Methods, systems, equipment and media for multi-source threat intelligence analysis of power information networks

Abstract

This invention relates to the field of threat intelligence analysis technology for power information networks, and provides a method, system, device, and medium for multi-source threat intelligence analysis of power information networks. The method includes acquiring multi-source threat intelligence data to be analyzed from the power information network; extracting and analyzing attack entity relationships from the text intelligence data based on a preset attack entity data model and a preset entity association pattern table to generate an attack reconstruction master graph; extracting and analyzing attack entity relationships from the vulnerability code based on a preset code model and an attack entity retrieval database to generate several attack reconstruction sub-graphs; and merging the attack reconstruction master graph and the various attack reconstruction sub-graphs to generate a target attack reconstruction graph. This invention improves the accuracy and comprehensiveness of attack entity identification by combining an attack entity relationship extraction mechanism based on a unified attack entity data model with a multi-source attack graph reconstruction mechanism, ensuring the reliability of threat detection and attack tracing, and enhancing the security defense capabilities of power information networks.

Description

Technical Field

[0001] This invention relates to the field of threat intelligence analysis technology for power information networks, and in particular to a method, system, device, and medium for multi-source threat intelligence analysis of power information networks. Background Technology

[0002] The rapid development of smart power information networks has greatly improved the stability and reliability of power supply systems. At the same time, attacks against power information networks are also occurring frequently, with Advanced Persistent Threats (APTs) causing significant losses and attracting widespread attention. Therefore, developing defenses against APT attacks is urgently needed.

[0003] Existing APT attack detection and defense methods primarily extract attack tactics, techniques, and processes by analyzing the attack frameworks defined in the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) attack matrix against the attack steps in threat intelligence, aiming to improve enterprises' security emergency response capabilities. However, existing technologies generally suffer from problems such as single data sources, low accuracy in extracting Indicators of Compromise (IOCs), and reliance on manual review, making it impossible to reliably capture genuine threat events in a timely manner, leading to failures in attack tracing, detection, and defense tasks. Furthermore, existing APT attack detection and defense methods mainly focus on application research at the host protection level. The complex architecture and extensive connections of power information networks mean that the threats they encounter differ significantly from host attacks in terms of attack behavior patterns and attack chains, making them unsuitable for power information network attack protection scenarios. Therefore, there is an urgent need to provide a threat intelligence extraction method specifically for power information network attack scenarios to improve the security defense capabilities of power information networks and ensure the stable and reliable operation of power systems. Summary of the Invention

[0004] The purpose of this invention is to provide a multi-source threat intelligence analysis method for power information networks. By employing natural language processing and deep learning technologies, and based on a pre-constructed attack entity data model, it extracts attack entity relationships from multi-source heterogeneous data, including text intelligence data and vulnerability code. Then, based on the attack entity relationships from different data sources, it performs attack graph reconstruction and fusion analysis. This multi-source attack graph reconstruction mechanism not only effectively improves the accuracy and comprehensiveness of attack entity identification, but also ensures the reliability of threat detection and attack tracing analysis, thereby enhancing the security defense capabilities of power information networks.

[0005] To achieve the above objectives, a method, system, device, and medium for multi-source threat intelligence analysis of power information networks are provided.

[0006] In a first aspect, embodiments of the present invention provide a method for multi-source threat intelligence analysis of power information networks, the method comprising:

[0007] Based on preset search keywords, multi-source threat intelligence data to be analyzed from the power information network is obtained; the multi-source threat intelligence data to be analyzed includes text intelligence data and attack vulnerability code; the text intelligence data includes network threat intelligence, system security logs, and security webpage information;

[0008] The attack entity relationship is extracted and analyzed from the text intelligence data according to the preset attack entity data model and the preset entity association pattern table to generate an attack reconstruction master map. The preset attack entity data model includes a variety of attack entity types and natural language descriptions and attributes corresponding to each attack entity type. The attack entity types include processes, files, sockets, general vulnerability disclosure information, and attack organizations.

