Computer system threat intelligence analysis system and method

Abstract

The invention relates to the technical field of data analysis, in particular to a computer system threat intelligence analysis system and method.The method comprises the steps that attack mode features of each attack sample are extracted from a multi-source attack sample library, and an attack mode feature set is formed; generating a new attack mode set by using a genetic algorithm based on the attack mode feature set and a preset constraint condition; performing logic verification on new attack mode characteristics in the new attack mode set, judging whether the new attack mode characteristics conform to attack logic or not, and rejecting the new attack modes which do not conform to the attack logic from the new attack mode set; the identification and labeling module is used for carrying out attack purpose identification on the new attack mode conforming to the attack logic; and the recognition and defense capabilities of a computer system on complex dynamic attacks are improved.

Description

Technical Field

[0001] The present invention relates to the field of data analysis technology, and in particular to a computer system threat intelligence analysis system and method. Background Art

[0002] With the rapid development of information technology, the types and methods of attacks faced by computer systems are becoming increasingly diverse. Traditional threat detection systems can only identify known attack methods and are unable to cope with new and complex attack methods. This is especially true when attackers use a combination of multiple attack methods or flexibly mutate attack methods. Existing detection systems have high false positive and false negative rates and are unable to effectively deal with unknown attacks. The existing solutions are as follows:

[0003] The existing patent 1 has the publication number CN111125694A, which discloses a threat intelligence analysis method and system based on the ant colony algorithm. The patent uses the ant colony algorithm to simulate the pheromone transmission of the attack path, dynamically evaluates the threat risk through the node pheromone concentration, and relies on the predefined attack node topology to generate a single path evolution strategy.

[0004] The existing patent 2 has a publication number of CN119254509A, which discloses a threat intelligence perception method, device, equipment and medium. The patent uses a rapidly expanding random tree (RRT) algorithm to generate attack paths, combines historical threat data to build a network behavior matrix, and triggers alarms through real-time traffic matching matrix rules.

[0005] The existing patent 3 authorization announcement number is CN117272303B, which discloses a method and system for generating malicious code sample variants based on genetic adversarial methods. This patent uses a genetic algorithm to generate malicious code variants, such as instruction replacement and code obfuscation, to bypass the static detection engine and optimize the variant's adversarial properties through adversarial training.

[0006] Existing technical solutions still have significant flaws in the following areas, which restrict the proactive defense capabilities of threat intelligence:

[0007] Existing Patent 1 relies on a predefined attack node topology and assesses the risk of a single path through pheromone concentration; it is unable to generate a complex attack method; Existing Patent 2 expands known attack paths based on the RRT algorithm, relies on a rule base to match real-time traffic, and passively responds to emerging threats; Existing Patent 3, although the code-level variant generation technology can bypass static detection, the generated variants have not verified the feasibility of the actual attack method, resulting in a large number of invalid variants.

[0008] Existing patents 1-3 are all limited to the expansion of known linear paths or mutation of code snippets, and are unable to generate multiple unknown and realistic attack methods, resulting in weak dynamic defense capabilities of computer systems; a logical verification and detection mechanism has not been established, resulting in the generated results being out of touch with actual combat scenarios.

[0009] To this end, the present invention provides a computer system threat intelligence analysis system and method. Summary of the Invention

[0010] In order to solve the above problems, the present invention provides a computer system threat intelligence analysis system.

[0011] The present invention adopts the following technical solution, a computer system threat intelligence analysis method, comprising:

[0012] Extract the attack purpose features and attack method features of each attack sample from the multi-source attack sample library to form an attack method feature set and an attack purpose feature set respectively;

[0013] Based on the attack method feature set and preset constraints, a new attack method set is generated using a genetic algorithm;

[0014] Perform logical verification on the characteristics of new attack methods in the new attack method set to determine whether they conform to the attack logic, and remove new attack methods that do not conform to the attack logic from the new attack method set;

[0015] Identify the attack purpose of new attack methods that conform to the attack logic;

[0016] Combine the new attack method that conforms to the attack logic with its corresponding attack purpose to form a new attack sample, update the attack sample library, train the threat detection model based on the updated attack sample library to form an updated threat detection model, and identify the real-time computer system data based on the updated threat detection model to obtain the attack purpose.

[0017] Furthermore, the constraints include soft implementation constraints and hard implementation constraints. The soft implementation constraints include novelty score, hiddenness score, and implementation cost score, and the hard implementation constraints include feasibility score.

