Threat intelligence sharing platform trust evaluation model and incentive mechanism integration method

Abstract

The invention provides a threat intelligence sharing platform trust evaluation model and incentive mechanism integration method, and relates to the field of network security threat intelligence sharing. The integration method comprises the following steps: creating and recording a user reputation table and a user evaluation table based on a block chain intelligent contract; calculating a user reputation score based on information uploading, purchasing and evaluating behaviors of the user, and updating a user reputation table; calculating an intelligence comprehensive evaluation score based on the user evaluation intelligence behavior and the user reputation score, and updating a user evaluation table; and calculating and updating the intelligence selling point price of the block chain based on the user purchase intelligence behavior and the intelligence comprehensive evaluation score. According to the threat intelligence sharing platform trust evaluation model and incentive mechanism integration method provided by the invention, the malicious user identification accuracy can be effectively improved, and a more reasonable point price is provided during intelligence transaction.

Description

Technical Field

[0001] The present invention relates to the field of network security threat intelligence sharing, and in particular to a threat intelligence sharing platform trust evaluation model and incentive mechanism integration method. Background Art

[0002] The threat intelligence market is a way to promote information sharing in the field of cybersecurity. It allows different organizations to exchange information about potential network threats to improve the overall level of cybersecurity, and plays an effective role in promoting the sharing of intelligence information between corporate organizations and security agencies.

[0003] However, the quality and accuracy of intelligence information are core issues that cannot be ignored in decentralized threat intelligence sharing platforms. Due to the openness and low barriers to entry of blockchain platforms, user-uploaded intelligence may not be rigorously verified, leading to the risk of erroneous or misleading information on the platform. For organizations that rely on this data to formulate security policies, if they lack the ability to assess the reliability of this intelligence, this information will not only fail to improve their security protection level, but may also lead to unnecessary resource consumption and even misguided defensive measures.

[0004] Secondly, in traditional threat intelligence sharing models, organizations and users often lack sufficient motivation to proactively share their intelligence. On the one hand, disclosing intelligence may inadvertently reveal vulnerabilities in their own systems, increasing the risk of attack. On the other hand, without a fair and reasonable incentive system, organizations and users may feel that their efforts are not being rewarded, thus reducing their enthusiasm for intelligence sharing. Therefore, a solution to these problems is urgently needed. Summary of the Invention

[0005] The purpose of this invention is to provide a trust evaluation model and incentive mechanism integration method for a threat intelligence sharing platform, which improves the evaluation and identification of malicious users and the problem of intelligence value assessment in a threat intelligence sharing platform built based on blockchain technology.

[0006] The present invention provides a threat intelligence sharing platform trust evaluation model and incentive mechanism integration method using the following technical solutions: Create and record user reputation tables and user evaluation tables based on blockchain smart contracts; Calculate user reputation scores based on user upload, purchase, and evaluation behaviors, and update the user reputation table; Calculate the intelligence comprehensive evaluation score based on the user's evaluation behavior and user reputation score, and update the user evaluation table; The intelligence selling points price on the blockchain is calculated and updated based on the user's intelligence purchasing behavior and intelligence comprehensive evaluation score.

[0007] Optionally, in the process of creating and recording the user reputation table and the user evaluation table based on the blockchain smart contract, the user reputation table is used to record the user reputation score, and the user evaluation table is used to record the intelligence comprehensive evaluation score, the initial value of the new user reputation score is the average value of the user reputation table, and the initial value of the new intelligence evaluation score is 60.

[0008] Optionally, in the process of calculating the user reputation score based on the user uploading, purchasing and evaluating intelligence behaviors, the process comprises: when a user of the threat intelligence sharing platform performs purchasing, uploading and evaluating intelligence, calculating a user reputation weight coefficient based on intelligence purchase quantity, intelligence upload quantity, intelligence evaluation similarity and user level of the user within one week, and calculating the user reputation score based on the user weight coefficient.

[0009] Optionally, in the process of calculating the user reputation weight coefficient based on the intelligence purchase quantity, the intelligence upload quantity, the intelligence evaluation similarity and the user level of the user within one week, the following formula is used: ; wherein, is the reputation weight coefficient of the user, , , , , is the weight of the influence factor, and the calculation method is , is the difference value when the intelligence purchase quantity of the user within one week exceeds the average intelligence purchase quantity of all users of the platform, is the difference value when the intelligence upload quantity of the user within one week exceeds the average intelligence upload quantity of all users of the platform, is the evaluation similarity of the user, is the user level. Optionally, in the process of calculating the user reputation score based on the user weight coefficient, the following formula is used:

[0010] ; wherein, is the reputation score of the user at the moment, is the reputation score of the user at the last moment, is the reputation increase or decay coefficient, is the reputation weight coefficient of the user, ​​​​​​​​An average reputation weight coefficient for all users of the platform.