[0009] The attack entity relationship is extracted and analyzed based on the pre-set code model and the attack entity retrieval database to generate several attack reconstruction sub-graphs; the attack entity retrieval database is constructed based on the vectorized text data corresponding to the text intelligence data;

[0010] The main attack reconstruction graph and each of the attack reconstruction subgraphs are merged to generate the target attack reconstruction graph.

[0011] Furthermore, the step of extracting and analyzing attack entity relationships from the text intelligence data based on a preset attack entity data model and a preset entity association pattern table to generate an attack reconstruction master map includes:

[0012] The non-log data text in the text intelligence data is split into short sentences, and the log data text in the text intelligence data is split into records. The resulting text sentences and log records are converted into corresponding triple data to generate a text triple dataset. The triple data consists of a subject, a predicate, and an object.

[0013] Based on the preset attack entity data model and the pre-built attack entity extraction model, attack entity extraction analysis is performed on the text triplet dataset to obtain several attack entity triplets.

[0014] The attack entity triples are matched and analyzed with the preset entity association pattern table to obtain several text attack association patterns.

[0015] Based on all the aforementioned text attack association patterns, the attack reconstruction master graph is generated.

[0016] Furthermore, the steps for constructing the preset entity association schema table include:

[0017] Obtain the text intelligence dataset of the power information network, and preprocess the text intelligence dataset to obtain the corresponding intelligence triple dataset;

[0018] Based on the preset attack entity data model and the pre-built attack entity extraction model, attack entity extraction analysis is performed on the intelligence triple dataset to obtain the attack entity set;

[0019] Based on the text intelligence dataset and the first language model, the attack entities in the attack entity set are deduplicated using the role-playing method to obtain the standard attack entity set.

[0020] Based on the text intelligence dataset, word frequency co-occurrence analysis is performed on each attack entity in the standard attack entity set to obtain a multidimensional co-occurrence word frequency matrix. Then, based on the multidimensional co-occurrence word frequency matrix and the Apriori algorithm, association analysis is performed on the attack entities in the standard attack entity set to obtain several associated attack entity pairs.

[0021] Based on the first large language model and the text intelligence dataset, text position restoration analysis is performed on each of the associated attack entity pairs based on prompt word engineering to generate the association patterns of each of the associated attack entity pairs.

[0022] The associated attack entity pairs and their corresponding association patterns are summarized to generate the preset entity association pattern table.

[0023] Furthermore, the construction steps of the attack entity extraction model include:

[0024] Obtain the text intelligence dataset of the power information network, and perform named entity recognition and extraction on the text intelligence dataset based on a preset regular expression to obtain a named entity set;

[0025] Based on the named entity set, the text intelligence dataset is annotated with named entities to obtain the text intelligence training set;

[0026] The preset named entity recognition model is trained based on the text intelligence training set to obtain the initial attack entity extraction model;

[0027] Obtain power grid attack cases from the ATT&CK matrix, and train the initial attack entity extraction model based on the power grid attack cases and power grid advanced persistent threat reports to obtain the attack entity extraction model.

[0028] Furthermore, the step of extracting and analyzing attack entity relationships in the vulnerability code based on a preset large code model and an attack entity retrieval database to generate several attack reconstruction subgraphs includes:

[0029] Based on the preset code model, the attack vulnerability code is parsed using the prompt word engineering to generate the corresponding abstract syntax tree and obtain the node set of the abstract syntax tree;

[0030] Based on the second language model, the correlation between each node in the node set and the attack information retrieved from the database by the attack entity is analyzed. Based on the obtained correlation analysis results, the node set is filtered to obtain a candidate node list.

[0031] Based on the preset entity association pattern table, the nodes in the candidate node list are subjected to association pattern matching analysis to obtain several code attack association patterns.

[0032] Based on the various code attack association patterns, generate corresponding attack reconstruction subgraphs.

[0033] Furthermore, the step of merging the main attack reconstruction graph and each of the attack reconstruction sub-graphs to generate the target attack reconstruction graph includes:

[0034] Based on the breadth-first search algorithm, the node access order list corresponding to the main attack reconstruction graph and each of the attack reconstruction subgraphs is obtained respectively;

[0035] Based on the attack reconstruction main graph and the node access order list corresponding to each of the attack reconstruction subgraphs, traverse and obtain the matching main graph node in the attack reconstruction main graph corresponding to each subgraph node in each of the attack reconstruction subgraphs;

[0036] Establish a graph connection relationship between each subgraph node in each of the attack reconstruction subgraphs and the corresponding matching main graph node in the attack reconstruction main graph to generate an initial attack reconstruction graph.