[0018] Furthermore, the method of generating a new attack method set using a genetic algorithm includes:

[0019] Step 1: Encoding and initial population: The extracted attack mode features are used as the encoding of the genetic algorithm individuals; the initial population uses the attack mode feature set as the initial solution set;

[0020] Step 2: Fitness evaluation: Define a fitness function based on preset constraints to calculate the fitness value of each individual in the initial population; if the feasibility score is lower than the preset value, the fitness is set to 0 and the individual is eliminated;

[0021] Step 3: Sort the fitness in descending order and select the first p individuals as the parent individuals;

[0022] Step 4: Perform genetic operations on the parent individuals, including selection, crossover, and mutation operations, to generate new offspring individuals;

[0023] Step 5. Loop Step 2-Step 4: Add new offspring individuals to the population and screen the next generation population according to fitness until the predetermined termination condition is reached. Output the population, which is the new attack method set.

[0024] Furthermore, the fitness value is the weighted sum of the normalized novelty score, feasibility score, concealment score and implementation cost score according to the positive contribution and negative contribution of the constraint conditions.

[0025] Furthermore, the novelty score obtaining method includes:

[0026] Calculate the cosine similarity between the attack method feature vector corresponding to the individual and the existing attack methods in the attack sample library; the difference between 1 and the highest cosine similarity is used as the novelty score;

[0027] Feasibility scores are obtained by:

[0028] Filtering historical data sets that are consistent with the preset operating environment in the historical data sets to obtain a filtered historical data set, wherein the historical data sets record the total number of executions and the number of successful executions of each attack method in each operating environment;

[0029] The success probability of each attack method in the corresponding individual attack method under the preset operating environment is calculated; the average success probability of each attack method is taken as the feasibility score.

[0030] Furthermore, the concealment score represents the difficulty of the existing detection system to identify the characteristics of the individual attack method; the implementation cost score is a comprehensive representation value of the complexity of the attack execution, the amount of resources required, and the difficulty of operation of the individual attack method.

[0031] Furthermore, methods for determining whether the attack logic is met include:

[0032] Check whether the required permission level conflicts with the required resources. If there is a conflict in any of the detections, the corresponding attack method characteristics are judged to be inconsistent with the attack logic, otherwise they are consistent.

[0033] Furthermore, a method for detecting whether the required permission levels conflict includes:

[0034] Obtain the required permission level for each attack method in the new attack method. If the required permission levels for each attack method in a new attack method are inconsistent, it is determined that there is a conflict. Otherwise, there is no conflict.

[0035] Methods for detecting whether required resources conflict include:

[0036] Obtain the resources that each attack method in the new attack method needs to access. If there are opposite operations on the same resource operations that need to be accessed, it is determined that there is a conflict. Otherwise, there is no conflict.

[0037] Furthermore, the required permission level that is consistent in each attack means in a new attack method is used as the final permission level; the timing of each attack means in a new attack method, the final permission level and the accessed resources and resource operations corresponding to each attack means are input into the pre-trained recognition and labeling model to obtain the attack purpose corresponding to the new attack method.

[0038] Furthermore, the recognition and annotation model training method includes:

[0039] Preprocess the previously collected training data set. The training data includes input feature data and attack objectives. The preprocessed input feature data includes the timing of each attack method in the attack mode, the final permission level, and the accessed resources and resource operations corresponding to each attack method.

[0040] The preprocessed input feature data is used as the input of the recognition and annotation model. The recognition and annotation model uses the predicted attack purpose for each set of input feature data as output, the actual attack purpose corresponding to each set of input feature data as the prediction target, and minimizing the sum of the prediction accuracies of all predicted attack purposes as the training goal; until the preset convergence condition is reached, the training is stopped, and the recognition and annotation model is a multi-layer perceptron or a long short-term memory network.

[0041] A computer system threat intelligence analysis system implements a computer system threat intelligence analysis method, including:

[0042] The data extraction module is used to extract the attack mode characteristics of each attack sample from the multi-source attack sample library to form an attack mode feature set;

[0043] The generation module uses genetic algorithms to generate a new attack method set based on the attack method feature set and preset constraints;

[0044] A logic detection module is used to perform logic verification on the characteristics of new attack methods in the new attack method set to determine whether they conform to the attack logic and to remove new attack methods that do not conform to the attack logic from the new attack method set;

[0045] Identification and annotation module, used to identify the attack purpose of new attack methods that conform to the attack logic;

[0046] The update module is used to combine the new attack method that conforms to the attack logic with its corresponding attack purpose to form a new attack sample, update the attack sample library, train the threat detection model based on the updated attack sample library to form an updated threat detection model, and identify real-time computer system data based on the updated threat detection model to obtain the attack purpose.

