A threat intelligence sharing platform trust evaluation model and incentive mechanism integration method

Abstract

The application provides a threat intelligence sharing platform trust evaluation model and incentive mechanism integration method, and relates to the field of network security threat intelligence sharing. The integration method comprises the following steps: creating and recording a user credit table and a user evaluation table based on a blockchain smart contract; calculating a user credit score based on the user's uploading, purchasing and evaluating intelligence behaviors, and updating the user credit table; calculating an intelligence comprehensive evaluation score based on the user's intelligence evaluation behaviors and the user credit score, and updating the user evaluation table; and calculating and updating the intelligence selling point price of the blockchain based on the user's intelligence purchasing behaviors and the intelligence comprehensive evaluation score. The threat intelligence sharing platform trust evaluation model and incentive mechanism integration method provided by the application can effectively improve the accuracy of identifying malicious users and provide a more reasonable point price during intelligence transactions.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity threat intelligence sharing, and in particular to a trust evaluation model and incentive mechanism integration method for a threat intelligence sharing platform. Background Technology

[0002] Threat intelligence marketplaces are a way to promote information sharing in the cybersecurity field. They allow different organizations to exchange information about potential cyber threats to improve overall cybersecurity and play an effective role in promoting intelligence sharing among enterprises, organizations, and security agencies.

[0003] However, the quality and accuracy of intelligence information is a core issue that decentralized threat intelligence sharing platforms cannot ignore. Due to the openness and low barrier to entry of blockchain platforms, intelligence uploaded by users may not be rigorously verified, leading to the risk of erroneous or misleading information on the platform. For organizations that rely on this data to formulate security strategies, if they lack the ability to assess the reliability of intelligence, such information will not only fail to improve their security levels but may also lead to unnecessary resource consumption or even guide incorrect defensive measures.

[0004] Secondly, in traditional threat intelligence sharing models, organizations and users often lack sufficient motivation to proactively share the intelligence they possess. On the one hand, publicly available intelligence may inadvertently reveal vulnerabilities in their systems, increasing the risk of attack; on the other hand, without a fair and reasonable incentive system, organizations and users may feel that their efforts are not being adequately rewarded, thus reducing their enthusiasm for participating in intelligence sharing. Therefore, there is an urgent need to provide a solution to these problems. Summary of the Invention

[0005] The purpose of this invention is to provide a trust evaluation model and incentive mechanism integration method for a threat intelligence sharing platform, which improves the assessment and identification of malicious users and the evaluation of intelligence value in threat intelligence sharing platforms built on blockchain technology.

[0006] The present invention provides a trust evaluation model and incentive mechanism integration method for a threat intelligence sharing platform, which adopts the following technical solution:

[0007] S1. Create and record user reputation tables and user evaluation tables based on blockchain smart contracts;

[0008] S2. Calculate user reputation score based on user's uploaded, purchased, and rated information behavior, and update user reputation table;

[0009] S3. Calculate the comprehensive intelligence evaluation score based on user evaluation intelligence behavior and user reputation score, and update the user evaluation table;

[0010] The calculation of the comprehensive intelligence evaluation score based on user evaluation intelligence behavior and user reputation score includes:

[0011] S3.1, When the user Generate evaluation intelligence When engaging in such activities, intelligence is obtained. The first set of users who have given reviews is used to calculate the cosine similarity of the review vectors of any two users in the first set of users. When the cosine similarity is lower than the threshold, it is determined to be a valid review. The validity review parameters are calculated based on the number of valid reviews and the first set of users. The weight coefficients of historical reviews are adjusted based on the validity review parameters.

[0012] S3.2, Give to the user Evaluate the information uploaded by any other user by adding directed edges to obtain an evaluation relationship graph, and obtain the evaluation relationship for the user. The uploaded intelligence generated a second set of users who had evaluated it, and the users were calculated. The ranking in the platform intelligence evaluation relationship graph is based on the ranking and the user. The user's reputation score and rating similarity are calculated. The evaluation score weights are calculated using the following formula:

[0013] ;

[0014] In the formula, For users Evaluation score weighting, For users Evaluation similarity, For users Reputation score, For users Ranking in the platform intelligence evaluation relationship diagram For intelligence All evaluation scores are weighted and summed. For the first set of users;

[0015] S3.3, User-based The actual evaluation score, the weight of the evaluation score, and the weight coefficient of the historical evaluation are used to calculate the comprehensive intelligence evaluation score;

[0016] S4. Calculate and update the blockchain intelligence selling points price based on user intelligence purchase behavior and intelligence comprehensive evaluation score.

