Threat intelligence data mining method and device, storage medium and electronic equipment

Abstract

The application discloses a threat intelligence data mining method and device, a storage medium and an electronic equipment. The method comprises the following steps: acquiring triple information defined in a threat intelligence knowledge graph; extracting a threat event vector from a threat intelligence report according to the defined triple information, and generating an attack link vector according to a network attack knowledge base; under the constraint of the threat event vector and the attack link vector, mining triple information that does not exist in the threat intelligence knowledge graph to obtain new triple information; determining an evaluation score of each new triple information, determining target triple information based on the evaluation score, and generating new threat intelligence data based on the target triple information. Through the application, the problem of high mining cost and low credibility of mining results in the related art when intelligence is mined based on a knowledge graph in the field of network security is solved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and more specifically, to a method, apparatus, storage medium, and electronic device for mining threat intelligence data. Background Technology

[0002] A knowledge graph is a structured semantic knowledge base used to describe concepts and their relationships in the physical world in symbolic form. The basic building block of a knowledge graph is the "entity-relationship-entity" triple, along with the "entity" and its associated attribute values. Entities are interconnected through "relationships," forming a network-like knowledge structure.

[0003] Previously, when a user searched for a specific term, only web pages containing that term would be returned. After building a knowledge graph, a knowledge graph-based search engine can provide users with structured knowledge in a graphical way. When a user searches for a term, the browser will return all content related to that term's topic. Users can accurately locate and deeply acquire knowledge without having to browse a large number of web pages.

[0004] After constructing a knowledge graph, association rule mining algorithms can be used to extract association rules from it, helping people understand the relationships between entities and relations within the knowledge graph. For example, in the field of threat intelligence management, threat intelligence knowledge graphs can be constructed and automated intelligence mining can be performed. However, threat intelligence management based on knowledge graphs in related technologies has the following drawbacks:

[0005] The mining algorithms have many shortcomings. They are computationally expensive on large-scale knowledge graphs, and generate a large number of meaningless or low-quality association rules, requiring security operations personnel to perform additional work to filter and evaluate these rules. They primarily rely on triplet data to establish relationships between entities, failing to fully utilize the characteristics of the graph, resulting in rules lacking deep semantic understanding.

[0006] There is currently no effective solution to the problems of high mining costs and low reliability of mining results when using knowledge graphs for intelligence mining in the field of cybersecurity. Summary of the Invention

[0007] This application provides a method, apparatus, storage medium, and electronic device for mining threat intelligence data, in order to solve the problems of high mining costs and low reliability of mining results when mining intelligence based on knowledge graphs in the field of network security.

[0008] According to one aspect of this application, a method for mining threat intelligence data is provided. The method includes: acquiring triple information defined in a threat intelligence knowledge graph; extracting threat event vectors from threat intelligence reports based on the defined triple information, and generating attack link vectors based on a network attack knowledge base; mining triple information not present in the threat intelligence knowledge graph under the constraints of the threat event vectors and attack link vectors to obtain new triple information; determining an evaluation score for each new triple information, determining target triple information based on the evaluation score, and generating new threat intelligence data based on the target triple information.

[0009] Optionally, under the constraints of threat event vectors and attack link vectors, mining triple information that does not exist in the threat intelligence knowledge graph to obtain new triple information includes: determining the recursion depth based on the basic knowledge defined by threat event vectors and attack link vectors; and using mining operators to mine triple information that does not exist in the threat intelligence knowledge graph at the recursion depth to obtain new triple information.

[0010] Optionally, the mining operator is used to mine new associations based on existing associations between entities and the frequency of entity occurrence. The mining operator includes at least one of the following: supplementing associations between different entities of triple instances with sequential relationships; adding dangling edges or instance edges for entities that occur more frequently than a preset frequency.

[0011] Optionally, extracting threat event vectors from a threat intelligence report based on defined triplet information includes: determining the extraction depth; extracting triplet information for multiple threat events from the threat intelligence report based on the extraction depth and defined triplet information; and generating threat event vectors from the triplet information of multiple threat events.

[0012] Optionally, generating an attack link vector based on a network attack knowledge base includes: generating triple information of multiple attack links based on attack strategies in the network attack knowledge base; and generating an attack link vector from the triple information of multiple attack links.