[0047] Beneficial effects:

[0048] This invention significantly enhances the dynamic adaptability of threat detection systems by automatically generating new attack samples and incorporating an updated attack sample library. This method, based on a genetic algorithm, combines multiple constraints, such as novelty, feasibility, stealth, and implementation cost, to generate a variety of unknown and realistic attack methods. This effectively expands the coverage of training data, increases the diversity of attack patterns, and helps the system detect more variant attacks.

[0049] By continuously updating the attack sample library, the threat detection model can learn more attack method combinations and their attack objectives, thereby improving the recognition rate of unknown attacks. When encountering an unseen attack method combination, the threat detection model can identify it as malicious based on the new attack samples and accurately predict its attack objective, thereby reducing missed reports. New attack samples generated using genetic algorithms cover attack methods not covered by the original sample library, filling gaps in the dataset and enabling the threat detection model to respond to new variants used by attackers. This process not only enhances the threat detection model's ability to detect emerging threats, but also allows it to be iteratively updated as attackers continuously change their strategies, improving its ability to identify and defend against complex dynamic attacks.

[0050] Because the generated new attack samples follow a reasonable perturbation mechanism and are highly consistent with real-world attack behaviors, the threat detection model can effectively identify new attack methods while avoiding false positives for irrelevant or unrealistic noise data. By introducing consistent final permission levels and attack method timing characteristics, the recognition and annotation model can accurately identify the attack intent of each newly generated attack method, ensuring that the recognition and annotation model accurately predicts attack intent in complex attack chains and improving detection accuracy. The updated threat detection model can issue early warnings, detect attack behaviors in a timely manner, and take defensive measures, significantly improving the computer system's defense capabilities in dynamic threat environments. By effectively identifying new attack methods, the threat detection model can respond to potential attacks in advance and prevent further losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A schematic diagram of a computer system threat intelligence analysis system provided by the present invention;

[0052] Figure 2A schematic diagram of the process of generating a new attack method set provided by the present invention;

[0053] Figure 3 A flowchart of a computer system threat intelligence analysis method provided by the present invention. DETAILED DESCRIPTION

[0054] In order to make the technical means, creative features, objectives and effects of the present invention easier to understand, the present invention is further described below with reference to specific diagrams. It should be noted that the embodiments and features in the embodiments of this application can be combined with each other unless they conflict.

[0055] See Figure 1 An embodiment of the present invention provides a computer system threat intelligence analysis system: the system includes a data extraction module, a generation module, a logic detection module, an identification and marking module, and an update module.

[0056] The data extraction module is used to extract attack objective features and attack method features from the multi-source attack sample library for each attack sample, forming an attack method feature set and an attack objective feature set, respectively. The attack objective is the goal the attacker wants to achieve, and the attack method feature is a combination of multiple attack methods, including timing. Attack method feature A is: phishing → web vulnerability → privilege escalation → data exfiltration; attack method feature B is: web vulnerability → privilege escalation → data exfiltration; attack method feature C is: phishing → remote desktop brute force attack → persistence → data encryption; attack method feature D is: supply chain implantation → lateral movement → data exfiltration → system wipe.

[0057] Use the descriptions or labels in the attack sample data as attack objective features. For example, attack method features A and B both have the attack objective of data theft; attack method feature C has the attack objective of ransomware encryption. Attack method feature D has the attack objective of data theft and system damage. Each attack sample can be assigned to one or more attack objectives based on the attack method. Represent the attack objective features as vectors (such as one-hot encoded category vectors). For example, if "data theft" is defined as a category, it can be represented by the vector [1,0,0,...] (with 1 in the attack objective position and 0 in other attack objectives). Representing attack method features as vectors is similar to representing attack objective features as vectors.

[0058] By extracting the attack purpose characteristics and attack method characteristics of each attack sample from the multi-source attack sample library, basic data is provided for the subsequent automatic generation of unknown new attack samples.

[0059] The generation module generates a new attack method set based on the attack method feature set and preset constraints using a natural heuristic algorithm. The method of generating a new attack method set using a natural heuristic algorithm includes:

[0060] The natural heuristic algorithms that can be selected include genetic algorithms, particle swarm optimization algorithms, differential evolution algorithms, etc. In this embodiment, the generation process is described using the genetic algorithm as an example, see Figure 2 shown.