[0017] Optionally, during the process of creating and recording user reputation tables and user evaluation tables based on blockchain smart contracts, the user reputation table is used to record user reputation scores, and the user evaluation table is used to record intelligence comprehensive evaluation scores. The initial value of the new user reputation score is the average value of the user reputation table, and the initial value of the new intelligence evaluation score is 60.

[0018] Optionally, the process of calculating a user's reputation score based on the user's uploading, purchasing, and evaluating intelligence behavior includes: when a user on the threat intelligence sharing platform purchases, uploads, or evaluates intelligence, calculating a user reputation weight coefficient based on the user's intelligence purchase quantity, intelligence upload quantity, intelligence evaluation similarity, and user level within a week, and calculating a user reputation score based on the user weight coefficient.

[0019] Optionally, the following formula is used to calculate the user reputation weight coefficient based on the number of intelligence purchases, the number of intelligence uploads, the intelligence evaluation similarity, and the user level within a week:

[0020] ;

[0021] in, For users The reputation weight coefficient, , , , The weights of the impact factors are calculated as follows: , For users The difference taken when the number of intelligence purchases within a week exceeds the average number of intelligence purchases by all users on the platform. For users The difference taken when the number of intelligence uploads within a week exceeds the average number of intelligence uploads by all users on the platform. For users Evaluation similarity, User level.

[0022] Optionally, when calculating a user's reputation score based on user weight coefficients, the following formula may be used:

[0023] ;

[0024] in, for Time users Reputation score, for The user at the previous moment Reputation score, To increase or decrease reputation, For users The reputation weight coefficient, This is the average reputation weight coefficient for all users on the platform.

[0025] Optional, based on user The comprehensive intelligence evaluation score is calculated using the actual evaluation score, the weight of the evaluation score, and the weight coefficients of historical evaluations, using the following formula:

[0026] ;

[0027] in, for Real-time intelligence The overall evaluation score The weighting coefficient for historical evaluation. For intelligence Historical evaluation scores For the first set of users, For users Evaluation score weighting, For users intelligence The actual evaluation score.

[0028] Optionally, the process of calculating and updating the blockchain's intelligence selling points price based on user intelligence purchasing behavior and comprehensive intelligence evaluation scores includes:

[0029] When intelligence is purchased by a user for the first time, the intelligence uploaded by the user and the initial points price set by the user are obtained. Based on the platform's evaluation of the intelligence's value, conversion parameters are obtained. Based on the conversion parameters, the initial points price is converted, and the initial selling price is obtained through the platform's price dimension conversion. Points transactions are conducted based on the initial selling price. The factors that the platform evaluates for the intelligence's value include the intelligence's information content, type, and threat level.

[0030] When intelligence has a historical point price after being purchased by a user, the final selling point price of the intelligence is calculated based on the historical point price, the intelligence's comprehensive evaluation score, and the historical purchase quantity of the intelligence, and the intelligence selling information on the blockchain is updated.

[0031] Optionally, the following formula may be used to calculate the final selling price of intelligence in points:

[0032] ;

[0033] in, for Real-time intelligence The final selling price of points, , For price weighting coefficients, =1, for Previous moment intelligence Historical points prices for Real-time intelligence The overall evaluation score For intelligence Historical purchase volume.

[0034] The present invention proposes a trust evaluation model and incentive mechanism integration method for a threat intelligence sharing platform, which has the following advantages:

[0035] 1. This invention obtains a user's reputation score by quantitatively comparing the user's information uploading, purchasing, and evaluation behaviors with normal behaviors, and effectively improves the accuracy of identifying malicious users through the reputation score;

[0036] 2. By combining the evaluation relationship diagram of the evaluated users, the evaluation validity, and the reputation score, this invention can calculate the comprehensive intelligence evaluation score more effectively and accurately.

[0037] 3. This invention updates intelligence prices based on historical points prices, intelligence comprehensive evaluation scores, and historical purchase quantities, which can incentivize users to upload high-quality intelligence and receive higher-value rewards. Attached Figure Description

[0038] Figure 1 The present invention provides a flowchart of a trust evaluation model and incentive mechanism integration method for a threat intelligence sharing platform. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0040] This invention provides an integrated method for a trust evaluation model and incentive mechanism for a threat intelligence sharing platform, comprising:

[0041] S1. Create and record user reputation tables and user evaluation tables based on blockchain smart contracts;

[0042] S2. Calculate user reputation score based on user's uploaded, purchased, and rated information behavior, and update user reputation table;

[0043] S3. Calculate the comprehensive intelligence evaluation score based on user evaluation intelligence behavior and user reputation score, and update the user evaluation table;

[0044] S4. Calculate and update the blockchain intelligence selling points price based on user intelligence purchase behavior and intelligence comprehensive evaluation score.