[0013] Optionally, before obtaining the triple information defined in the threat intelligence knowledge graph, the method further includes: determining the entities, attribute values, and relationships of threat knowledge intelligence based on security knowledge and threat information to obtain multiple triple information; generating a threat intelligence knowledge graph based on the multiple triple information; and storing the threat intelligence knowledge graph in a graph database.

[0014] Optionally, determining the evaluation score for each newly added triplet information, and determining the target triplet information based on the evaluation score, includes: calculating the confidence score for each newly added triplet information to obtain a first score; sending each newly added triplet information to the target object's client and receiving the second score fed back by the client; determining the weight of the first score and the weight of the second score, and determining the evaluation score of the newly added triplet information based on the first score and its weight, and the second score and its weight; determining the evaluation score range in which the evaluation score of each newly added triplet information falls, and determining the credibility associated with the evaluation score range, and determining the newly added triplet information with a credibility level of the target credibility level as the target triplet information.

[0015] According to another aspect of this application, a threat intelligence data mining apparatus is provided. The apparatus includes: an acquisition unit for acquiring triple information defined in a threat intelligence knowledge graph; a vector generation unit for extracting threat event vectors from threat intelligence reports based on the defined triple information and generating attack link vectors based on a network attack knowledge base; a mining unit for mining triple information not present in the threat intelligence knowledge graph under the constraints of threat event vectors and attack link vectors, thereby obtaining new triple information; and an evaluation unit for determining an evaluation score for each new triple information, determining target triple information based on the evaluation score, and generating new threat intelligence data based on the target triple information.

[0016] According to another aspect of the present invention, a computer storage medium is also provided for storing a program, wherein the program, when running, controls the device where the non-volatile storage medium is located to execute a method for mining threat intelligence data.

[0017] According to another aspect of the present invention, an electronic device is also provided, comprising a processor and a memory; the memory stores computer-readable instructions, and the processor is configured to execute the computer-readable instructions, wherein the computer-readable instructions, when executed, perform a method for mining threat intelligence data.

[0018] This application employs the following steps: obtaining triplet information defined in a threat intelligence knowledge graph; extracting threat event vectors from threat intelligence reports based on the defined triplet information, and generating attack link vectors based on a network attack knowledge base; mining triplet information not present in the threat intelligence knowledge graph under the constraints of the threat event vectors and attack link vectors to obtain new triplet information; determining the evaluation score for each new triplet information, identifying target triplet information based on the evaluation score, and generating new threat intelligence data based on the target triplet information. This solves the problems of high mining costs and low reliability of mining results in related technologies for intelligence mining based on knowledge graphs in the field of network security. By generating constraint operators based on threat intelligence reports and network attack knowledge bases, mining new triplet information from the threat intelligence knowledge graph under the constraints of the constraint operators, and evaluating the new triplet information, the application achieves the effect of efficiently mining reliable new threat intelligence data from the threat intelligence knowledge graph. Attached Figure Description

[0019] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0020] Figure 1 This is a flowchart of a threat intelligence data mining method according to an embodiment of this application;

[0021] Figure 2 This is a flowchart of an optional threat intelligence data mining method according to an embodiment of this application;

[0022] Figure 3 This is a schematic diagram of a threat intelligence data mining apparatus according to an embodiment of this application;

[0023] Figure 4 This is a schematic diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0024] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties.

[0028] According to an embodiment of this application, a method for mining threat intelligence data is provided.

[0029] Figure 1 This is a flowchart of a threat intelligence data mining method according to an embodiment of this application. Figure 1 As shown, the method includes the following steps:

[0030] Step S102: Obtain the triplet information defined in the threat intelligence knowledge graph.

[0031] Among them, the threat intelligence knowledge graph is a knowledge graph built on security knowledge and threat information. The triple information defined in the threat intelligence knowledge graph includes entities, attribute values, and relationships between entities.

[0032] Step S104: Extract threat event vectors from the threat intelligence report based on the defined triplet information, and generate attack link vectors based on the network attack knowledge base.

[0033] Specifically, threat incident reports can be reports independent of threat intelligence knowledge graphs, and cyberattack knowledge bases can be existing databases.

[0034] Threat event vectors and attack chain vectors are generated based on threat event reports and existing cyberattack knowledge bases. The underlying knowledge of threat event vectors and attack chain vectors defines entities and relationships that should not exist, which can be used to determine whether the relationships between entities are correct.