[0037] The initial attack reconstruction graph is deduplicated to obtain the target attack reconstruction graph.

[0038] Further, the step of traversing and obtaining the matching main graph node in the attack reconstruction main graph corresponding to each subgraph node in each attack reconstruction subgraph based on the node access order list corresponding to the attack reconstruction main graph includes:

[0039] Based on the node access order list corresponding to the main graph of the attack reconstruction and each of the subgraphs of the attack reconstruction, the node alignment score between each subgraph node in each subgraph of the attack reconstruction and each main graph node in the main graph of the attack reconstruction is calculated by traversing the graph based on the preset node alignment score expression; the preset node alignment score is calculated based on the consistency of entity type and the similarity of entity name between nodes.

[0040] Obtain the maximum node alignment score among all node alignment scores of each subgraph node in each of the attack reconstruction subgraphs, and use the main graph node corresponding to the maximum node alignment score as the corresponding matching main graph node.

[0041] Secondly, embodiments of the present invention provide a multi-source threat intelligence analysis system for power information networks, the system comprising:

[0042] The data acquisition module is used to acquire multi-source threat intelligence data to be analyzed from the power information network based on preset search keywords; the multi-source threat intelligence data to be analyzed includes text intelligence data and attack vulnerability code; the text intelligence data includes network threat intelligence, system security logs and security web page information;

[0043] The main image reconstruction module is used to extract and analyze the attack entity relationships of the text intelligence data according to the preset attack entity data model and the preset entity association pattern table, and generate an attack reconstruction main image; the preset attack entity data model includes a variety of attack entity types and natural language descriptions and attributes corresponding to each attack entity type; the attack entity types include processes, files, sockets, general vulnerability disclosure information and attack organizations.

[0044] The subgraph reconstruction module is used to extract and analyze the attack entity relationships of the attack vulnerability code based on a preset code large model and an attack entity retrieval database, and generate several attack reconstruction subgraphs; the attack entity retrieval database is constructed based on the vectorized text data corresponding to the text intelligence data;

[0045] The fusion processing module is used to merge the main attack reconstruction map and each of the attack reconstruction sub-maps to generate a target attack reconstruction map.

[0046] Thirdly, embodiments of the present invention also provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method.

[0047] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method.

[0048] The present invention provides a method, system, device, and medium for multi-source threat intelligence analysis of power information networks. The method achieves the following: First, based on preset search keywords, it acquires multi-source threat intelligence data from the power information network, including text intelligence data and vulnerability code, to be analyzed. Then, based on a preset attack entity data model and a preset entity association pattern table, it extracts and analyzes attack entity relationships from the text intelligence data to generate an attack reconstruction master graph. Next, based on a preset code master model and an attack entity retrieval database constructed from vectorized text data corresponding to the text intelligence data, it extracts and analyzes attack entity relationships from the vulnerability code to generate several attack reconstruction sub-graphs. Finally, it merges the attack reconstruction master graph and the various attack reconstruction sub-graphs to generate a target attack reconstruction graph. Compared with existing technologies, this multi-source threat intelligence analysis method for power information networks employs natural language processing and deep learning technologies. Based on a pre-built attack entity data model, it extracts attack entity relationships from multi-source heterogeneous data, including text intelligence data and vulnerability code, and then performs attack graph reconstruction and fusion analysis based on attack entity relationships from different data sources. This multi-source attack graph reconstruction mechanism not only effectively improves the accuracy and comprehensiveness of attack entity identification but also ensures the reliability of threat detection and attack tracing analysis, thereby enhancing the security defense capabilities of power information networks. Attached Figure Description

[0049] Figure 1 This is a flowchart illustrating the multi-source threat intelligence analysis method for power information networks in an embodiment of the present invention.