[0011] Optionally, in the process of calculating the comprehensive evaluation score of the information based on the information evaluation behavior of the user and the reputation score of the user, the following steps are included: When the user produces the evaluation information behavior, a first user set that has produced evaluation information is obtained, the cosine similarity of the evaluation vectors of any two users in the first user set is calculated, when the cosine similarity is lower than a threshold value, it is determined as effective evaluation, an effectiveness evaluation parameter is calculated based on the number of effective evaluations and the first user set, and the weight coefficient of the historical evaluation is adjusted based on the effectiveness evaluation parameter; The user adds a directed edge to the evaluation relationship graph when evaluating information uploaded by any other user, and a second user set that has produced evaluation information uploaded by the user is obtained, the ranking of the user in the information evaluation relationship graph of the platform is calculated, the evaluation score weight of the user is calculated based on the ranking, the reputation score of the user and the evaluation similarity; The comprehensive evaluation score of the information is calculated based on the actual evaluation score of the user , the evaluation score weight and the weight coefficient of the historical evaluation.

[0012] Optionally, the evaluation score weight of the user is calculated based on the ranking, the reputation score of the user and the evaluation similarity, using the following formula: ; Wherein, is the evaluation score weight of the user , is the evaluation similarity of the user , is the reputation score of the user , is the ranking of the user in the information evaluation relationship graph of the platform, is the sum of all evaluation score weights of the information , and is the first user set.

[0013] Optionally, the comprehensive evaluation score of the information is calculated based on the actual evaluation score of the user , the evaluation score weight and the weight coefficient of the historical evaluation, using the following formula: ;​​ wherein, is the moment information The comprehensive evaluation score, is the weight coefficient of historical evaluation, is the historical evaluation score of information , is the first user set, is the evaluation score weight of user , is the actual evaluation score of user to information .

[0014] Optionally, in the process of calculating and updating the information selling point price of the blockchain based on the user's purchase of information and the comprehensive evaluation score of information, comprising: When the information is purchased by the user for the first time, the information uploaded by the user and the initial point price set by the user are obtained, the conversion parameter is obtained based on the evaluation of the value of the information by the platform, the initial point price is converted based on the conversion parameter, and the initial selling price is obtained through the platform price dimension conversion, the point transaction is carried out based on the initial selling price, and the factors for the evaluation of the value of the information by the platform include the information amount, type, threat level of information; When the information has a historical point price after being purchased by the user, the final selling point price of the information is calculated based on the historical point price of the information, the comprehensive evaluation score of the information and the historical purchase quantity of the information, and the information selling information of the blockchain is updated.

[0015] Optionally, when calculating the final selling point price of the information, the following formula is used: ; wherein, is the final selling point price of the information at the moment, , , is the price weight coefficient, =1, is the historical point price of the information at the last moment, is the comprehensive evaluation score of the information at the moment, is the historical purchase quantity of the information . The trust evaluation model and incentive mechanism integration method of the threat information sharing platform proposed by the application are beneficial in that:

[0016] The trust evaluation model and incentive mechanism integration method of the threat information sharing platform proposed by the application are beneficial in that: ​1. The application obtains the credit score of the user by quantitatively comparing the user's uploading, purchasing and evaluating information behavior with normal behavior, and effectively improves the accuracy of identifying malicious users through the credit score; 2. The application can more effectively and accurately calculate the information comprehensive evaluation score by combining the evaluation relationship graph, evaluation effectiveness and credit score of the user; 3. The application can encourage users to upload high-quality information and obtain higher value feedback by updating the information price based on the historical credit price, information comprehensive evaluation score and historical purchase quantity. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 A threat information sharing platform trust evaluation model and incentive mechanism integration method flowchart is provided. DETAILED DESCRIPTION

[0018] To make the purpose, technical solutions and advantages of the embodiments of the application clearer, the technical solutions in the embodiments of the application will be described clearly and completely below. Obviously, the described embodiments are part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the usual meaning understood by those skilled in the art. The use of "including" and similar words in this document means that the elements or objects before the word cover the elements or objects listed after the word and their equivalents, and do not exclude other elements or objects.