[0035] Step S106: Under the constraints of threat event vector and attack link vector, mine the triple information that does not exist in the threat intelligence knowledge graph to obtain the newly added triple information.

[0036] Specifically, threat event vectors and attack chain vectors are introduced as constraint operators for the mining algorithm. The mining operation can be restricted and interrupted by the basic knowledge defined by threat event vectors and attack chain vectors, which limits the matching range and recursion depth of the mining algorithm, improves the efficiency of the mining algorithm and the credibility of the newly mined triplet information.

[0037] Step S108: Determine the evaluation score for each newly added triplet information, determine the target triplet information based on the evaluation score, and generate new threat intelligence data based on the target triplet information.

[0038] Specifically, the evaluation score of the newly added triplet information is used to quantify the credibility of the newly added triplet information.

[0039] For example, the credibility of newly added triplet information is determined based on the mapping relationship between the evaluation score range and credibility. Newly added triplet information with credibility higher than the preset value is identified as target triplet information. Target triplet information contains threat intelligence entities, attribute values, and relationships between entities. Target triplet information can be converted into threat intelligence data to realize the mining of hidden threat intelligence clues.

[0040] It should be noted that the threat intelligence data mining method in this embodiment can be used for threat intelligence mining work, supplementing the relationships between threat intelligence entities not found in the threat intelligence knowledge graph, improving the correlation between threat entities, increasing the threat hunting surface, and thus improving the efficiency of tracing and analyzing threat events. It is understood that the threat intelligence data mining method in this embodiment can also be used for threat intelligence verification work. Based on the constraints of threat situation vectors and attack link vectors, it can review the threat intelligence already mined in the intelligence database, improving the accuracy and correlation of the threat intelligence in the database. This embodiment does not specifically limit the specific application scenarios.

[0041] The threat intelligence data mining method provided in this application embodiment obtains triple information defined in a threat intelligence knowledge graph; extracts threat event vectors from threat intelligence reports based on the defined triple information, and generates attack link vectors based on a network attack knowledge base; under the constraints of the threat event vectors and attack link vectors, mines triple information that does not exist in the threat intelligence knowledge graph to obtain new triple information; determines the evaluation score of each new triple information, determines the target triple information based on the evaluation score, and generates new threat intelligence data based on the target triple information. This solves the problems of high mining cost and low reliability of mining results in related technologies when mining intelligence based on knowledge graphs in the field of network security. By generating constraint operators based on threat intelligence reports and network attack knowledge bases, mining new triple information from the threat intelligence knowledge graph under the constraints of the constraint operators, and evaluating the new triple information, the method achieves the effect of efficiently mining reliable new threat intelligence data from the threat intelligence knowledge graph.

[0042] Threat intelligence knowledge graphs need to be pre-built. Optionally, in the threat intelligence data mining method provided in this application embodiment, before obtaining the triple information defined in the threat intelligence knowledge graph, the method further includes: determining the entities, attribute values ​​and associations of threat knowledge intelligence based on security knowledge and threat information to obtain multiple triple information; generating a threat intelligence knowledge graph based on the multiple triple information; and storing the threat intelligence knowledge graph in a graph database.

[0043] Specifically, existing security knowledge and threat information are acquired, and the entity content, attribute values, and relationships between entities are defined based on this knowledge and information. For example, some entity relationship triples defined in this embodiment are as follows:

[0044] Report(HasCVE)CVE, Report(HasMalware)Malware, Operation(HasMalware)Malware, Report(HitSigame)Sigma, Malware(HitSigame)Sigma, File(StringRefer)URI, File(StringRefer)Domain, Domain(BeSiblingWith)Domain, Operation(BelongToCountry)Country,Repo rt(BelongToCountry)Country, ThreatActor(BelongToCountry)Country, Operation(IOCContain)IPv6, Operation(IOCContain)Domain, Operation(IOCContain)IPv4, Operation(IOCContain)Vulnerability, Malware(HasATTCK)Tag-attck, Report(HasATTCK)Tag-attck.