[0061] Step 1: Encoding and initial population: The extracted attack method features are used as the encoding of the genetic algorithm individuals. For example, each individual is represented by an attack method feature vector; the initial population uses the attack method feature set as the initial solution set.

[0062] Step 2: Fitness evaluation. Based on pre-set constraints, a fitness function is defined to calculate the fitness of each individual in the initial population. The design of the fitness function can be combined with the goal of generating new attack samples, such as encouraging the generation of attack methods that are "different from existing samples but reasonable."

[0063] Constraints include soft implementation constraints and hard implementation constraints. Soft implementation constraints include novelty score, concealment score, and implementation cost score. Hard implementation constraints include feasibility score. If the feasibility score is lower than the preset value, the fitness is set to 0 and the individual is eliminated.

[0064] The fitness value is the weighted sum of the normalized novelty score, feasibility score, concealment score, and implementation cost score based on the positive and negative contributions of the constraints. The larger the fitness value, the more novel, feasible, and concealed the attack method corresponding to the individual is, and the lower the implementation cost is. The fitness value is calculated as follows:

[0065] F=α×N+β×E+δ×S-η×C

[0066] Where E is the feasibility score, S is the concealment score, C is the implementation cost score, N is the novelty score, and α, β, δ, and η are preset weights.

[0067] The novelty score measures the difference between the generated new attack method and the existing attack methods in the attack sample library. The novelty score is obtained by:

[0068] Calculate the cosine similarity between the attack method feature vector corresponding to the individual and the existing attack methods in the attack sample library; take the difference between 1 and the highest cosine similarity as the novelty score. The novelty score range is between [0, 1]. The closer the novelty score N is to 1, the newer it is, that is, the more innovative the new attack method corresponding to the individual is. The expression is as follows:

[0069] N = 1 - cos(θ);

[0070] cos(θ) represents cosine similarity. The attack method feature vector is converted into a numerical vector using a feature extraction algorithm (such as TF-IDF or word embedding models). Novelty is one of the core optimization goals. Generating new attack methods aims to capture attack method features that existing models fail to capture.

[0071] The feasibility score represents the probability of success of executing an attack method under the same operating environment. In other words, the feasibility score measures whether the generated attack method can be successfully implemented in reality and reflects the operability of the attack method. The feasibility score is obtained by:

[0072] A historical data set having the same preset operating environment is screened from the historical data set to obtain a screened historical data set. The historical data set records the total number of executions and the number of successful executions of each attack method in each operating environment.

[0073] The success probability of each attack method in the corresponding individual attack method under the preset operating environment is calculated; the average success probability of each attack method is taken as the feasibility score; the feasibility score range is between [0, 1], and the closer to 1, the more feasible it is.

[0074] The stealth score represents the difficulty of identifying the attack method characteristics corresponding to an individual by the existing detection system. The stealth score is obtained by:

[0075] The attack method feature vector corresponding to the individual is input into the pre-trained detection system recognition model to obtain a stealth score. The stealth score ranges from [0, 1]. The closer to 1, the harder the attack is to detect. The stealth of the attack method directly affects whether it can persist in the target system for a long time, affecting the long-term attack capability.

[0076] The training methods for the detection system recognition model include:

[0077] Identification training data is collected in advance, and the identification training data includes attack mode feature vectors and their corresponding concealment scores; the identification training data is used as the input of the detection system recognition model, and the detection system recognition model uses the concealment score predicted for each group of attack mode feature vectors as output, the actual concealment score corresponding to each group of attack mode feature vectors as the prediction target, and the minimization of the sum of the prediction accuracies of all predicted concealment scores as the training target; until the preset convergence condition is reached, the training is stopped, and the detection system recognition model is a decision tree, support vector machine or deep neural network.

[0078] The implementation cost score is a comprehensive representation of the attack execution complexity, required resources, and operational difficulty of the attack method corresponding to the individual attack method. The implementation cost score is obtained as follows:

[0079] The historical datasets are filtered for those with the same pre-set operating environment to obtain the filtered historical datasets. The historical datasets also record the number of successful 0-day vulnerabilities exploited by each attack method in each operating environment. The sum of the number of 0-day vulnerabilities exploited by all attack methods is taken as the number of exploits. The weighted sum of the number of exploits and the number of attack methods in the corresponding attack method is used to obtain the implementation cost score. The implementation cost score ranges from [0, 1], and the closer it is to 1, the more difficult the attack is to execute. The expression is as follows:

[0080] C=a step ×n steps +a 0day ×n 0days ;

[0081] n steps is the number of attack methods in the attack mode corresponding to the individual; n 0days is the quantity used; a step 、a 0day is the preset weight, a step +a 0day = 1; The number of attack methods indicates execution complexity, the number of exploits indicates the amount of resources required and the level of difficulty. Using 0-day vulnerabilities to bypass protection measures has a high implementation cost. This cost directly affects the success of the attack; excessively high costs may render the attack infeasible or ineffective.

