Mental language threat intelligence clue expansion method, system and device and medium

Abstract

The invention provides a minority language threat intelligence clue expansion method, system and device and a medium, and belongs to the technical field of network security. The method comprises the steps of obtaining minority language threat intelligence, performing data cleaning, format conversion and semantic index establishment on intelligence information, and constructing a vector knowledge base by utilizing a vectorization model based on the processed intelligence information to serve as an initial threat intelligence base; acquiring tactics, technologies and associated information related to the attack from the initial threat intelligence library by using a preset agent, and outputting semi-structured attack process description information; and based on the attack process description information, obtaining extension information and context promotion information, obtaining depth information related to an attack technology through analysis and retrieval, and generating a structured or reported threat intelligence clue extension result. According to the method, the multi-agent with domain knowledge and scene memory is utilized, and analysis and understanding of cross-language threat intelligence, intelligence key point extraction and semi-structured representation output are achieved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and more particularly to a small language threat intelligence clue expansion method, system, device and medium. BACKGROUND

[0002] In the field of network security, security analysts and threat intelligence researchers will encounter a large number of unstructured document materials every day, such as attack analysis reports, threat intelligence bulletins and technical research papers in PDF format. These files contain rich and critical attacker tactics, techniques and procedures (TTPs), related vulnerabilities, abnormal traffic, malware usage, infrastructure information, accounts, processes and related context information. However, this information is often presented in natural language descriptions, which usually needs to be analyzed and interpreted by security department personnel before it can be used for intelligence expansion and subsequent automated early warning, security protection strategy generation. However, the analysis and interpretation of massive intelligence data by manpower not only consumes a lot of time, but also is inefficient, especially for small language related threat intelligence, which also requires additional translation work, further increasing time consumption and reducing efficiency. Therefore, intelligent analysis technology for small language threat intelligence has become an inevitable choice.

[0003] Small language threat intelligence clue expansion refers to collecting, analyzing and utilizing network security related information in non-mainstream languages to expand and supplement the existing threat intelligence system. By integrating small language threat intelligence, security teams can build a more comprehensive and diversified threat intelligence knowledge base, improving the perception and early warning effect of the security situation in local hotspots.

[0004] Specifically, small language threat intelligence clue expansion can bring information resource advantages and practical application value to the network security department. From the perspective of information resources, this task can expand the language coverage of threat intelligence, enrich the data sources of threat intelligence, and improve the comprehensiveness and accuracy of threat intelligence. From the perspective of practical application, it can help security teams discover and respond to emerging threats from small language areas, and improve the perception of global network security situation. For the network security department, small language threat intelligence clue expansion can fill the gaps in the existing threat intelligence system, enhance the early warning and defense capabilities of network attacks in small language areas, and thus more comprehensively protect the network security of organizations.

[0005] The existing small language threat intelligence clue expansion methods are as follows: (1) Machine Translation (MT) driven method: through the use of machine translation technology to convert small language text into mainstream language for automatic or semi-automatic intelligence extraction and analysis.

[0006] (2) Based on natural language processing (NLP) and text mining: In the original context of small language text, directly apply or customize NLP technology to extract key information from the text and build a threat intelligence knowledge base.

[0007] (3) Artificial or semi-artificial review method: Based on machine translation or preliminary automatic results, professional personnel familiar with the target small language and the field of network security are used to review, supplement or correct, so as to improve the credibility and accuracy of threat intelligence (4) Based on multilingual knowledge graph or knowledge base: After extracting entities and relationships from intelligence data in multiple languages, a consistent multilingual threat intelligence knowledge graph or knowledge base is constructed for unified management and query of small language and mainstream language threat intelligence information.

[0008] (5) Based on Web crawler and OSINT (Open Source Intelligence): Use open source intelligence technologies such as crawler, web scraping and social media monitoring to obtain original intelligence data from small language forums, social platforms, news, technical blogs, etc. After cleaning and analysis, it is integrated.

[0009] However, the above traditional methods have the following limitations in small language threat intelligence clue expansion: The quality of multilingual translation and semantic understanding is still limited: the existing technology is not enough for the processing of specific terms and expressions in the field of network security, which reduces the accuracy of intelligence extraction.

[0010] It is difficult to build a large data knowledge graph or knowledge base: when building a multilingual knowledge graph, the alignment of entities and relationships is challenging, affecting the effectiveness of intelligence integration and query.

[0011] Small language security experts and technical resources are scarce: artificial or semi-artificial methods rely on expert participation, which is inefficient and difficult to meet the rapid processing needs of a large amount of information.

[0012] The cost of domain-adapted NLP or model training is huge: the limited high-quality corpus and professional terminology resources of small languages affect the training effect of machine translation and natural language processing models, increasing the cost of model training.

[0013] High information noise: the data obtained through network crawler and open source intelligence has uneven quality, which requires a lot of cleaning and analysis work. SUMMARY

[0014] To solve the above problems, the application aims to provide a small language threat intelligence clue expansion method, system, device and medium, which uses multi-agent with domain knowledge and scene memory to realize analysis and understanding of cross-language threat intelligence, intelligence point extraction and semi-structured representation output, and can improve small language threat intelligence processing efficiency, expand threat intelligence coverage and enhance threat warning capability.