[0045] The entities in the triples have the following meanings: Report (threat report), ThreatActor (threat organization), Operation (action), Malware (malware), Domain (domain name), IPv4 (Internet Protocol Version 4), Vulnerability (vulnerability), Country (country), CVE (vulnerability ID), Tag-attack (ATTACK matrix), URI (Uniform Resource Locator), and Sigma (login format rules for endpoint data collection). The relationships between the entities in the triples have the following meanings: Has (has), Hit (hit), StringRefer (refer to), BeSiblingWith (belongs to), BelongTo (belongs to), and Contain (contains).

[0046] Furthermore, after defining the entity content, attribute values, and relationships between entities in the threat intelligence knowledge graph, the defined content is stored in the graph database using a storage tool. The name and attributes of each entity can also be displayed in the storage tool.

[0047] A threat event vector is composed of triple information of multiple threat events. Optionally, in the threat intelligence data mining method provided in this application embodiment, extracting a threat event vector from a threat intelligence report based on the defined triple information includes: determining the extraction depth; extracting triple information of multiple threat events from the threat intelligence report based on the extraction depth and the defined triple information; and generating a threat event vector from the triple information of multiple threat events.

[0048] Specifically, the threat intelligence knowledge graph predefines triples of information, including what entities are, their attributes, and the relationships between them. These triples constitute the basic information. After obtaining threat event reports from outside the knowledge graph, a large language model can extract specific values ​​corresponding to the predefined basic information from the threat reports to obtain the triple information of the threat events. All the extracted triple information of the threat events forms a list, which is the threat event vector. For example, the threat intelligence knowledge graph predefines the entity "Malwaretools," and the threat event report describes the specific content of "Malwaretools." The specific content is extracted from the threat event report according to the defined entity content to obtain the attribute values ​​of "Malwaretools."

[0049] In an optional embodiment, a portion of the threat event vectors are defined as follows:

[0050] Vec (Operation company phishing incident)

[0051] -Operation(GUID)363afb84-e483-4da6-bc58-04e5b9375b15

[0052] -Report(title_cn)

[0053] -Malware (Manipulate) 192.

[0054] -Malware(Manipulate)power

[0055] -Malware(Manipulate)le.com

[0056] -Report(abstract_ori)

[0057] -Domain(Subdomain)

[0058] -Report(HasAnalysis)

[0059] -Operation(HasAnalysis)

[0060] -File(ConcatedNetwork)

[0061] It should be noted that when extracting the triplet information of threat events from the threat intelligence report, if no constraints are imposed, the extraction will continue to go deeper and deeper. This embodiment defines an extraction depth to constrain the extraction operation. For example, if Malware is matched from the report based on the defined triplet information, and the extraction depth is 1, the extraction ends when the name of Malware is matched. If a domain name is matched from the report based on the defined triplet information, and the extraction depth is 1, the extraction ends when the IP address is matched.

[0062] Furthermore, after extracting the triplet information set of threat events from the report to obtain the threat event vector, the threat event vector is used as a constraint operator for the mining algorithm. In the process of mining threat intelligence data based on the mining algorithm, the basic knowledge in the threat event vector can constrain the recursion depth of the mining algorithm, the depth of matching in a small knowledge graph, and increase the semantic capabilities of the mining algorithm, thereby laying a data foundation for mining valuable threat intelligence data.

[0063] Optionally, in the threat intelligence data mining method provided in this application embodiment, generating an attack link vector based on a network attack knowledge base includes: generating triple information of multiple attack links based on attack strategies in the network attack knowledge base; and generating an attack link vector from the triple information of multiple attack links.

[0064] Specifically, a cyberattack knowledge base can be the MITRE ATT&CK matrix. The MITRE ATT&CK matrix describes the various strategies and techniques used by attackers in cyberattacks. The strategies describe the attacker's strategic objectives and the reasons for performing the actions, while the techniques describe "how" the attacker achieves these strategic objectives through the actions performed. The MITRE ATT&CK matrix stores different attack types, such as pre-attack, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, penetration, and command and control.

[0065] This embodiment generates attack link vectors based on known attack types in the MITRE ATT&CK matrix. Specifically, the MITRE CAR data model can be used to standardize the content of the MITRE ATT&CK matrix, structuring the content to obtain attack link vectors. Attack link vectors can constrain threat intelligence data based on known attack types in MITRE ATT&CK. For example, if PowerShell (a command-line shell program) is used to initiate an external URI connection, the attack link vector constraint should not include entities and relationships related to the data cmd (command line). Therefore, generating a relationship between PowerShell and the data cmd would be incorrect.