[0082] Step 3: Sort the fitness in descending order and select the first p individuals as parents. Individuals with high fitness (indicating a more novel and reasonable combination of means) are given a higher probability of being selected to pass on their characteristics.

[0083] Step 4: Perform genetic operations on the parent individuals, including performing genetic operations such as selection, crossover, and mutation, to generate new offspring individuals. The specific operations are as follows:

[0084] Crossover: Pair the selected parents with each other, exchange some of their attack methods, and generate new offspring individuals. For the attack method feature vector, single-point or multi-point crossover can be used: for example, randomly select the feature vector dimension and replace the dimension of parent individual B with the corresponding value of parent individual A (or vice versa), thereby combining a new attack method that mixes the methods of the two, and producing a new attack method that integrates multiple techniques.

[0085] Mutation: Randomly select some parent individuals and perturb their feature vectors to introduce new changes. For binary features, some bits can be randomly flipped (for example, changing the feature of a certain attack method from 0 to 1 or from 1 to 0). The mutation operation can add new attack method components. For example, if a certain attack method does not appear in the parent generation, there is a certain probability that the mutation will introduce this attack method, that is, the feature bit corresponding to the attack method will be changed from 0 to 1, to simulate new strategies that may be tried in reality.

[0086] Step 5. Loop Step 2-Step 4: Add new offspring individuals to the population and screen the next generation population according to fitness until the predetermined termination condition is reached. Output the population, which is the new attack method set.

[0087] Through the above genetic evolution process, a large number of new attack methods can be automatically generated. The new attack methods are "recombinant variants" of the original attack methods, filling in the space where the original attack methods do not cover the pattern. For example:

[0088] The attack mode feature vector of parent individual K is [1, 0, 1, 1], and the attack mode feature vector of parent individual V is [0, 1, 1, 1], corresponding to the time series of phishing, web vulnerability, privilege escalation, and data leakage.

[0089] Crossover: Assume a single-point crossover between parent individuals K and V: Select the middle position to split the attack vector into two segments, then swap the second half. A possible attack vector for offspring individual M is [1,1,1,1] (combining the first half of K [1,0] and the second half of V [1,1]). This new attack vector, M, combines both the initial attack vectors of phishing and web vulnerability exploitation, and also includes privilege escalation and data exfiltration—a complex attack vector not found in the original attack vector.

[0090] Mutation: Based on the offspring individual M, random mutations may further introduce new attack methods. For example, if the attack method feature set includes an unused dimension such as "malware implantation," mutation may set it from 0 to 1, producing an offspring individual M'. This indicates that in addition to the above steps, the attacker has also implanted malware, resulting in a more complex new attack method.

[0091] The generated new attack method M (or M') simulates, to some extent, more complex or mixed attacks in reality. The random recombination and mutation of the genetic algorithm enables the threat intelligence analysis system to discover unconventional but potentially effective attack methods, including combinations not explicitly predefined by computer security experts. This provides a richer sample space for threat intelligence analysis, helping threat detection models learn potential new attack methods. Furthermore, because each generation of the evolutionary algorithm selects and optimizes based on fitness, it can continuously adapt to the dynamically changing threat environment. As attackers continuously update their strategies, iteratively generates new solutions, or new attack methods, demonstrating superior adaptability to new threats. This adaptive evolutionary nature aligns with the requirements of proactive network attack and defense: it enables early warning of potential variant attack methods.

[0092] The logic detection module is used to perform logic verification on the characteristics of new attack methods in the new attack method set to determine whether they conform to the attack logic and remove new attack methods that do not conform to the attack logic from the new attack method set.

[0093] The method for determining whether it conforms to the attack logic includes detecting whether the required permission level conflicts with the required resources. If there is a conflict in any of the detections, it is determined that the corresponding attack method characteristics do not conform to the attack logic, otherwise they conform.