[0015] To achieve the above-mentioned purpose, the application realizes the above-mentioned purpose by the following technical solutions: In a first aspect, the application provides a small language threat intelligence clue expansion method, comprising: Obtaining small language threat intelligence, performing data cleaning, format conversion and semantic index building on intelligence information, and constructing a vector knowledge base based on the processed intelligence information using a vectorization model as an initial threat intelligence base; Using a preset agent to obtain attack-related tactics, techniques and associated information from the initial threat intelligence base, and outputting semi-structured attack process description information; Based on the attack process description information, obtaining expansion information and context improvement information, obtaining depth information related to attack techniques through analysis and retrieval, and generating structured or reported threat intelligence clue expansion results.

[0016] In an optional implementation, the obtaining small language threat intelligence, performing data cleaning, format conversion and semantic index building on intelligence information, and constructing a vector knowledge base based on the processed intelligence information using a vectorization model as an initial threat intelligence base, comprises: Obtaining unstructured and semi-structured original small language threat intelligence files, converting the original small language threat intelligence files into a processable text format, and removing special characters and redundant labels to generate standardized files; According to the semantic or chapter structure of the standardized files, the standardized files are split into multiple text blocks, and reference marks or cross indexes are set for the text blocks; Using a summary and abstract agent constructed based on a large language model to perform cross-language semantic understanding on each text block to generate abstract information; Applying a vectorization model to encode the text blocks and abstract information, storing the encoded information into a vector database, establishing the association between the text blocks and abstract information, generating a vector knowledge base as an initial threat intelligence base.

[0017] In an optional implementation, the establishing the association between the text blocks and abstract information comprises: According to the text blocks and abstract information, metadata is added to the corresponding encoded information; Establishing hierarchical association between the text blocks and abstract information through original data; The metadata includes language type, chapter, page number, belonging document, timestamp, organization, and file source.

[0018] In an optional embodiment, the initial threat intelligence database is retrieved by a preset agent to obtain attack-related tactics, techniques, and associated information, and semi-structured attack process description information is output, including: The initial threat intelligence database is retrieved by a process division agent based on a large language model to locate text blocks related to attack process information; According to the located text blocks, attack step key attributes are extracted through semantic similarity and keyword matching; The attack step key attributes are mapped to semi-structured data in JSON or YAML format through a format conversion tool as attack process description information.

[0019] In an optional embodiment, the attack step key attributes include attack action information, attack technique information, attack tactic information, and basic information.

[0020] In an optional embodiment, based on the attack process description information, extension information and context promotion information are obtained, deep information related to attack techniques is obtained through analysis and retrieval, and structured or reported threat intelligence clue expansion results are generated, including: The initial threat intelligence database and preset external intelligence sources are retrieved according to the attack tactic information by a clue expansion agent based on a large language model to obtain extension information and context promotion information related to the current attack step; The preset analysis and retrieval tools are called by the clue expansion agent, the attack tactic information, the extension information and the context promotion information are used to filter and associate information through the reasoning and discrimination ability of the large language model, and the clue information related to the attack scene is screened out; The clue information is matched with the corresponding attack technique information, and the clue information is corrected according to the matching result; The clue information is converted into structured or reported threat intelligence clue expansion results by an output agent based on a large language model according to the pre-defined format and instruction prompt; the threat intelligence clue expansion results include a clue set, a report, a conclusion, and a retrieval rule; The threat intelligence clue expansion results are sent to a preset security platform.

[0021] In an optional embodiment, the extension information and context promotion information include organizational background, malware features, associated vulnerability numbers, prerequisites, basic settings, involved assets, tools used, accounts, and processes.

[0022] In an optional embodiment, the preset analysis and retrieval tools include a network infrastructure analysis tool, a threat intelligence platform and database retrieval tool, an online sample analysis tool, a malicious code analysis tool, and an open source intelligence tool.

[0023] In a second aspect, the embodiments of the present application further provide a small language threat intelligence clue expansion system, comprising: A threat intelligence library construction module is configured to obtain small language threat intelligence, perform data cleaning, format conversion, and semantic indexing on intelligence information, and construct a vector knowledge base based on the processed intelligence information using a vectorization model as an initial threat intelligence library. An attack process extraction module is configured to obtain attack-related tactics, techniques, and associated information from the initial threat intelligence library using a preset agent, and output semi-structured attack process description information. An attack technology clue expansion module is configured to obtain expansion information and context improvement information based on the attack process description information, obtain deep information related to attack technology through analysis and retrieval, and generate structured or reported threat intelligence clue expansion results.

[0024] In a third aspect, the embodiments of the present application further provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the steps of the small language threat intelligence clue expansion method according to any one of the above.

[0025] In a fourth aspect, the embodiments of the present application further provide a storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the steps of the small language threat intelligence clue expansion method according to any one of the above.