[0066] In this embodiment, attack link vectors are generated based on existing network attack knowledge bases. The basic knowledge in the attack link vectors defines entities and relationships that should not exist, which can be used to determine whether the relationships between entities are correct. The attack link vectors are used as constraint operators for the mining algorithm. During the mining of threat intelligence data based on the mining algorithm, the basic knowledge in the attack link vectors can restrict and interrupt the mining operation, thereby laying a data foundation for mining valuable threat intelligence data.

[0067] Optionally, in the threat intelligence data mining method provided in this application embodiment, under the constraints of threat event vectors and attack link vectors, mining triple information that does not exist in the threat intelligence knowledge graph to obtain new triple information includes: determining the recursion depth based on the basic knowledge of the definition of threat event vectors and attack link vectors; and using mining operators at the recursion depth to mine triple information that does not exist in the threat intelligence knowledge graph to obtain new triple information.

[0068] It should be noted that without constraint operators, supplementing the knowledge graph through mining operators would result in a large number of meaningless triplet relationships. Therefore, it is necessary to limit the mining operators in the mining algorithm from infinitely expanding the knowledge graph. This embodiment has already constructed a basic threat intelligence knowledge graph. Mining algorithms are used to mine unknown threat intelligence data, based on external threat event reports and existing network attack knowledge bases. The content of threat event reports and network attack knowledge bases is standardized to obtain threat event vectors and attack link vectors. These threat event vectors and attack link vectors are defined as constraint operators. The basic knowledge of threat event vectors and attack link vectors defines entities and relationships that should not exist. The recursion depth is determined by the basic knowledge defined by threat event vectors and attack link vectors to limit and interrupt mining operations, ensuring that the mining operators uncover highly reliable threat intelligence data that is not present in the threat intelligence knowledge graph.

[0069] Optionally, in the threat intelligence data mining method provided in the embodiments of this application, the mining operator is used to mine new relationships based on existing relationships between entities and the frequency of entity occurrence. The mining operator includes at least one of the following: supplementing relationships between different entities of triple instances with sequential relationships; adding dangling edges or instance edges for entities that occur more frequently than a preset frequency.

[0070] Among them, supplementing the association between different entities of triple instances with sequential relationship refers to the automatic mounting operation of sequential instances. For example, if A->B and B->C are triple instances with sequential relationship, then a conditional association A->C is automatically added.

[0071] Adding dangling edges or instance edges to entities that appear more frequently than a preset frequency refers to the operation of adding frequent itemsets based on entity attribute values. In threat intelligence knowledge graphs, frequently occurring triple patterns are called frequent triple itemsets. Dangling edges or instance edges are added based on the attribute values ​​of entity instances. For example, if A->C and A->B appear frequently, then a relationship between B and C can be inferred based on the frequency, and a dangling edge is added between them.

[0072] This embodiment defines two mining operators: sequential instance automatic mounting operation and frequent itemset addition operation based on entity attribute values. Threat event vector and attack chain vector are introduced as two constraint operators. Under the constraints of the constraint operators, the mining operators automatically mine the relationships between entities in the threat intelligence knowledge graph, thereby achieving the goal of associating multiple threat entities and producing high-quality intelligence.

[0073] Optionally, in the threat intelligence data mining method provided in this application embodiment, determining the evaluation score of each newly added triplet information includes: calculating the confidence score of each newly added triplet information to obtain a first score; sending each newly added triplet information to the client of the target object (e.g., operations and maintenance personnel) and receiving the second score fed back by the client; determining the weight of the first score and the weight of the second score, and determining the evaluation score of the newly added triplet information based on the first score and the weight of the first score, and the second score and the weight of the second score.

[0074] Optionally, in the threat intelligence data mining method provided in this application embodiment, determining target triplet information based on evaluation scores includes: determining the evaluation score range where the evaluation score of each newly added triplet information is located, and determining the credibility associated with the evaluation score range, and determining the newly added triplet information with a credibility level of the target credibility level as the target triplet information.

[0075] Here, the reliability of the correlation between different assessment score ranges can vary.

[0076] Credibility can have multiple credibility levels, such as low credibility and high credibility.