[0094] Methods for detecting conflicting required permission levels include:

[0095] Obtain the required permission level for each attack method in the new attack method, such as 0 = ordinary user permission, 1 = administrator permission, and 2 = kernel permission. If there are inconsistent required permission levels among the attack methods in a new attack method, it is determined that there is a conflict, otherwise there is no conflict. For example, if some attack methods in the new attack method require either administrator permission or kernel permission, while other attack methods require ordinary user permission, and there is no consistent required permission level among the attack methods, then the new attack method may not be able to work in coordination in an actual attack. If some attack methods in the new attack method require either administrator permission or kernel permission, while other attack methods require administrator permission, then there is a consistent required permission level. In an actual attack, the attack methods can be selected to have consistent administrator permission.

[0096] Methods for obtaining the required permission level for each attack method in the new attack method include:

[0097] Each attack method in the new attack mode is input into a preset permission level rule library, and the required permission level corresponding to each attack method is output, and the required permission level includes at least one. The permission level rule library pre-sets the required permission level corresponding to each attack method.

[0098] Methods for detecting whether required resources conflict include:

[0099] Obtain the resources that each attack method in the new attack method needs to access, such as files, ports, protocols, etc. If the operations that need to be accessed on the same resource have opposite operations, it is determined that there is a conflict; otherwise, there is no conflict. For example, if one attack method in the new attack method requires opening a port, and another attack method needs to close the same port, or if one attack method encrypts a file, and another attack method needs to delete the same file, resulting in a conflict on the same resource, a conflict will occur, causing the attack logic to fail.

[0100] Methods for obtaining the resources required for access by each attack method in the new attack method include:

[0101] Each attack method in the new attack mode is input into the preset resource operation rule library, and the resource operation corresponding to each attack method is output. The resource operation rule library pre-sets the required resources and corresponding resource operations for each attack method.

[0102] The identification and annotation module is used to identify the attack purpose of new attack methods that conform to the attack logic.

[0103] The required permission level that is consistent among the various attack means in a new attack method is used as the final permission level; the timing of each attack means in a new attack method, the final permission level, and the accessed resources and resource operations corresponding to each attack means are input into the pre-trained recognition and labeling model to obtain the attack purpose corresponding to the new attack method.

[0104] Through repeated experiments, the applicant discovered that the generated new attack methods often contain multiple attack means, and the requirements for permission levels of each attack means may not be consistent. If multiple permission levels are directly input into the recognition and annotation model, the model is prone to inaccurate results due to permission conflicts during inference. To avoid this problem, the applicant proposed: only select the permission level that is commonly applicable to all attack means as the final permission level of the new attack method, ensuring that there will be no permission conflicts during actual execution and maintaining the integrity and coherence of the attack chain. Introducing the "final permission level" into the recognition and annotation model as a key input feature can significantly improve the model's accuracy in determining the attack purpose, that is, the attack intention. Based on the uncertainty of the feasibility of the new attack method, the applicant comprehensively considered multi-dimensional factors such as the timing of the attack means, the consistency of resource access, and the division of permission levels when designing the constraints and input features. This process embodies significant creative labor input to arrive at the above solution.

[0105] The recognition and annotation model training methods include:

[0106] The training data set collected in advance is preprocessed. The training data includes input feature data and attack purposes. The preprocessed input feature data includes the timing of each attack method in the attack method, the final permission level, and the accessed resources and resource operations corresponding to each attack method.

[0107] Preprocessing includes vectorized coding, which includes attack method timing coding, resource and operation coding, and final permission level coding:

[0108] The attack means timing coding is to splice each attack means in time sequence and assign a unique integer coding ID to obtain an integer attack means timing; the resource and operation coding is to generate a string (Token) through a hash algorithm, and realize the unique identification of resource access and operation through structured input.

[0109] To facilitate batch training, the input feature data is padded or truncated to a fixed length.

[0110] The preprocessed input feature data is used as the input of the recognition and annotation model. The recognition and annotation model uses the predicted attack purpose for each set of input feature data as output, the actual attack purpose corresponding to each set of input feature data as the prediction target, and minimizing the sum of the prediction accuracies of all predicted attack purposes as the training goal; until the preset convergence condition is reached, the training is stopped, and the recognition and annotation model is a multi-layer perceptron or a long short-term memory network.

[0111] During an attack, the timing of the attack methods and the final permission level affect the scope of access to resources. The resource operation type (read, modify, execute, delete, encrypt, etc.) reflects the purpose of the attack. Different attack methods correspond to different resources and operations.