[0026] As can be seen from the above technical solutions, the present application has the following advantages: The small language threat intelligence clue expansion method provided by the present application uses multi-agents with domain knowledge and scene memory centered on a large language model to arrange the division of labor and cooperation of these agents, realizes the analysis and understanding of cross-language threat intelligence, the extraction and semi-structured representation output of intelligence points, and completes tasks such as automatic analysis, correlation mining, knowledge graph construction, and early warning index generation of threat intelligence, thereby achieving the goals of improving threat intelligence processing efficiency, expanding threat intelligence coverage, and enhancing threat early warning capability.

[0027] The present application breaks through the barrier of small language intelligence processing through cross-language semantic understanding and vectorization encoding technology, supports the automatic analysis of non-universal language threat data, realizes the unified management of multi-source heterogeneous intelligence combined with metadata annotation, and significantly enhances the monitoring capability of regional attack organizations and specific language APT activities.

[0028] The application is based on the process division and treatment of large language model agents, which can autonomously locate attack process key fragments and extract structured information, replace manual intelligence screening and format conversion, greatly shorten the threat analysis period; through semi-structured output and report generation, an automatic link from raw data to operable intelligence is constructed, the cost of manual intervention is reduced, and the intelligence production efficiency is improved.

[0029] The application utilizes vector knowledge base semantic indexing and external intelligence source integration. This method can trace back to attack technology associated malware features, vulnerability numbers, infrastructure context information, and realize in-depth analysis from the tactical layer to the technical layer by combining metadata hierarchical association, reveal the complete attack chain behind a single clue, and improve the identification ability of hidden threats.

[0030] The application constructs an incrementally updated vector knowledge base by combining vectorization models and agents, integrates newly acquired small language intelligence in real time, and avoids knowledge base ossification; the clue expansion agent calls threat intelligence platforms and open source tools to perform multi-dimensional cross-validation on attack technology features, ensuring intelligence accuracy and realizing continuous evolution of threat knowledge.

[0031] The structured threat intelligence (such as STIX / TAXII format) and report output of the application can seamlessly interface with security platforms such as SOAR and SIEM, directly driving automated response processes; the preset retrieval rules and clue set output provide reusable analysis templates for security teams, reducing the threshold for small language threat research and judgment, and significantly improving the adaptability of the overall defense system to non-traditional threats. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the present application, the drawings needed in the description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0033] Figure 1 The flowchart of the small language threat intelligence clue expansion method provided by the present application.

[0034] Figure 2 The overall architecture diagram of the small language threat intelligence clue expansion method provided by the present application.

[0035] Figure 3 The flowchart of another small language threat intelligence clue expansion method provided by the present application.

[0036] Figure 4 The structure diagram of the small language threat intelligence clue expansion system provided by the present application.

[0037] Figure 5 A structural schematic diagram of an electronic device provided for the present application is shown. DETAILED DESCRIPTION

[0038] The specific steps of the small language threat intelligence clue expansion method will be described in detail below. Various embodiments of the present disclosure will be described more fully. The present disclosure can have various embodiments, and adjustments and changes can be made therein. However, it should be understood that there is no intention to limit various embodiments of the present disclosure to the specific embodiments disclosed herein, but the present disclosure should be understood to cover all adjustments, equivalents and / or alternatives falling within the spirit and scope of various embodiments of the present disclosure.

[0039] In order to clearly describe the technical solutions of the embodiments of the present application, the following briefly introduces some terms and technologies involved in the embodiments of the present application: 1. In the present application, small language threat intelligence can appear in many different forms in the actual environment, including but not limited to: Unstructured text documents: such as PDF reports, technical papers, research blogs, intelligence bulletins, etc.

[0040] Internet forums and chat records: underground forum posts, instant messaging tool chat records, hacker organization announcements or messages, etc.

[0041] Social media posts and comments: posts, comments or group messages on social platforms (Twitter, Telegram, Reddit, etc.).

[0042] Malicious samples and related indicators: hashes (MD5, SHA256, etc.) of virus samples, executable files, scripts, etc., as well as associated domain names, URLs, IP addresses, etc.

[0043] Vulnerability databases and technical analysis reports: official or unofficial small language vulnerability libraries, CVE / CNVD related information, technical reports of small language security research organizations or security vendors.

[0044] Threat intelligence platforms or log data: SIEM platform logs, data sets exported from small language threat intelligence databases, etc.

[0045] These information is often scattered in multi-source heterogeneous data in different languages, and needs to be processed and extracted by multi-agent cooperation with large models to accurately and efficiently obtain core intelligence such as attacker behavior and technical tactics.

[0046] 2. In the present application, various functional agents pre-constructed by large language models are involved. The "agent" involved in the present application refers to an autonomous software entity with the following characteristics: A: A cognitive and reasoning engine based on large language models (LLM) can understand small language texts and output answers in specified languages according to prompts.

[0047] B: It can flexibly call external tools (such as DNS resolution, vulnerability scanning tools, OSINT, etc.), search databases or access other services according to different task requirements, and complete in-depth analysis and processing of threat intelligence.

[0048] C: It has context memory and scenario knowledge, and can flexibly choose analysis ideas at different stages to form a serial-parallel cooperation mechanism and cooperate with other intelligent agents to complete complex tasks.