[0077] Here, the target credibility level can be the highest credibility level.

[0078] Specifically, on the one hand, the newly added triple information is sent to the client of the security analyst. The security analyst evaluates the new associations and obtains a first score (Pre): 0 to 10, where 0 represents no human intervention.

[0079] On the other hand, the PCA confidence score (R) of the associations in the newly added triplet information is calculated using the following formula, and the PCA confidence score is used as the second score. The second score can quantify the relevance of the mined associations:

[0080]

[0081] In the above formula, the numerator is the support (which conforms to both the rule body and the rule head), and the denominator is the number of triples that only conform to the rule body. PCA confidence is calculated by dividing the support of rule R by the maximum support across all classes that contains at least one rule C. This method aims to account for differences in rule support across different classes to more accurately assess the confidence of a rule.

[0082] -Confidence(R): PCA confidence of rule R, representing the probability of rule R occurring given the given premises.

[0083] -Support(R): Support of rule R, which represents the frequency of rule R in the dataset, i.e., the proportion of transactions containing R out of the total transactions.

[0084] -max(c∈classes): This means taking the maximum value among all classes c.

[0085] - This indicates the support level of at least one C rule from category c.

[0086] The calculation process for the above formula is as follows:

[0087] First, calculate the support of rule R: Support(R).

[0088] Then, for each category c in the dataset, find all rules C in that category, calculate the support of these rules, and then take the maximum value. That is, for each category c, find... Calculate its support and denot it as

[0089] Finally, the PCA confidence score is obtained by dividing the support of rule R by the maximum support across all categories.

[0090] The mining algorithm has a rule support threshold set to determine the weight of the first score and the weight of the second score. The weight of the first score can be set to a smaller percentage, and the weight of the second score can be set to a larger percentage. If the rule support threshold is set to 20%, then the weight of the first score is set to account for 20% of the total score, and the weight of the second score is set to account for 80% of the total score.

[0091] The comprehensive score calculation formula is: (Pre / 10*0.2) + PCA*0.8. The evaluation score table is designed as shown in Table 1.

[0092] Table 1

[0093]

[0094] As shown in Table 1, different comprehensive score ranges are associated with different intelligence mining confidence levels. In this embodiment, after calculating the evaluation score of the correlation in the newly added triplet information, the comprehensive score range in which the evaluation score falls is determined by referring to the evaluation score table, and the corresponding confidence level is obtained. New threat intelligence data is generated based on the new triplet information with the confidence level as the target confidence level, thereby ensuring the reliability of the new threat intelligence data.

[0095] Figure 2 This is a flowchart of an optional threat intelligence data mining method according to an embodiment of this application, such as... Figure 2 As shown, the method includes;

[0096] First, obtain a suspected attack report. The report's content is an analysis of the suspected target threat organization's attack activities in a certain area.

[0097] Furthermore, it is defined that closed nodes must be hash-type and network-type IOCs (Indicators of Compromise). Based on the triple relationships defined in the threat intelligence knowledge graph, threat event vectors Vec (Operation-Target Threat Organization) are extracted from suspected attack reports, and attack link vectors Vec (CChain) are generated according to the network attack knowledge base. Vec (Operation-Target Threat Organization) and Vec (CChain) are used as constraint operators for the mining algorithm. At the same time, a rule support threshold S (RuleX) is set in the mining algorithm to evaluate the mined threat intelligence data.

[0098] Finally, it was discovered that the target threat organization was associated with a threat report through an IOC.

[0099] In this embodiment, threat event vectors Vec (Operation) and attack chain vectors Vec (CChain) are determined, a rule support threshold S (RuleX) is defined, and it is defined that closed nodes must be hash-type and network-type IOCs. Based on the mining algorithm, automated mining can mine high-quality intelligence within a specified time and a predefined depth, successfully linking previously unassigned IOCs and obtaining new intelligence data.

[0100] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0101] This application also provides a threat intelligence data mining apparatus. It should be noted that the threat intelligence data mining apparatus of this application can be used to execute the threat intelligence data mining method provided in this application. The threat intelligence data mining apparatus provided in this application is described below.

[0102] Figure 3 This is a schematic diagram of a threat intelligence data mining apparatus according to an embodiment of this application. Figure 3 As shown, the device includes: an acquisition unit 302, a vector generation unit 304, a mining unit 306, and an evaluation unit 308.