[0045] In some embodiments, the process of performing step S1 includes: creating and recording a user reputation table and a user evaluation table based on a blockchain smart contract, wherein the user reputation table is used to record user reputation scores, the user evaluation table is used to record intelligence comprehensive evaluation scores, the initial value of the new user reputation score is the average value of the user reputation table, and the initial value of the new intelligence evaluation score is 60.

[0046] In fact, by establishing user reputation tables and user evaluation tables, it is possible to effectively ensure the quality of intelligence shared by users on the platform, the accuracy of the incentive mechanism in calculating intelligence points and prices, and prevent malicious users' violations from interfering with the operation of the platform mechanism.

[0047] In some embodiments, the process of performing step S2 includes:

[0048] S2.1 Calculate the user reputation weight coefficient;

[0049] S2.2 Calculate user reputation score based on user weight coefficient.

[0050] Specifically, when performing step S2.1, calculating the user reputation weight coefficient, the following steps are included: when a user of the threat intelligence sharing platform purchases, uploads, or evaluates intelligence, the user reputation weight coefficient is calculated based on the number of intelligence purchases, the number of intelligence uploads, the similarity of intelligence evaluations, and the user level within a week.

[0051] Furthermore, in calculating the user reputation weight coefficient based on the number of intelligence purchases, the number of intelligence uploads, the intelligence evaluation similarity, and the user level within a week, the following formula is used:

[0052] ;

[0053] in, For users The reputation weight coefficient, , , , The weights of the impact factors are calculated as follows: , For users The difference taken when the number of intelligence purchases within a week exceeds the average number of intelligence purchases by all users on the platform. For users The difference taken when the number of intelligence uploads within a week exceeds the average number of intelligence uploads by all users on the platform. For users Evaluation similarity, User level.

[0054] Furthermore, in computing users Evaluation similarity When calculating, use the following formula:

[0055] ;

[0056] in, For users The evaluation score vector, For users The evaluation score vector, For users on the user review form.

[0057] In practice, the main factors considered when calculating a user's reputation weight coefficient are as follows: when a user's purchase volume exceeds the platform's average threshold, they are considered an anomaly, and their reputation weight will be reduced accordingly; when a user's intelligence upload volume exceeds the platform's average threshold, they are considered an active user, and their reputation weight will be increased accordingly; the average cosine similarity between a user's rating score and that of other users on the platform is considered, with a higher similarity indicating that the user's rating is closer to the platform's average rating, and the higher the probability that they are an active and normal user; conversely, when a user's rating deviates too much from the platform's rating score, the higher the probability that they are an abnormal or malicious user, and their reputation weight will be reduced accordingly; when a user actively uploads intelligence and obtains the corresponding threshold points, their level will be improved, and the higher the user level, the higher their activity level, and the higher their reputation weight.

[0058] Specifically, in step S2.2, when calculating the user's reputation score based on the user weight coefficient, the following formula is used:

[0059] ;

[0060] in, for Time users Reputation score, for The user at the previous moment Reputation score, To increase or decrease reputation, For users The reputation weight coefficient, This is the average reputation weight coefficient for all users on the platform.

[0061] Furthermore, after calculating the user's reputation score, the user reputation table in the blockchain is updated.

[0062] In some embodiments, the process of performing step S3 includes:

[0063] S3.1 Calculate the weighting coefficients for historical intelligence evaluation;

[0064] S3.2 Calculate the weight of the user's evaluation score;

[0065] S3.3 Calculate the comprehensive evaluation score of intelligence.

[0066] Specifically, in step S3.1, when calculating the weighting coefficients for intelligence history evaluation, the following steps are included: when the user... Generate evaluation intelligence When engaging in such activities, intelligence is obtained. The first set of users who have generated reviews is used to calculate the cosine similarity of the review vectors of any two users in the first set of users. When the cosine similarity is lower than the threshold, it is determined to be a valid review. Based on the number of valid reviews and the first set of users, the validity review parameters are calculated, and the weight coefficients of historical reviews are adjusted based on the validity review parameters.

[0067] Furthermore, when calculating the validity evaluation parameters based on the number of valid evaluations and the first user set, the following formula is used:

[0068] ;

[0069] in, For effectiveness evaluation parameters, For intelligence The number of reviews For intelligence The first set of users who have posted comments For users The evaluation score vector, For users The evaluation score vector, The value is 0 when the cosine similarity of the rating vectors of two users is greater than 80%, and is considered an invalid rating; otherwise, the value is 1.