[0049] D: Through the feedback mechanism of human-in-the-loop, the analysis results are corrected and improved to ensure the accuracy and reliability of intelligence processing.

[0050] In the following, the term "include" or "may include" used in various embodiments of the present disclosure indicates the presence of the disclosed functions, operations or elements, and does not limit the addition of one or more functions, operations or elements. In addition, as used in various embodiments of the present disclosure, the terms "include", "have" and their synonyms only mean to indicate the presence of a specific feature, number, step, operation, element, component or combination of the foregoing, and should not be understood as first excluding the presence or addition of one or more other features, numbers, steps, operations, elements, components or combinations of the foregoing.

[0051] The technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0052] Please refer to Figure 1 The method flowchart of a small language threat intelligence clue expansion method in a specific embodiment is shown, and the method comprises: S1: Obtain small language threat intelligence, clean up data, convert format and build semantic index for intelligence information, and use a vectorization model to build a vector knowledge base based on the processed intelligence information as an initial threat intelligence library.

[0053] In the specific embodiment, first, unstructured and semi-structured original small language threat intelligence files are acquired, the original small language threat intelligence files are converted into a processable text format, and special characters and redundant labels therein are cleaned up to generate standardized files.

[0054] Then, the standardized files are split into multiple text blocks according to the semantics or chapter structure of the standardized files, and reference marks or cross indexes are set for the text blocks; further, a summary and abstract agent constructed based on a large language model is used to perform cross-language semantic understanding on each text block to generate abstract information.

[0055] Finally, a vectorization model is applied to encode the text blocks and the abstract information, the encoded information is stored in a vector database, the association between the text blocks and the abstract information is established, a vector knowledge base is generated as an initial threat intelligence library. When the association between the text blocks and the abstract information is established, metadata is first added to the corresponding encoded information according to the text blocks and the abstract information; then, the hierarchical association between the text blocks and the abstract information is established through the original data. The metadata includes language type, chapter, page number, belonging document, timestamp, organization, and file source.

[0056] For example, this step aims to perform data cleaning, format conversion, and semantic index construction on unstructured and semi-structured threat intelligence, and organize all information into a vector library to provide a basis for subsequent analysis. The main process is as follows: 1. Format conversion and data cleaning of unstructured and semi-structured intelligence: convert small language intelligence files in various formats (PDF, Word, HTML, etc.) into processable text format, remove noise characters, labels, and other redundant information.

[0057] 2. Document segmentation: based on the semantics or chapter structure of the processed text, long documents are split into smaller text blocks (paragraph or line-level segmentation can also be considered), so that subsequent vector retrieval is more accurate. To maintain contextual semantic association, reference marks or cross indexes can be set for continuous text blocks after segmentation to ensure that context information can be traced back during retrieval.

[0058] 3. Use of agent summary to form abstracts and highlights: a summary and abstract agent configured with large voice model capabilities is used to perform semantic understanding on each chapter or text block to automatically generate highlights or abstracts.

[0059] 4. Hierarchical association vector library establishment: a vectorization model is applied to encode the text blocks and the abstracts, store them in a vector database, and add important metadata (such as language type, chapter, page number, belonging document, timestamp, organization, and file source), and establish hierarchical association between the abstracts and the text blocks through the metadata.

[0060] S2: Obtain attack-related tactics, techniques, and associated information from the initial threat intelligence library using a preset agent, and output semi-structured attack process description information.

[0061] In the specific embodiment, first, the initial threat intelligence library is searched using a process division agent constructed based on a large language model, and text blocks related to attack process information are located.

[0062] Then, according to the located text blocks, attack step key attributes are extracted through semantic similarity and keyword matching. The attack step key attributes include attack action information, attack technique information, attack tactic information, and basic information.

[0063] Finally, the attack step key attributes are mapped to semi-structured data in JSON or YAML format through a format conversion tool as attack process description information.

[0064] For example, the main purpose of this step is to obtain attack-related tactics, techniques, and associated information from the initial threat intelligence library and output semi-structured attack process description. This step includes the following sub-steps: Attack process extraction task division: Use a "process division agent" based on a large language model to search the vector knowledge base in multiple rounds, locate text blocks or summaries related to attack processes through keywords, semantic similarity, etc., and determine whether the search results cover the complete attack process through the "process division agent". If there are missing steps, further search can be performed.

[0065] Retrieve the description of each attack step according to the existing attack process: Find text blocks with attack step basic information from the vector knowledge base through hybrid search, including but not limited to actions, techniques, tactics, and descriptions.

[0066] Semi-structured output attack process: The agent extracts the basic information fields involved in the attack tactics into a semi-structured data structure for further clue expansion.

[0067] S3: Based on the attack process description information, obtain extended information and context improvement information, obtain deep information related to attack techniques through analysis and search, and generate structured or reported threat intelligence clue expansion results.

[0068] In the specific embodiment, after confirming the attack process and related tactics, further deep information closely related to attack techniques or tools is obtained through this step, and the specific process is as follows: 1. The clue expansion agent based on a large language model retrieves an initial threat intelligence database and a preset external intelligence source according to attack tactic information, and obtains expansion information and context enhancement information related to the current attack step.