[0112] The update module is used to combine new attack methods that conform to the attack logic with their corresponding attack objectives to form new attack samples, update the attack sample library, train the threat detection model based on the updated attack sample library to form an updated threat detection model, identify real-time computer system data based on the updated threat detection model, and obtain the attack objectives, so as to improve the model's detection and early warning capabilities for dynamic emerging threats.

[0113] Training methods for threat detection models include:

[0114] The attack samples in the attack sample library are pre-processed attack samples.

[0115] The attack sample is used as the input of the threat detection model. The threat detection model uses the attack purpose predicted for the attack sample as the output, the actual attack purpose corresponding to the attack sample as the prediction target, and minimizing the sum of the prediction accuracies of all predicted attack purposes as the training goal; until the preset convergence condition is reached, the training is stopped to obtain the threat detection model, which is a multi-layer perceptron or a long short-term memory network.

[0116] By updating the attack sample library with new attack samples, the attack sample coverage is gradually expanded through continuous accumulation. Compared to the original attack samples, the new attack samples provide variant attacks not included in the original attack samples, enriching the diversity of attack methods at the dataset level and enabling the threat detection model to learn new attack patterns. The threat detection model can identify more variant attacks. For example, it can correctly classify certain previously unseen attack method combinations as malicious and indicate their purpose, thereby reducing false negatives.

[0117] Since new attack samples are generated based on reasonable disturbances, the new attack method combinations learned by the threat detection model are real and credible attack behaviors, which can improve the ability to judge the intentions of such attacks, issue early warnings in the early stages of the attack, and improve the detection rate without introducing too much noise false alarms.

[0118] Example of effectiveness: Suppose the original threat detection model was trained only on attack vectors A and B. It lacks awareness of complex attacks where attackers employ both phishing and web vulnerabilities, potentially underreporting such incidents. Using the updated attack sample library, a newly generated and annotated attack vector M, combining phishing, web vulnerabilities, privilege escalation, and data exfiltration for the purpose of data theft, is added to the training. When the updated threat detection model encounters a similar multi-vector attack during testing, it no longer considers it unfamiliar: Having seen similar combinations of attack vectors before, the threat detection model's classifier will identify it as malicious data theft and trigger an alert, significantly enhancing the computer system's security defenses in dynamic threat environments.

[0119] Example 2

[0120] like Figure 3 As shown, this embodiment provides a computer system threat intelligence analysis method, including:

[0121] Extract the attack method features of each attack sample from the multi-source attack sample library to form an attack method feature set;

[0122] Based on the attack method feature set and preset constraints, a new attack method set is generated using a genetic algorithm;

[0123] Perform logical verification on the characteristics of new attack methods in the new attack method set to determine whether they conform to the attack logic, and remove new attack methods that do not conform to the attack logic from the new attack method set;

[0124] Identify the attack purpose of new attack methods that conform to the attack logic;

[0125] Combine the new attack method that conforms to the attack logic with its corresponding attack purpose to form a new attack sample, update the attack sample library, train the threat detection model based on the updated attack sample library to form an updated threat detection model, and identify the real-time computer system data based on the updated threat detection model to obtain the attack purpose.

[0126] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the above-described embodiments. The above-described embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer system threat intelligence analysis method, characterized in that: include: Extract the attack method features of each attack sample from the multi-source attack sample library to form an attack method feature set; Based on the attack method feature set and preset constraints, a new attack method set is generated using a genetic algorithm; Perform logical verification on the characteristics of new attack methods in the new attack method set to determine whether they conform to the attack logic, and remove new attack methods that do not conform to the attack logic from the new attack method set; Identify the attack purpose of new attack methods that conform to the attack logic; Combine the new attack method that conforms to the attack logic with its corresponding attack purpose to form a new attack sample, update the attack sample library, train the threat detection model based on the updated attack sample library to form an updated threat detection model, and identify the real-time computer system data based on the updated threat detection model to obtain the attack purpose.

2. A computer system threat intelligence analysis method according to claim 1, characterized in that: Methods for generating new attack method sets using genetic algorithms include: Step 1: Encoding and initial population: The extracted attack mode features are used as the encoding of the genetic algorithm individuals; the initial population uses the attack mode feature set as the initial solution set; Step 2: Fitness evaluation. Define a fitness function based on preset constraints to calculate the fitness value of each individual in the initial population. Constraints include soft implementation constraints and hard implementation constraints. Soft implementation constraints include novelty score, concealment score, and implementation cost score, while hard implementation constraints include feasibility score. If the feasibility score is lower than the preset value, the fitness is set to 0 and the individual is eliminated. Step 3: Sort the fitness in descending order and select the first p individuals as the parent individuals; Step 4: Perform genetic operations on the parent individuals to generate new offspring individuals; Step 5. Loop Step 2-Step 4: Add new offspring individuals to the population and screen the next generation population according to fitness until the predetermined termination condition is reached. Output the population, which is the new attack method set.