[0050] Figure 2 This is a schematic diagram of the target attack reconstruction map in an embodiment of the present invention;

[0051] Figure 3 This is a schematic diagram of the structure of the power information network multi-source threat intelligence analysis system in an embodiment of the present invention;

[0052] Figure 4 This is an internal structural diagram of the computer device in an embodiment of the present invention;

[0053] The attached figures are labeled as follows:

[0054] 1. Data acquisition module; 2. Main image reconstruction module; 3. Sub-image reconstruction module; 4. Fusion processing module. Detailed Implementation

[0055] To make the objectives, technical solutions, and beneficial effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. Obviously, the embodiments described below are only part of the embodiments of this invention and are used to illustrate the invention, but are not intended to limit the scope of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0056] In one embodiment, such as Figure 1 As shown, a multi-source threat intelligence analysis method for power information networks is provided, including:

[0057] S11. Based on preset search keywords, obtain multi-source threat intelligence data to be analyzed from the power information network; the multi-source threat intelligence data to be analyzed includes text intelligence data and attack vulnerability code; the text intelligence data includes network threat intelligence, system security logs, and security web page information, and network threat intelligence can be understood as open-source CTI (CyberThreat Intelligence) reports, system security logs can be understood as system security information records collected by the system firewall and kernel of the power information network, security web page information can be understood as web page information such as security blogs and news social media related to the power information network, and attack vulnerability code can be understood as attack vulnerability exploitation code transmitted from open-source code platforms.

[0058] The preset search keywords in this embodiment can be understood as keywords set based on the application scenario of the power information network, used to specifically extract threat intelligence data in this application scenario, such as smart grid, power supply, power system, and power equipment. The method for obtaining the multi-source threat intelligence data to be analyzed can be based on web crawling technology combined with relevant monitoring systems of the power information network. Furthermore, to ensure that various types of intelligence data meet the needs of subsequent data analysis, different types of data are processed using relevant existing preprocessing techniques to obtain multi-source intelligence data that can be directly used for subsequent threat intelligence analysis. The specific acquisition and preprocessing processes can be implemented with reference to relevant existing technologies and will not be detailed here. This embodiment ensures a more comprehensive assessment of attack organizations and attack methods in power information network threat intelligence analysis by summarizing multi-source data information, overcoming the application defects of existing solutions where a single data source cannot guarantee the comprehensiveness of attack detection and the reliability of threat defense.

[0059] S12. Based on the preset attack entity data model and the preset entity association pattern table, perform attack entity relationship extraction and analysis on the text intelligence data to generate an attack reconstruction master map. The preset attack entity data model can be understood as a definition of entity data types suitable for threat intelligence analysis of power information networks, determined by organizing and analyzing relevant historical CTI reports of power information networks, taking into account that the actual collected text intelligence data may include various document formats such as PDF files, HTML text, and TXT files. Specifically, as shown in Table 1, the preset attack entity data model includes various attack entity types and corresponding natural language descriptions and attributes for each attack entity type. The attack entity types include, but are not limited to, processes, files, sockets, common vulnerability disclosure information, and attack organizations. Common vulnerability disclosure information can be understood as CVE (Common Vulnerabilities and Exposures) vulnerability information.

[0060] Table 1 Information on the Preset Attack Entity Data Model

[0061]

[0062] The preset entity association pattern table in this embodiment can be understood as a table defining the association relationships between different attack named entities. It is used in conjunction with the preset attack entity data model to analyze and extract all attack entity relationship patterns from the text intelligence data, serving as the basis for constructing the attack reconstruction master graph. The corresponding attack reconstruction master graph can be understood as an attack knowledge graph constructed using knowledge graph technology, based on the attack entity relationships obtained from attack named entity identification and entity relationship analysis of the text intelligence data.