[0069] For example, according to the attack tactic basic information, expansion information is obtained to provide a scene and context for attack technology clue expansion. Specifically, the "clue expansion agent" retrieves a vector knowledge base or calls other external intelligence sources according to the existing description and metadata of the attack tactic, to find more details related to the current attack step, i.e. expansion information and context enhancement information related to the current attack step. Such information includes but is not limited to organizational background, malware features, associated vulnerability numbers, prerequisites, base settings, involved assets, tools used, accounts, and processes.

[0070] 2. The clue expansion agent calls a preset analysis and retrieval tool, and uses the reasoning and discrimination ability of a large language model to filter and correlate information according to attack tactic information, expansion information and context enhancement information, to screen out clue information related to the attack scene.

[0071] For example, multiple tools are used to automatically expand attack techniques, and the specific implementation means and methods include: the "clue expansion agent" automatically calls multiple tools integrated in advance according to the basic information of the attack tactic, expansion information and context prompts. After the agent calls the tools, the reasoning and discrimination ability of the large model is used to filter and correlate the results, to screen out clues consistent with the target scene and attack techniques, and to give an analysis description. The called tools include network base setting analysis tools, threat intelligence platform and database retrieval tools, online sample analysis tools, malicious code analysis tools, open source intelligence (OSINT) tools, and automated scripts.

[0072] 3. The clue information is matched with the corresponding attack technique information, and the clue information is corrected according to the matching result.

[0073] For example, this process can use a security personnel verification agent to expand the clues and provide feedback. This includes: a security analyst manually reviews the candidate clues given by the agent, and if the clues do not match the attack techniques (such as domain names, digital artifacts are not related to the actual attack steps), the agent is provided with feedback. After receiving the feedback, the agent corrects the retrieval and reasoning process, re-calls the tools or accesses the intelligence database, and gradually improves the matching degree of the clues and the attack techniques. If the clues are confirmed to match, they are included in the subsequent analysis link and the final intelligence output result.

[0074] 4. Through the output agent constructed based on the large language model, the clue information is converted into structured or reported threat intelligence clue expansion results according to the pre-defined format and instruction prompt; the threat intelligence clue expansion results are sent to a preset security platform. The threat intelligence clue expansion results include a clue set, a report, a conclusion, and a retrieval rule.

[0075] For example, the "output responsible agent" constructed based on the large language model automatically generates the achievement output such as the clue set, the report, the conclusion, and the retrieval rule according to the pre-defined format and instruction prompt. The output information can be directly connected to the SIEM, SOC, and other security platforms, and is used for security detection, early warning index generation, strategy formulation, and personnel training, and various scenes.

[0076] Referring to Figure 2 It can be known that the method in the embodiment includes three main stages of initial threat intelligence library construction, attack process extraction, and attack technology clue expansion. Their main functions are as follows: (1) The function of initial threat intelligence library construction: The threat intelligence scattered in multiple data sources, different file formats, and different languages (including small languages) is summarized, cleaned, and standardized converted, and redundant data and noise information is removed.

[0077] The text content is blocked and abstracted, so that the relevant text blocks and corresponding points or summaries can be quickly focused on during subsequent retrieval and analysis.

[0078] Through the establishment of vector index and metadata label, the information is managed in a "one-to-many" or "many-to-one" hierarchical structure, improving the access and retrieval efficiency of the intelligent agent on different granularities and different semantic contexts.

[0079] Through the construction of this stage, a high-quality threat intelligence foundation library can be formed, providing reliable bottom-layer data support for subsequent attack process extraction and attack technology clue expansion.

[0080] (2) The function of attack process extraction: On the basis of the initial intelligence library, the attack tactics, techniques, and process information (such as TTPs, phased attack steps, etc.) contained in the documents or texts are refined through mixed retrieval, intelligent agent cooperation, and context analysis.

[0081] The extraction results are converted into semi-structured or structured forms that can be further processed and utilized, facilitating security analysts to quickly understand the key nodes, motives, technical routes of attacks, and points related to defense strategies.

[0082] The attack process is kept in context association, and subsequent technical clue expansion can combine the whole attack chain to dig more information, instead of relying on isolated text fragments.

[0083] Through the processing of this stage, the attack steps and technical means implied by the small language intelligence can be clearly determined, and the multi-lingual threat intelligence can be effectively analyzed and organized.

[0084] (3) Role of attack technical clue expansion: Based on the extracted attack process and tactical information, further details of technical implementation and specific attack indicators behind each attack step are mined.

[0085] By calling various external security analysis tools (such as network infrastructure analysis, vulnerability library retrieval, sample analysis tools, etc.) and accessible intelligence platforms, domain names, IPs, URLs, hashes, malicious codes, etc. Clues related to these attack steps are automatically discovered.

[0086] In a human-computer cooperative manner (security experts provide feedback and correction), the automatically expanded clues are verified and screened, and finally structured or reported results are output, including monitoring rules, feature fingerprints, IOC indicators, policy suggestions, etc. for detection or defense.

[0087] This stage provides the possibility for deep correlation and value refinement of intelligence, helping security teams quickly lock and master more targeted attack technologies and their evolution trends.