3. A computer system threat intelligence analysis method according to claim 2, characterized in that: The fitness value is the weighted sum of the novelty score, feasibility score, hidden score and implementation cost score after normalization according to the positive and negative contributions of the constraints.

4. A computer system threat intelligence analysis method according to claim 3, characterized in that: Methods for obtaining novelty points include: Calculate the cosine similarity between the attack method feature vector corresponding to the individual and the existing attack methods in the attack sample library; the difference between 1 and the highest cosine similarity is used as the novelty score; Feasibility scores are obtained by: Filtering historical data sets that are consistent with the preset operating environment in the historical data sets to obtain a filtered historical data set, wherein the historical data sets record the total number of executions and the number of successful executions of each attack method in each operating environment; The success probability of each attack method in the corresponding individual attack method under the preset operating environment is calculated; the average success probability of each attack method is taken as the feasibility score.

5. A computer system threat intelligence analysis method according to claim 3, characterized in that: The concealment score represents the difficulty of the existing detection system to identify the characteristics of the individual attack method; the implementation cost score is a comprehensive representation of the complexity of the attack execution, the amount of resources required, and the difficulty of operation of the individual attack method.

6. A computer system threat intelligence analysis method according to claim 1, characterized in that: Methods for determining whether an attack conforms to the attack logic include: Check whether the required permission level conflicts with the required resources. If there is a conflict in any of the detections, the corresponding attack method characteristics are judged to be inconsistent with the attack logic, otherwise they are consistent.

7. A computer system threat intelligence analysis method according to claim 6, characterized in that: Methods for detecting conflicting required permission levels include: Obtain the required permission level for each attack method in the new attack method. If the required permission levels for each attack method in a new attack method are inconsistent, it is determined that there is a conflict. Otherwise, there is no conflict. Methods for detecting whether required resources conflict include: Obtain the resources that each attack method in the new attack method needs to access. If there are opposite operations on the same resource operations that need to be accessed, it is determined that there is a conflict. Otherwise, there is no conflict.

8. A computer system threat intelligence analysis method according to claim 1, characterized in that: The required permission level that is consistent among the various attack means in a new attack method is used as the final permission level; the timing of each attack means in a new attack method, the final permission level, and the accessed resources and resource operations corresponding to each attack means are input into the pre-trained recognition and labeling model to obtain the attack purpose corresponding to the new attack method.

9. A computer system threat intelligence analysis method according to claim 8, characterized in that: The recognition and annotation model training methods include: Preprocess the previously collected training data set. The training data includes input feature data and attack objectives. The preprocessed input feature data includes the timing of each attack method in the attack mode, the final permission level, and the accessed resources and resource operations corresponding to each attack method. The preprocessed input feature data is used as the input of the recognition and annotation model. The recognition and annotation model uses the predicted attack purpose for each set of input feature data as output, the actual attack purpose corresponding to each set of input feature data as the prediction target, and minimizing the sum of the prediction accuracies of all predicted attack purposes as the training goal; until the preset convergence condition is reached, the training is stopped, and the recognition and annotation model is a multi-layer perceptron or a long short-term memory network.

10. A computer system threat intelligence analysis system, characterized in that: Implementing a computer system threat intelligence analysis method according to any one of claims 1 to 9 comprises: The data extraction module is used to extract the attack mode characteristics of each attack sample from the multi-source attack sample library to form an attack mode feature set; The generation module uses genetic algorithms to generate a new attack method set based on the attack method feature set and preset constraints; A logic detection module is used to perform logic verification on the characteristics of new attack methods in the new attack method set to determine whether they conform to the attack logic and to remove new attack methods that do not conform to the attack logic from the new attack method set; Identification and annotation module, used to identify the attack purpose of new attack methods that conform to the attack logic; The update module is used to combine the new attack method that conforms to the attack logic with its corresponding attack purpose to form a new attack sample, update the attack sample library, train the threat detection model based on the updated attack sample library to form an updated threat detection model, and identify real-time computer system data based on the updated threat detection model to obtain the attack purpose.

Images