[0063] Specifically, the step of extracting and analyzing attack entity relationships from the text intelligence data based on a preset attack entity data model and a preset entity association pattern table, and generating an attack reconstruction master map, includes:

[0064] The non-log data text in the text intelligence data is split into short sentences, and the log data text in the text intelligence data is split into records. The resulting short sentences and log records are converted into corresponding triplet data, generating a text triplet dataset. Each triplet consists of a subject, predicate, and object. Short sentence splitting can be understood as decomposing long and complex sentences in the intelligence data text into shorter sentences in a standardized form, based on the structure of sentences in the intelligence data text, ensuring that each short sentence includes only one action or state and that each short sentence has a clearly defined subject, predicate (verb), and object. The specific short sentence splitting process can refer to existing technologies, such as natural language processing methods based on syntactic parsing (spaCy / CoreNLP) and rule post-processing, or sentence segmentation models based on deep learning (T5 / BART models). The method of splitting log data text into records can also be implemented using existing technologies, such as delimiter-based splitting, regular expression-based splitting, and log template extraction based on machine learning, which will not be detailed here.

[0065] From a grammatical and semantic perspective, each text phrase and each log record expresses an action; therefore, the subject, object, and action itself are relatively easy to identify. After obtaining each text phrase and log record corresponding to the text intelligence data, each text phrase and log record can be converted into its corresponding form by following the steps of word segmentation, part-of-speech tagging, dependency parsing, and extracting the subject, predicate, and object based on dependency relations.<subject, operation, object> The dataset consists of JSON-formatted triples. It's important to note that for log text, the `subject` represents the entity performing the log operation, `operation` represents the operation type, and `object` represents the object of the operation. For short sentence text, the `subject` is the subject of the sentence, `operation` is the predicate, and `object` is the object. After obtaining the text triple dataset, we can perform IOC extraction and association pattern analysis based on the following steps.

[0066] Based on the preset attack entity data model and the pre-built attack entity extraction model, attack entity extraction analysis is performed on the text triplet dataset to obtain several attack entity triplets. The attack entity extraction model can be understood as a model capable of identifying real-name entities based on various attack entity types defined in the preset attack entity data model. To improve the efficiency and accuracy of attack entity identification in power information networks, this embodiment preferably uses historical text intelligence data from power information networks, power grid attack cases in the ATT&CK matrix, and power grid advanced persistent threat reports as training data to train and construct an attack entity extraction model suitable for power information networks in stages. Specifically, the construction steps of the attack entity extraction model include:

[0067] A text intelligence dataset from the power information network is obtained. Named entity recognition and extraction are performed on the text intelligence dataset using preset regular expressions to obtain a named entity set. The text intelligence dataset can be understood as valid text data obtained after preprocessing historical text intelligence data from the power information network, such as removing irrelevant characters, blank lines, and special characters. It also includes data such as network threat intelligence, system security logs, and secure webpage information. In practical applications, regular expressions for extracting various phrases and keywords related to network security (such as IP addresses, domain names, and file hash values) can be pre-defined based on these network security phrases and keywords. Then, all designed regular expressions are used to perform named entity matching and extraction on each text intelligence data in the text intelligence dataset to obtain the required named entity set.

[0068] Based on the named entity set, the text intelligence dataset is annotated with named entities to obtain a text intelligence training set; wherein, the named entity annotation can be performed using existing named entity annotation tools to annotate the content, type and location of each named entity, without specific limitations here.

[0069] The preset named entity recognition model is trained based on the text intelligence training set to obtain the initial attack entity extraction model. The preset named entity recognition model can be selected based on actual application requirements. For example, the pre-trained NER model in the SpaCy library can be used. The specific training process can refer to the training techniques corresponding to the preset named entity recognition model.

[0070] Power grid attack cases are obtained from the ATT&CK matrix, and the initial attack entity extraction model is trained based on these cases and power grid advanced persistent threat reports to obtain the attack entity extraction model. The power grid attack cases in the ATT&CK matrix can be understood as being obtained by filtering based on preset keywords related to power attacks. The power grid attack cases and power grid advanced persistent threat reports are processed and converted into data formats that can be directly used to train the named entity recognition model. These data are then used to further train the initial attack entity extraction model to improve its adaptability and scalability to network threat intelligence and specific security entities, ensuring that the entity types extracted based on the model can cover all attack techniques and entity types.