[0019] The embodiments of the application provide a threat information sharing platform trust evaluation model and incentive mechanism integration method, which comprises: S1, creating and recording a user credit table and a user evaluation table based on a blockchain smart contract; S2, calculating the user credit score based on the user's uploading, purchasing and evaluating information behavior, and updating the user credit table; S3, calculating the information comprehensive evaluation score based on the user's evaluating information behavior and the user credit score, and updating the user evaluation table; S4, calculating and updating the information selling credit price of the blockchain based on the user's purchasing information behavior and the information comprehensive evaluation score.

[0020] In some embodiments, in the process of performing step S1, the following is included: creating and recording a user reputation table and a user evaluation table based on a blockchain smart contract, the user reputation table is used to record user reputation scores, and the user evaluation table is used to record intelligence comprehensive evaluation scores, the initial value of the new user reputation score is the average value of the user reputation table, and the initial value of the new intelligence evaluation score is 60.

[0021] In fact, by establishing a user reputation table and a user evaluation table, the quality of intelligence shared by users to the platform and the accuracy of the intelligence point price calculation incentive mechanism can be effectively guaranteed, and the interference of malicious user violation behavior on the operation of the platform mechanism can be prevented.

[0022] In some embodiments, in the process of performing step S2, the following is included: S2.1, calculating a user reputation weight coefficient; S2.2, calculating a user reputation score based on the user weight coefficient.

[0023] Specifically, in the process of performing step S2.1, calculating a user reputation weight coefficient, the following is included: when a user of a threat intelligence sharing platform purchases, uploads, and evaluates intelligence, a user reputation weight coefficient is calculated based on the intelligence purchase quantity, intelligence upload quantity, intelligence evaluation similarity, and user level of the user within one week.

[0024] Further, in the process of calculating the user reputation weight coefficient based on the intelligence purchase quantity, intelligence upload quantity, intelligence evaluation similarity, and user level of the user within one week, the following formula is used: ; Wherein, is the reputation weight coefficient of the user , , , , is the weight of the influence factor, and the calculation method is , is the difference value when the intelligence purchase quantity of the user within one week exceeds the average intelligence purchase quantity of all users of the platform, is the difference value when the intelligence upload quantity of the user within one week exceeds the average intelligence upload quantity of all users of the platform, is the evaluation similarity of the user , is the user level.

[0025] Further, in the process of calculating the evaluation similarity of the user , the following formula is used for calculation: ; in, For users The evaluation score vector of For users The evaluation score vector of For users on the user evaluation form.

[0026] In fact, when calculating the user reputation weight coefficient, the main factors to be considered are: when the user's purchase volume exceeds the platform's average threshold, it is considered to be abnormal, and its reputation weight will be reduced accordingly; when the user's intelligence upload volume exceeds the platform's average threshold, it is considered to be an active user, and its reputation weight will be increased accordingly; when the average cosine similarity of the user's evaluation scores with other users on the platform, the greater the similarity, the closer the user's evaluation is to the platform's average evaluation, and the more likely it is that the user is an active and normal user. Conversely, when the user's evaluation deviates too much from the platform's evaluation score, the more likely it is that the user is an abnormal or malicious user, and its reputation weight will be reduced accordingly; when the user actively uploads intelligence and obtains the corresponding threshold points, its level will be increased. The higher the user level, the higher its enthusiasm, and the higher its reputation weight will be accordingly.

[0027] Specifically, when executing step S2.2, the user reputation score is calculated based on the user weight coefficient, and the following formula is used for calculation: ; in, for Moment User The reputation score, for The last moment user The reputation score, is the reputation increase or decay coefficient, For users The reputation weight coefficient, is the average reputation weight coefficient of all users on the platform.

[0028] Furthermore, after the user's reputation score is calculated, the user's reputation table in the blockchain is updated.

[0029] In some embodiments, the process of executing step S3 includes: S3.1. Calculate the weight coefficient for intelligence historical evaluation; S3.2. Calculate the user's evaluation score weight; S3.3. Calculate the comprehensive intelligence evaluation score.

[0030] Specifically, when executing step S3.1, calculating the weight coefficient of intelligence history evaluation, it includes: when the user Generate evaluation intelligence When the behavior A first user set with evaluations is generated, and the cosine similarity of the evaluation vectors of any two users in the first user set is calculated. When the cosine similarity is lower than a threshold, it is determined to be a valid evaluation. A validity evaluation parameter is calculated based on the number of valid evaluations and the first user set, and the weight coefficient of the historical evaluation is adjusted based on the validity evaluation parameter.