[0103] Specifically, the acquisition unit 302 is used to acquire triple information defined in the threat intelligence knowledge graph.

[0104] The vector generation unit 304 is used to extract threat event vectors from the threat intelligence report based on the defined triplet information, and generate attack link vectors based on the network attack knowledge base.

[0105] Mining unit 306 is used to mine triple information that does not exist in the threat intelligence knowledge graph under the constraints of threat event vector and attack link vector, and obtain new triple information.

[0106] Evaluation unit 308 is used to determine the evaluation score of each newly added triplet information, determine the target triplet information based on the evaluation score, and generate new threat intelligence data based on the target triplet information.

[0107] The threat intelligence data mining apparatus provided in this application embodiment acquires triple information defined in the threat intelligence knowledge graph through an acquisition unit 302; a vector generation unit 304 extracts threat event vectors from the threat intelligence report based on the defined triple information and generates attack link vectors based on the network attack knowledge base; a mining unit 306 mines triple information that does not exist in the threat intelligence knowledge graph under the constraints of the threat event vectors and attack link vectors to obtain new triple information; and an evaluation unit 308 determines the evaluation score of each new triple information, determines the target triple information based on the evaluation score, and generates new threat intelligence data based on the target triple information. This solves the problems of high mining cost and low reliability of mining results when mining intelligence based on knowledge graphs in the network security field in related technologies. By generating constraint operators based on threat intelligence reports and network attack knowledge bases, new triple information is mined from the threat intelligence knowledge graph under the constraints of the constraint operators, and the new triple information is evaluated, thereby achieving the effect of efficiently mining reliable new threat intelligence data from the threat intelligence knowledge graph.

[0108] Optionally, the mining unit 306 includes: a first determining module, used to determine the recursion depth based on the basic knowledge defined by the threat event vector and the attack link vector; and a mining module, used to mine triple information that does not exist in the threat intelligence knowledge graph at the recursion depth using mining operators to obtain newly added triple information.

[0109] Optionally, in the threat intelligence data mining apparatus provided in this application embodiment, the mining operator is used to mine new relationships based on existing relationships between entities and the frequency of entity occurrence. The mining operator includes at least one of the following: supplementing relationships between different entities of triple instances with sequential relationships; adding dangling edges or instance edges for entities that occur more frequently than a preset frequency.

[0110] Optionally, in the threat intelligence data mining apparatus provided in this application embodiment, the vector generation unit 304 includes: a second determining module, used to determine the extraction depth, and extract triple information of multiple threat events from the threat intelligence report based on the extraction depth and defined triple information; and a first generating module, used to generate a threat event vector from the triple information of multiple threat events.

[0111] Optionally, in the threat intelligence data mining apparatus provided in this application embodiment, the vector generation unit 304 includes: a second generation module, used to generate triple information of multiple attack links according to the attack strategy in the network attack knowledge base; and a third generation module, used to generate attack link vectors from the triple information of multiple attack links.

[0112] Optionally, in the threat intelligence data mining apparatus provided in this application embodiment, the apparatus further includes: a determining unit, used to determine the entities, attribute values ​​and associations of threat knowledge intelligence based on security knowledge and threat information before obtaining the triple information defined in the threat intelligence knowledge graph, thereby obtaining multiple triple information; and a graph generation unit, used to generate a threat intelligence knowledge graph based on the multiple triple information and store the threat intelligence knowledge graph in a graph database.

[0113] Optionally, in the threat intelligence data mining apparatus provided in this application embodiment, the evaluation unit 308 includes: a first calculation module, used to calculate the confidence score of each newly added triplet information to obtain a first score; a second calculation module, used to send each newly added triplet information to the client of the target object and receive the second score fed back by the client; a third calculation module, used to determine the weight of the first score and the weight of the second score, and determine the evaluation score of the newly added triplet information according to the first score and the weight of the first score, and the second score and the weight of the second score; and a third determination module, used to determine the evaluation score range in which the evaluation score of each newly added triplet information is located, and determine the credibility associated with the evaluation score range, and determine the newly added triplet information with a credibility level of the target credibility level as the target triplet information.

