a dictionary based on the alias lists from multiple sources; the keys of the dictionary are list elements, and the key values are list identifiers; Based on the dictionary, using the depth-first algorithm to assign the key values with at least one identical element to the same organization set to obtain a preliminary fusion result of the APT organization portrait.

3. The method according to claim 1, wherein Before the step of constructing and merging alias lists for the APT organization portrait information from multiple sources to obtain a preliminary fusion result of the APT organization portrait, it further includes: If the identifiers of the same attribute in the APT organization portrait information from different sources are different, modifying the identifiers to be consistent.

4. The method according to claim 2, characterized in that The step of constructing a dictionary based on the alias lists from multiple sources includes: Sorting the alias lists from multiple sources to determine the serial number corresponding to each alias list; Determining the serial number as the list identifier corresponding to the alias list; Constructing a dictionary with the list elements as keys and the key values corresponding to the list identifiers as the key values.

5. The method according to claim 1, wherein The step of constructing a graph data structure including directed edges based on the relationships between the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources to obtain a multi-source APT organization fusion result includes: Storing the values corresponding to the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources as nodes in the graph data structure; Adding directed edges with a specified name between the nodes in the graph data structure according to the relationship between the organization alias and the organization name, and the relationship between the organization name and the organization set to form a graph data structure.

6. The method according to claim 5, wherein The step of adding directed edges with a specified name between the nodes in the graph data structure according to the relationship between the organization alias and the organization name, and the relationship between the organization name and the organization set to form a graph data structure includes: Naming the directed edge from the organization alias to the organization name as a first specified name, which is used to indicate that the alias belongs to the organization name; naming the directed edge from the organization name to the organization set as a second specified name, which is used to indicate that the organization name is a member of the organization set.

7. The method according to claim 5 or 6, characterized in that, After the step of adding a directed edge corresponding to a specified name between nodes of the graph data structure according to the relationship between the organization alias and the organization name, and the relationship between the organization name and the organization set, the method further includes: Calculating the similarity between every two organization aliases in the graph data structure; For two organization aliases whose similarity exceeds a threshold, adding a directed edge labeled with a third specified name between the two organization aliases, where the third specified name indicates that the two organization aliases are similar.

8. The method according to claim 7, characterized in that The step of calculating the similarity between every two organization aliases in the graph data structure includes: For every two organization aliases in the graph data structure, the following steps are performed: Removing a specific pattern string from the strings corresponding to the two organization aliases; Calculating the edit distance between the two strings after removing the specific pattern string; Determining the similarity between the two organization aliases based on the edit distance; Preferably, the step of determining the similarity between the two organization aliases based on the edit distance includes: Taking the ratio of the edit distance to a target value as the similarity between the two organization aliases; where the target value is the maximum string length of the string lengths of the two organization aliases.

9. An information fusion device, characterized in that The apparatus includes: An information acquisition module, configured to acquire APT organization portrait information from multiple sources; the APT organization portrait information includes: multiple attributes and corresponding attribute values; the attributes at least include: organization name, organization alias; A first fusion module, configured to construct and merge alias lists for the APT organization portrait information from multiple sources to obtain a preliminary fusion result of the APT organization portrait; the preliminary fusion result includes: multiple organization sets; A second fusion module, configured to construct a graph data structure including directed edges based on the relationship between the organization aliases, organization names, and multiple organization sets in the APT organization portrait information from multiple sources to obtain a multi-source APT organization fusion result; wherein, there are directed edges between organization aliases that are similar to each other in the graph data structure, and different organizations with the same or similar organization aliases belong to the same organization set.

10. An electronic device, characterized in that, It includes a processor and a memory, the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the information fusion method according to any one of claims 1 to 8.

Images