[0031] Furthermore, when calculating the effectiveness evaluation parameter based on the number of valid evaluations and the first user set, the following formula is used for calculation: ; in, is the effectiveness evaluation parameter, For intelligence The number of reviews, For intelligence The first set of users who have made comments, For users The evaluation score vector of For users The evaluation score vector of When the cosine similarity of the evaluation vectors of two users is greater than 80% of the users, the value is 0, which is considered an invalid evaluation. Otherwise, the value is 1.

[0032] Specifically, when executing step S3.2, calculating the user's evaluation score weight, it includes: S3.2.1. Calculate the user's ranking in the platform intelligence evaluation relationship diagram; S3.2.2. Calculate the weight of user evaluation scores.

[0033] Specifically, when executing step S3.2.1, calculating the ranking of the user in the platform intelligence evaluation relationship diagram, it includes: giving the user Evaluate the information uploaded by any other user by adding directed edges to obtain the evaluation relationship graph and obtain the user The uploaded intelligence generates a second set of users who have evaluated it, and the user Ranking in the platform intelligence evaluation relationship diagram.

[0034] Furthermore, the user The ranking in the platform intelligence evaluation relationship diagram is calculated using the following formula: ; in, For users Ranking in the platform intelligence evaluation relationship diagram, is the total number of platform users, is a damping coefficient, is a second user set which has generated the evaluation on the information uploaded by the user, is the number of evaluations generated by the user, is the ranking of the user in the information evaluation relationship graph of the platform,

[0035] In fact, when a user generates less evaluations, and other users generate more evaluations on the information uploaded by the user, the ranking of the user is higher, and the possibility of the user being an active user is higher, and correspondingly, the evaluation weight of the user is higher.

[0036] Specifically, when the user evaluation score weight is calculated in step S3.2.2, the following is included: the user evaluation score weight is calculated based on the ranking, the reputation score of the user, and the evaluation similarity.

[0037] Further, when the user evaluation score weight is calculated, the following formula is used: wherein, is the evaluation score weight of the user, is the evaluation similarity of the user, is the reputation score of the user, is the ranking of the user in the information evaluation relationship graph of the platform, is the sum of all evaluation score weights of the information, is the first user set. Specifically, when the information comprehensive evaluation score is calculated in step S3.3, the following is included: the information comprehensive evaluation score is calculated based on the actual evaluation score of the user, the evaluation score weight, and the weight coefficient of historical evaluation. Further, when the information comprehensive evaluation score is calculated, the following formula is used:

[0038] wherein, is the comprehensive evaluation score of the information at the moment, is the weight coefficient of historical evaluation,

[0039] is the information ​​​​​​​​​​​​​​​​​ Historical evaluation scores, is the first user set, For users The evaluation score weight, For users Intelligence The actual evaluation score.

[0040] In some embodiments, the process of executing step S4 includes: When intelligence is purchased by a user for the first time, the platform obtains the intelligence uploaded by the user and the initial point price set by the user, evaluates the value of the intelligence based on the platform to obtain a conversion parameter, converts the initial point price based on the conversion parameter, and obtains an initial selling price through platform price dimension conversion. The platform then conducts a point transaction based on the initial selling price. The platform evaluates the value of the intelligence based on factors including the amount of information, type, and threat level of the intelligence. When intelligence has a historical point price after being purchased by a user, the final selling point price of the intelligence is calculated based on the historical point price of the intelligence, the comprehensive evaluation score of the intelligence, and the historical purchase quantity of the intelligence, and the intelligence sales information on the blockchain is updated.

[0041] Furthermore, the following formula is used to calculate the final selling price of intelligence points: ; in, for Real-time intelligence The final selling price of points, 、 is the price weight coefficient, =1, for Last moment information The historical point price of for Real-time intelligence The comprehensive evaluation score of For intelligence The historical purchase quantity.