[0114] The threat intelligence data mining device includes a processor and a memory. The acquisition unit 302, vector generation unit 304, mining unit 306, and evaluation unit 308 are all stored in the memory as program units. The processor executes the program units stored in the memory to achieve the corresponding functions.

[0115] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can address the problems of high mining costs and low reliability of results in knowledge graph-based intelligence mining in the field of cybersecurity.

[0116] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0117] This application also provides a computer storage medium for storing a program, wherein the program, when running, controls the device where the non-volatile storage medium is located to execute a method for mining threat intelligence data.

[0118] This application also provides an electronic device. Figure 4 This is a schematic diagram of an electronic device according to an embodiment of this application, such as... Figure 4As shown, the electronic device 40 includes a processor and a memory; the memory stores computer-readable instructions, and the processor executes these computer-readable instructions, which, when executed, perform a method for mining threat intelligence data. The electronic device in this document can be a server, PC, PAD, mobile phone, etc.

[0119] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0120] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0121] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0122] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0123] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0124] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0125] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0126] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0127] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for mining threat intelligence data, characterized in that, include: Obtain triple information defined in the threat intelligence knowledge graph; Threat event vectors are extracted from threat intelligence reports based on the defined triplet information, and attack link vectors are generated based on the network attack knowledge base. Under the constraints of the threat event vector and the attack link vector, mining non-existent triplet information in the threat intelligence knowledge graph yields new triplet information. This includes: determining the recursion depth based on the fundamental knowledge defined by the threat event vector and the attack link vector; at the recursion depth, using mining operators to mine non-existent triplet information in the threat intelligence knowledge graph to obtain the new triplet information; the mining operators are used to mine new relationships based on existing relationships between entities and the frequency of entity occurrence, and the mining operators include at least one of the following: supplementing relationships between different entities with sequential triplet instances; adding dangling edges or instance edges to entities with a frequency greater than a preset frequency. The process involves determining an evaluation score for each newly added triplet, identifying target triplet information based on the evaluation scores, and generating new threat intelligence data based on the target triplet information. This includes: calculating a confidence score for each newly added triplet to obtain a first score; sending each newly added triplet to the target client and receiving a second score from the client; determining the weights of the first and second scores, and determining the evaluation score for the newly added triplet based on the first score and its weight, and the second score and its weight; determining the evaluation score range for each newly added triplet and the associated credibility of the evaluation score range; and identifying newly added triplet information with a credibility level equal to the target credibility level as the target triplet information.

2. The method according to claim 1, characterized in that, Extracting threat event vectors from threat intelligence reports based on the defined triplet information includes: Determine the extraction depth, and at the extraction depth, extract triple information of multiple threat events from the threat intelligence report based on the defined triple information; The threat event vector is generated from the triple information of the multiple threat events.

3. The method according to claim 1, characterized in that, The attack link vector generated based on the network attack knowledge base includes: Multiple attack link triples are generated based on the attack strategies in the network attack knowledge base. The attack link vector is generated from the triple information of the multiple attack links.

4. The method according to claim 1, characterized in that, Before acquiring the triple information defined in the threat intelligence knowledge graph, the method further includes: Based on security knowledge and threat information, the entities, attribute values, and relationships of threat knowledge intelligence are determined, resulting in multiple triplet information; The threat intelligence knowledge graph is generated based on the multiple triple information, and the threat intelligence knowledge graph is stored in a graph database.

5. A threat intelligence data mining apparatus, applied to the threat intelligence data mining method according to any one of claims 1 to 4, characterized in that, include: The acquisition unit is used to acquire triple information defined in the threat intelligence knowledge graph. The vector generation unit is used to extract threat event vectors from the threat intelligence report based on the defined triplet information, and to generate attack link vectors based on the network attack knowledge base. The mining unit is used to mine triple information that does not exist in the threat intelligence knowledge graph under the constraints of the threat event vector and the attack link vector, and obtain new triple information. An evaluation unit is used to determine the evaluation score of each newly added triplet information, determine the target triplet information based on the evaluation score, and generate new threat intelligence data based on the target triplet information.

6. A computer storage medium, characterized in that, The computer storage medium is used to store a program, wherein the program, when running, controls the device where the computer storage medium is located to execute the threat intelligence data mining method according to any one of claims 1 to 4.

7. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the threat intelligence data mining method according to any one of claims 1 to 4 through the computer program.

Images