[0088] As can be seen, the small language threat intelligence clue expansion method provided in the embodiment breaks through the processing bottleneck of small language threat intelligence by cross-language semantic understanding and vectorization coding technology, realizes the rapid extraction and structured output of attack processes by combining the automatic process driven by intelligent agents, improves the threat tracing accuracy by using deep context association analysis and multi-source intelligence cross-validation, and finally outputs the standard intelligence to drive the security platform to respond in coordination, which fully enhances the monitoring and defense efficiency of regional and non-traditional threats.

[0089] Further, as a refinement and expansion of the specific implementation manner of the above-mentioned embodiment, in order to completely describe the specific implementation process in the embodiment, another small language threat intelligence clue expansion method is provided.

[0090] As shown in Figure 3 , the method comprises: S11 Format Conversion: This step converts raw small language intelligence files in various formats (PDF, HTML, Word) into a processable text format, and removes special characters, redundant tags, and other noise. Through uniform processing of the files, a clean and standardized foundation environment is established for subsequent text segmentation and analysis.

[0091] S12 Document Segmentation: This step divides the converted document into smaller text blocks based on semantic content or chapter structure, making subsequent model retrieval more accurate. After segmentation, reference identifiers or cross-references can be set for text blocks to ensure complete traceability of semantic context.

[0092] S13 Text Block Embedding: This step performs word segmentation or vectorization encoding on the text blocks, generating vector representations for retrieval. Similar vectors can reflect semantic correlation, providing basic knowledge support for subsequent attack process extraction and intelligence correlation queries.

[0093] S14 Chapter Summary and Key Points Extraction: Through the "summary and abstract agent", cross-language understanding of text blocks or chapter content is performed to automatically generate key points and summary information. This step can reduce the burden of manual reading and provide more refined text summary indexes for subsequent retrieval.

[0094] S15 Vector Knowledge Base Construction: This step stores the vector representations of text blocks and their summaries, as well as metadata (language type, chapter, page number, etc.) into a vector database. Through hierarchical association or aggregated indexing, relevant text content and its context can be quickly located, facilitating subsequent mixed retrieval and attack process extraction.

[0095] S21 Attack Process Extraction Task Division: This step uses the "process division agent" to perform preliminary analysis and retrieval on the vector library, locating text blocks related to attack process information. If the retrieval results are incomplete, further task decomposition and multiple rounds of retrieval are carried out to ensure coverage of small language intelligence.

[0096] S22 Attack Step Basic Information Retrieval: Based on the located text blocks, the key attributes of each attack step (such as actions, techniques, and tactics) are accurately extracted. Through semantic similarity and keyword matching, the recognition of each step is deepened, preparing for the semi-structured output of the subsequent process.

[0097] S23 Semi-structured Output Attack Process: This step maps attack tactics, techniques, and basic information into semi-structured data such as JSON and YAML for subsequent storage and application. The correspondence between the attack process and the original document is preserved to facilitate traceability and further verification by security analysts.

[0098] S31 Attack tactic base information expansion: According to the extracted attack tactic label, continue to search the vector library or external intelligence sources to dig deeper information (such as hacker organization background, vulnerability information). In this process, the agent can perform cross-language semantic matching on multilingual documents to ensure the integrity of the intelligence.

[0099] S32 Attack technology clue expansion: For each attack step, this step further digs into the technical implementation and potential attack indicators (such as suspicious domain names, hash values, etc.). Combined with context hints and known attack features, it can better filter out highly relevant clue information for the target scene.

[0100] S33 Pre-set tool invocation: The agent automatically invokes pre-integrated security tools (vulnerability scanning, network infrastructure analysis, OSINT, etc.) to query or analyze suspicious domain names and samples. Through the discrimination ability of the large model, irrelevant results are filtered out, and key clues are focused on.

[0101] S34 Security personnel verification feedback: This step is reviewed by security analysts for the clues set output by the agent. If there are errors or low correlation clues, feedback is provided to the agent. This human-machine collaboration mechanism can continuously optimize the agent's understanding of rare words or specific expressions in small language texts.

[0102] S35 Expanded clue improvement feedback: After obtaining feedback from security personnel, the agent will further modify the retrieval parameters or methods and call related tools or databases again to find clues. Through multiple iterations, the matching degree of clues and actual attack technology can be gradually improved, and the analysis blind area can be reduced.

[0103] S36 Output form setting and result generation: After completing the clue screening and confirmation, the agent automatically generates structured reports, IOC indicator sets, monitoring rules, etc. according to the pre-defined format and instructions. These achievements can be integrated with SIEM, SOC, etc. Platform provides direct support for security monitoring, early warning and strategy formulation.

[0104] As Figure 4 shown, the following is an embodiment of a small language threat intelligence clue expansion system provided by the embodiments of the present disclosure. The system and the small language threat intelligence clue expansion method of each embodiment described above belong to the same inventive concept. Details not described in the embodiment of the small language threat intelligence clue expansion system can be referred to the embodiment of the small language threat intelligence clue expansion method described above.

[0105] A small language threat intelligence clue expansion system includes a threat intelligence library construction module, an attack process extraction module, and an attack technology clue expansion module.