[0042] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1.A method for integrating a trust evaluation model and an incentive mechanism of a threat intelligence sharing platform, characterized in that, The following steps are involved: Create and record user reputation tables and user evaluation tables based on blockchain smart contracts; Calculate user reputation scores based on user upload, purchase, and evaluation behaviors, and update the user reputation table; Calculate the intelligence comprehensive evaluation score based on the user's evaluation behavior and user reputation score, and update the user evaluation table; The intelligence selling points price on the blockchain is calculated and updated based on the user's intelligence purchasing behavior and intelligence comprehensive evaluation score. 2.The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method of claim 1, wherein, In the process of creating and recording the user reputation table and user evaluation table based on the blockchain smart contract, the user reputation table is used to record the user reputation score, and the user evaluation table is used to record the comprehensive intelligence evaluation score. The initial value of the new user's reputation score is the average value of the user reputation table, and the initial value of the new intelligence evaluation score is 60. 3.The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method of claim 1, wherein, The process of calculating user reputation scores based on user upload, purchase, and evaluation intelligence behaviors includes: When users of the threat intelligence sharing platform purchase, upload, or evaluate intelligence, the user's reputation weight coefficient is calculated based on the user's intelligence purchase quantity, intelligence upload quantity, intelligence evaluation similarity, and user level within a week, and the user's reputation score is calculated based on the user weight coefficient. 4.The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method of claim 3, wherein, The following formula is used to calculate the user's reputation weight coefficient based on the user's intelligence purchase quantity, intelligence upload quantity, intelligence evaluation similarity, and user level within a week: ； in, For users The reputation weight coefficient, 、 、 、 is the weight of the impact factor, which is calculated as , For users The difference between the number of intelligence purchases in a week and the average number of intelligence purchases by all platform users. For users The difference between the number of intelligence uploads in a week and the average number of intelligence uploads by all users on the platform. For users The evaluation similarity of For user level. 5.The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method of claim 4, wherein, When calculating the user's reputation score based on the user weight coefficient, the following formula is used: ； wherein, is the reputation score of the user at the time t, is the reputation score of the user at the time t-1, is a reputation increase or decay coefficient, is a reputation weight coefficient of the user, is the average reputation weight coefficient of all users of the platform.​​​ 6.The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method of claim 1, wherein, The process of calculating the comprehensive intelligence evaluation score based on user evaluation intelligence behavior and user reputation score includes: When a user generates an evaluation information , the behavior of the user is acquired , a first user set that has generated an evaluation is calculated, the cosine similarity of the evaluation vectors of any two users in the first user set is calculated, when the cosine similarity is lower than a threshold value, it is determined as an effective evaluation, an effectiveness evaluation parameter is calculated based on the number of effective evaluations and the first user set, and the weight coefficient of the historical evaluation is adjusted based on the effectiveness evaluation parameter; to the user obtain an evaluation relationship graph by adding directed edges to the information uploaded by other arbitrary users, and obtain a second user set that has evaluated the information uploaded by the user obtain a second user set that has evaluated the information uploaded by the user rank the user in the platform information evaluation relationship graph, and calculate an evaluation score weight of the user based on the ranking, a reputation score of the user, and an evaluation similarity ​​ User-based The comprehensive evaluation score of intelligence is calculated based on the actual evaluation score, the evaluation score weight and the weight coefficient of historical evaluation. 7.The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method of claim 6, wherein, based on the ranking, the user's reputation score, and the review similarity, the user's review score weight is calculated using the following equation: ； wherein, an evaluation score weight of a user, a similarity of an evaluation of a user, a reputation score of a user, a ranking of a user in a platform intelligence evaluation relationship graph, an intelligence all evaluation score weights and a first user set.​​​​ 8.The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method of claim 7, wherein, User-based The actual evaluation score, the evaluation score weight and the weight coefficient of the historical evaluation are used to calculate the intelligence comprehensive evaluation score using the following formula: ； in, for Real-time intelligence The comprehensive evaluation score of is the weight coefficient of historical evaluation, For intelligence Historical evaluation scores, is the first user set, For users The evaluation score weight, For users Intelligence The actual evaluation score. 9.The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method of claim 1, wherein, The process of calculating and updating the blockchain intelligence sales point price based on the user's intelligence purchasing behavior and intelligence comprehensive evaluation score includes: When intelligence is purchased by a user for the first time, the platform obtains the intelligence uploaded by the user and the initial point price set by the user, evaluates the value of the intelligence based on the platform to obtain a conversion parameter, converts the initial point price based on the conversion parameter, and obtains an initial selling price through platform price dimension conversion. The platform then conducts a point transaction based on the initial selling price. The platform evaluates the value of the intelligence based on factors including the amount of information, type, and threat level of the intelligence. When intelligence has a historical point price after being purchased by a user, the final selling point price of the intelligence is calculated based on the historical point price of the intelligence, the comprehensive evaluation score of the intelligence, and the historical purchase quantity of the intelligence, and the intelligence sales information on the blockchain is updated. 10.The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method of claim 9, wherein, The following formula is used to calculate the final sales point price of intelligence: ； wherein, is the final sale score of the information at the time t, , , is a price weight coefficient, = 1, is the historical sale score of the information at the time t-1, , is the comprehensive evaluation score of the information at the time t, , , is the historical purchase quantity of the information, .

Images