[0070] Specifically, in step S3.2, when calculating the user's rating score weight, the following steps are included:

[0071] S3.2.1 Calculate the user's ranking in the platform intelligence evaluation relationship graph;

[0072] S3.2.2 Calculate the weight of user rating scores.

[0073] Specifically, in step S3.2.1, when calculating the user's ranking in the platform intelligence evaluation relationship graph, the following steps are included: assigning the user... Evaluate the information uploaded by any other user by adding directed edges to obtain an evaluation relationship graph, and obtain the evaluation relationship for the user. The uploaded intelligence generated a second set of users who had evaluated it, and the users were calculated. Ranking in the platform intelligence evaluation relationship diagram.

[0074] Further, calculate the user The following formula is used to calculate the ranking in the platform intelligence evaluation relationship graph:

[0075] ;

[0076] in, For users Ranking in the platform intelligence evaluation relationship diagram The total number of platform users The damping coefficient is... For users The uploaded intelligence generated a second set of user evaluations. For users The number of reviews generated For users Ranking in the platform intelligence evaluation relationship diagram.

[0077] In reality, the fewer reviews a particular user generates, the more reviews other users provide. The more intelligence reviews uploaded, the higher the ranking, the higher the likelihood that it represents an active user, and correspondingly, the higher the review weight.

[0078] Specifically, in executing step S3.2.2, when calculating the user rating score weight, it includes: based on the ranking, the user... The user's reputation score and rating similarity are calculated. The evaluation score weights.

[0079] Further, calculate the user When weighting the evaluation scores, the following formula is used:

[0080] ;

[0081] in, For users Evaluation score weighting, For users Evaluation similarity, For users Reputation score, For users Ranking in the platform intelligence evaluation relationship diagram For intelligence All evaluation scores are weighted and summed. This is the first set of users.

[0082] Specifically, in step S3.3, when calculating the comprehensive intelligence evaluation score, the following steps are included: based on user... The actual evaluation score, the weight of the evaluation score, and the weight coefficient of the historical evaluation are used to calculate the comprehensive evaluation score.

[0083] Furthermore, the overall intelligence evaluation score is calculated using the following formula:

[0084] ;

[0085] in, for Real-time intelligence The overall evaluation score The weighting coefficient for historical evaluation. For intelligence Historical evaluation scores For the first set of users, For users Evaluation score weighting, For users intelligence The actual evaluation score.

[0086] In some embodiments, the process of performing step S4 includes:

[0087] When intelligence is purchased by a user for the first time, the intelligence uploaded by the user and the initial points price set by the user are obtained. Based on the platform's evaluation of the intelligence's value, conversion parameters are obtained. Based on the conversion parameters, the initial points price is converted, and the initial selling price is obtained through the platform's price dimension conversion. Points transactions are conducted based on the initial selling price. The factors that the platform evaluates for the intelligence's value include the intelligence's information content, type, and threat level.

[0088] When intelligence has a historical point price after being purchased by a user, the final selling point price of the intelligence is calculated based on the historical point price, the intelligence's comprehensive evaluation score, and the historical purchase quantity of the intelligence, and the intelligence selling information on the blockchain is updated.

[0089] Furthermore, the following formula is used to calculate the final selling price of intelligence in points:

[0090] ;

[0091] in, for Real-time intelligence The final selling price of points, , For price weighting coefficients, =1, for Previous moment intelligence Historical points prices for Real-time intelligence The overall evaluation score For intelligence Historical purchase volume.

[0092] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A trust evaluation model and incentive mechanism integration method for a threat intelligence sharing platform, characterized in that, Includes the following steps: S1. Create and record user reputation tables and user evaluation tables based on blockchain smart contracts; S2. Calculate user reputation score based on user's uploaded, purchased, and rated information behavior, and update user reputation table; S3. Calculate the comprehensive intelligence evaluation score based on user evaluation intelligence behavior and user reputation score, and update the user evaluation table; The calculation of the comprehensive intelligence evaluation score based on user evaluation intelligence behavior and user reputation score includes: S3.1, When the user Generate evaluation intelligence When engaging in such activities, intelligence is obtained. The first set of users who have given reviews is used to calculate the cosine similarity of the review vectors of any two users in the first set of users. When the cosine similarity is lower than the threshold, it is determined to be a valid review. The validity review parameters are calculated based on the number of valid reviews and the first set of users. The weight coefficients of historical reviews are adjusted based on the validity review parameters. S3.2, Give to the user Evaluate the information uploaded by any other user by adding directed edges to obtain an evaluation relationship graph, and obtain the evaluation relationship for the user. The uploaded intelligence generated a second set of users who had evaluated it, and the users were calculated. The ranking in the platform intelligence evaluation relationship graph is based on the ranking and the user. The user's reputation score and rating similarity are calculated. The evaluation score weights are calculated using the following formula: ； In the formula, For users Evaluation score weighting, For users Evaluation similarity, For users Reputation score, For users Ranking in the platform intelligence evaluation relationship diagram For intelligence All evaluation scores are weighted and summed. For the first set of users; S3.3, User-based The actual evaluation score, the weight of the evaluation score, and the weight coefficient of the historical evaluation are used to calculate the comprehensive intelligence evaluation score; S4. Calculate and update the blockchain intelligence selling points price based on user intelligence purchase behavior and intelligence comprehensive evaluation score.