[0106] The threat intelligence library construction module is configured to obtain small-language threat intelligence, perform data cleaning, format conversion and semantic indexing on the intelligence information, and construct a vector knowledge base based on the processed intelligence information using a vectorization model as an initial threat intelligence library.

[0107] The attack flow extraction module is configured to obtain attack-related tactics, techniques and associated information from the initial threat intelligence library using a preset agent, and output semi-structured attack flow description information.

[0108] The attack technology clue expansion module is configured to obtain expansion information and context improvement information based on the attack flow description information, obtain deep information related to attack technology by analysis and retrieval, and generate structured or reported threat intelligence clue expansion results.

[0109] The small-language threat intelligence clue expansion system provided by the embodiment breaks through the bottleneck of small-language threat intelligence analysis through multilingual semantic processing and vector knowledge base technology, combines automatic extraction of agents, deep context association and multi-source cross verification, realizes end-to-end efficient production from raw data to structured intelligence, significantly improves regional attack monitoring capability, attack chain tracing accuracy and threat knowledge iteration speed, and finally enhances security operation collaboration through standardized output, and provides intelligent support for defense against non-traditional threats.

[0110] Figure 5 A hardware structure schematic diagram of an electronic device for implementing various embodiments of the present application.

[0111] The small-language threat intelligence clue expansion method provided by the embodiment of the application can be applied to an electronic device. Those skilled in the art can understand that the electronic device structure involved in the embodiment of the application does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than the illustration, or combine certain components, or different component arrangements. In the embodiment of the application, the electronic device includes but is not limited to a laptop computer, a desktop computer, a workstation, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the application described and / or claimed herein.

[0112] The electronic device can include a processor, an external memory interface, an internal memory, a universal serial bus (USB) interface, a charging management module, a power management module, a battery, a wireless communication module, an audio module, a speaker, a microphone, a sensor module, a key, a camera, a display screen, and a SIM card interface, and the like.

[0113] The processor can include one or more processing units, such as: the processor can include a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), and the like. Among them, different processing units can be independent devices, or can be integrated in one or more processors.

[0114] Among them, the processor can be the nerve center and command center of the electronic device. The controller can generate operation control signals according to instruction operation codes and timing signals, and complete the control of fetching and executing instructions.

[0115] The memory can also be provided in the processor, used to store instructions and data. In some embodiments, the memory in the processor is a cache memory. The memory can save instructions or data that the processor has just used or repeatedly uses. If the processor needs to use the instructions or data again, it can directly call from the memory. Avoiding repeated access, reducing the waiting time of the processor, thus improving the efficiency of the system.

[0116] The external memory interface can be used to connect an external memory card, such as a MicroSD card, to realize the expansion of the storage capacity of the electronic device. The external memory card communicates with the processor through the external memory interface to realize the data storage function. For example, save music, video and other files in the external memory card.

[0117] The internal memory can be used to store computer executable program codes including instructions. The processor performs various function applications and data processing of the electronic device by running the instructions stored in the internal memory. The internal memory can include a program storage area and a data storage area. The internal memory can include a high-speed random access memory, and can further include a non-volatile memory such as at least one of a magnetic disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0118] The wireless communication function of the electronic device can be implemented through an antenna, a wireless communication module, a modem processor, and a baseband processor, etc.

[0119] The wireless communication module can provide a wireless communication solution including wireless local area networks (WLAN) (e.g., wireless fidelity (Wi-Fi) network), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared technology (IR), etc. applied to the electronic device.

[0120] The electronic device can implement an audio function, etc. through an audio module, a speaker, a receiver, a microphone, a headphone interface, and an application processor, etc.

[0121] The electronic device can implement a photographing function through an ISP, a camera, a video codec, a GPU, a display screen, and an application processor, etc.

[0122] The electronic device can implement a display function through a GPU, a display screen, and an application processor, etc.

[0123] The GPU is a microprocessor for image processing, which is connected to the display screen and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor can include one or more GPUs, which execute program instructions to generate or change display information.

[0124] The display screen is used to display images, videos, etc. The display screen includes a display panel.

[0125] The electronic device realizes the small language threat intelligence clue expansion method provided in the application by cross-language semantic understanding and vector knowledge base construction, automatic extraction of attack tactics, techniques and processes by an intelligent agent, and multi-dimensional expansion information analysis, so that the language barrier of small language threat intelligence is solved, the depth and scene adaptability of intelligence are improved, and the correlation and operability of threat clues are enhanced. Through the integration of structured output and automated tools, the systematic support of active defense strategies in a multilingual environment is further realized, effectively making up for the limitations of traditional threat intelligence in small language scenarios.

[0126] In the storage medium provided in the application, a program product capable of implementing the small language threat intelligence clue expansion method is stored.

[0127] The small language threat intelligence clue expansion method comprises: acquiring small language threat intelligence, performing data cleaning, format conversion and semantic index building on intelligence information, and constructing a vector knowledge base based on the processed intelligence information using a vectorization model as an initial threat intelligence base; acquiring attack-related tactics, techniques and associated information from the initial threat intelligence base using a preset intelligent agent, and outputting semi-structured attack process description information; based on the attack process description information, acquiring expansion information and context enhancement information, acquiring depth information related to attack techniques through analysis and retrieval, and generating structured or reported threat intelligence clue expansion results.