2. The method for integrating a trust evaluation model and incentive mechanism for a threat intelligence sharing platform according to claim 1, characterized in that, In the process of creating and recording user reputation tables and user evaluation tables based on blockchain smart contracts, the user reputation table is used to record user reputation scores, and the user evaluation table is used to record intelligence comprehensive evaluation scores. The initial value of a new user's reputation score is the average value of the user reputation table, and the initial value of a new intelligence evaluation score is 60.

3. The method for integrating a trust evaluation model and incentive mechanism for a threat intelligence sharing platform according to claim 1, characterized in that, The process of calculating a user's reputation score based on user-uploaded, purchased, and rated information includes: When a user on the threat intelligence sharing platform purchases, uploads, or evaluates intelligence, the user's reputation weight coefficient is calculated based on the number of intelligence purchases, the number of intelligence uploads, the similarity of intelligence evaluations, and the user's level within a week. The user's reputation score is then calculated based on the user weight coefficient.

4. The method for integrating a trust evaluation model and incentive mechanism for a threat intelligence sharing platform according to claim 3, characterized in that, The following formula is used to calculate the user reputation weight coefficient based on the number of intelligence purchases, the number of intelligence uploads, the similarity of intelligence evaluations, and the user's level within a week: ； in, For users The reputation weight coefficient, , , , The weights of the impact factors are calculated as follows: , For users The difference taken when the number of intelligence purchases within a week exceeds the average number of intelligence purchases by all users on the platform. For users The difference taken when the number of intelligence uploads within a week exceeds the average number of intelligence uploads by all users on the platform. For users Evaluation similarity, User level.

5. The method for integrating a trust evaluation model and incentive mechanism for a threat intelligence sharing platform according to claim 4, characterized in that, When calculating a user's reputation score based on user weight coefficients, the following formula is used: ； in, for Time users Reputation score, for The user at the previous moment Reputation score, To increase or decrease reputation, For users The reputation weight coefficient, This is the average reputation weight coefficient for all users on the platform.

6. The method for integrating a trust evaluation model and incentive mechanism for a threat intelligence sharing platform according to claim 1, characterized in that, Based on user The comprehensive intelligence evaluation score is calculated using the actual evaluation score, the weight of the evaluation score, and the weight coefficients of historical evaluations, using the following formula: ； in, for Real-time intelligence The overall evaluation score The weighting coefficient for historical evaluation. For intelligence Historical evaluation scores For the first set of users, For users Evaluation score weighting, For users intelligence The actual evaluation score.

7. The method for integrating a trust evaluation model and incentive mechanism for a threat intelligence sharing platform according to claim 1, characterized in that, The process of calculating and updating the blockchain-based intelligence selling points price based on user intelligence purchasing behavior and comprehensive intelligence evaluation scores includes: When intelligence is purchased by a user for the first time, the intelligence uploaded by the user and the initial points price set by the user are obtained. Based on the platform's evaluation of the intelligence's value, conversion parameters are obtained. Based on the conversion parameters, the initial points price is converted, and the initial selling price is obtained through the platform's price dimension conversion. Points transactions are conducted based on the initial selling price. The factors that the platform evaluates for the intelligence's value include the intelligence's information content, type, and threat level. When intelligence has a historical point price after being purchased by a user, the final selling point price of the intelligence is calculated based on the historical point price, the intelligence's comprehensive evaluation score, and the historical purchase quantity of the intelligence, and the intelligence selling information on the blockchain is updated.

8. The method for integrating a trust evaluation model and incentive mechanism for a threat intelligence sharing platform according to claim 7, characterized in that, The following formula is used to calculate the final selling price of intelligence in points: ； in, for Real-time intelligence The final selling price of points, , For price weighting coefficients, =1, for Previous moment intelligence Historical points prices for Real-time intelligence The overall evaluation score For intelligence Historical purchase volume.

Images