[0128] In some possible implementations, the small language threat intelligence clue expansion method of the present disclosure can be implemented in the form of a program product, which includes program code for causing a terminal device to perform the steps of various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the specification when the program product is run on the terminal device.

[0129] The storage medium of the present disclosure can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium may, for example, be but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0130] The foregoing description of the disclosed embodiments enables a person skilled in the art to make or use the application. Modifications of these embodiments will occur to persons of skill in the art, and that the appended claims are intended to cover all such modifications that do not depart from the true spirit and scope of the application. Therefore, the application is not limited to the embodiments shown but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A small language threat intelligence lead expansion method, characterized in that, The method comprises the following steps: obtaining small language threat intelligence, performing data cleaning, format conversion and semantic index construction on the intelligence information, and constructing a vector knowledge base based on the processed intelligence information using a vectorization model as an initial threat intelligence base; using a preset agent to obtain attack-related tactics, techniques and associated information from the initial threat intelligence base, and outputting semi-structured attack process description information; based on the attack process description information, obtaining extension information and context promotion information, obtaining deep information related to attack techniques through analysis and retrieval, and generating structured or reported threat intelligence clue expansion results.

2. The method of claim 1, wherein, The method comprises the following steps: obtaining unstructured and semi-structured original small language threat intelligence files, converting the original small language threat intelligence files into a processable text format, and removing special characters and redundant labels to generate standardized files; According to the semantic or chapter structure of the standardized file, the standardized file is divided into multiple text blocks, and the text blocks are set with reference marks or cross indexes; using a summary and abstract agent constructed based on a large language model to perform cross-language semantic understanding on each text block to generate abstract information; applying a vectorization model to encode the text blocks and abstract information, storing the encoded information in a vector database, establishing the association between the text blocks and the abstract information, and generating a vector knowledge base as an initial threat intelligence base.

3. The method of claim 2, wherein, The method comprises the following steps: According to the text blocks and abstract information, metadata is added to the corresponding encoded information; establishing a hierarchical association between the text blocks and the abstract information through the original data; The metadata includes language type, chapter, page number, belonging document, timestamp, organization, and file source.

4. The method of claim 3, wherein, The method comprises the following steps: using a process division and resolution agent constructed based on a large language model to search the initial threat intelligence base, and locating text blocks related to attack process information; According to the located text blocks, attack step key attributes are extracted through semantic similarity and keyword matching; mapping the attack step key attributes into semi-structured data in JSON or YAML format through a format conversion tool as attack process description information.

5. The method of claim 4, wherein, The attack step key attributes include attack action information, attack technique information, attack tactic information and basic information.

6. The method of claim 5, wherein, The method comprises the following steps: using a clue expansion agent constructed based on a large language model to search the initial threat intelligence base and a preset external intelligence source according to the attack tactic information, and obtaining extension information and context promotion information related to the current attack step; The agent calls preset analysis and retrieval tools through clue expansion, and filters and correlates information according to attack tactic information, the expansion information and context promotion information, and the reasoning and discrimination ability of a large language model, to screen out clue information related to an attack scenario; The clue information is matched with corresponding attack technology information, and the clue information is corrected according to a matching result; An output agent constructed based on a large language model is used to convert the clue information into structured or reported threat intelligence clue expansion results according to a predefined format and instruction prompt; the threat intelligence clue expansion results include a clue set, a report, a conclusion and a retrieval rule; The threat intelligence clue expansion results are sent to a preset security platform.

7. The small language threat intelligence clue expansion method according to claim 6, characterized in that: The expansion information and context promotion information include organizational background, malware features, associated vulnerability numbers, prerequisites, basic settings, involved assets, tools used, accounts and processes; The preset analysis and retrieval tools include network basic setting analysis tools, threat intelligence platform and database retrieval tools, online sample analysis tools, malicious code analysis tools and open source intelligence tools.

8. A small language threat intelligence lead expansion system, comprising: The system adopts the small language threat intelligence clue expansion method according to any one of claims 1 to 7; The system includes: A threat intelligence library construction module is configured to obtain small language threat intelligence, clean data, convert formats and build semantic indexes for intelligence information, and construct a vector knowledge base based on the processed intelligence information using a vectorization model, as an initial threat intelligence library; An attack flow extraction module is configured to obtain attack-related tactics, techniques and associated information from the initial threat intelligence library using a preset agent, and output semi-structured attack flow description information; An attack technology clue expansion module is configured to obtain expansion information and context promotion information based on the attack flow description information, obtain deep information related to attack technology through analysis and retrieval, and generate structured or reported threat intelligence clue expansion results.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the steps of the small language threat intelligence clue expansion method according to any one of claims 1 to 7 when executing the program.

10. A storage medium having stored thereon a computer program, characterized in that The computer program implements the steps of the small language threat intelligence clue expansion method according to any one of claims 1 to 7 when executed by the processor.

Images