[0071] The attack entity triples are matched and analyzed with the preset entity association pattern table to obtain several text attack association patterns. While the preset entity association pattern table can theoretically be set based on experience, to ensure the comprehensiveness and reliability of the extracted text attack association patterns, this embodiment preferably uses a large language model based on role-playing and cue word engineering to analyze historical text intelligence data of the power information network to generate the preset entity association patterns. Specifically, the steps for constructing the preset entity association pattern table include:

[0072] The text intelligence dataset of the power information network is obtained and preprocessed to obtain the corresponding intelligence triple dataset. As described above, the text intelligence dataset refers to the effective text data obtained after preprocessing historical text intelligence data of the power information network by removing irrelevant characters, blank lines, and special characters. It also includes data such as network threat intelligence, system security logs, and secure webpage information. The process of obtaining the corresponding intelligence triple dataset can be referred to the method for obtaining the text triple dataset in the aforementioned attack entity extraction model construction steps, and will not be repeated here.

[0073] Based on the preset attack entity data model and the pre-built attack entity extraction model, attack entity extraction analysis is performed on the intelligence triple dataset to obtain an attack entity set. The method for obtaining the attack entity set can also refer to the method for obtaining the named entity set in the aforementioned attack entity extraction model construction steps, and will not be repeated here.

[0074] Based on the aforementioned text intelligence dataset and the first large language model, a deduplication analysis is performed on the attack entities in the attack entity set using a role-playing method to obtain a standard attack entity set. The first large language model can be understood as an LLM (Large Language Model). In practical applications, leveraging the text analysis and semantic understanding capabilities of the LLM model, the attack entity set obtained in the above steps is input into the LLM model. Through prompt word engineering, combined with a role-playing method (prompt example: You are an excellent cybersecurity expert; please remove duplicate attack entities from attack entity set A), the LLM model performs semantic discrimination, removing duplicate IOC attack entities and standardizing the names of IOC attack entities to obtain the required standard attack entity set.

[0075] Based on the text intelligence dataset, word frequency co-occurrence analysis is performed on each attack entity in the standard attack entity set to obtain a multidimensional co-occurrence word frequency matrix. Then, based on the multidimensional co-occurrence word frequency matrix and the Apriori algorithm, association analysis is performed on the attack entities in the standard attack entity set to obtain several associated attack entity pairs. The multidimensional co-occurrence word frequency matrix can be understood as a matrix including the co-occurrence word frequencies of every two attack entities in the standard attack entity set, and can be obtained based on existing word frequency co-occurrence analysis techniques, which will not be detailed here. After obtaining the multidimensional co-occurrence word frequency matrix, the associated attack entities in the standard attack entity set can be mined based on the Apriori algorithm combined with pre-set power information network security event association rules. Associated attack entities that appear frequently (co-occurrence word frequencies exceeding a preset word frequency threshold) are selected as the required multiple associated attack entity pairs. The specific analysis process for associated attack entity pairs can refer to existing technologies using the Apriori algorithm for association analysis, and the power information network security event association rules can be set according to actual application needs, without specific limitations here.

[0076] Based on the first large language model and the text intelligence dataset, text position reconstruction analysis is performed on each of the associated attack entity pairs using cue word engineering to generate association patterns for each pair. In practical applications, the semantic analysis and semantic completion capabilities of the LLM model are utilized, combined with cue word engineering, to reconstruct the position of the attack entities in each associated attack entity pair within the text based on the text intelligence dataset, and to generate association patterns for the associated attack entity pairs based on the corresponding text information.

[0077] The associated attack entity pairs and their corresponding association patterns are summarized to generate the preset entity association pattern table; that is, the associated attack entity pairs and their corresponding association patterns are sorted according to...<subject, relation, object> The relationships are stored in a table, resulting in the preset entity association pattern table shown in Table 2. It should be noted that the association relationships in the preset entity association pattern table shown in Table 2 can be expanded or defined according to actual application needs.

[0078] Table 2 Preset Entity Association Mode Table

[0079]

[0080] The tuple information of each attack entity triple is matched and compared with the association information in each entity association pattern in the preset entity association pattern table (including complete matching of subject entity type / operation subject type, predicate type / operation type, and object entity type / operation object). If the tuple information of a certain attack entity triple is completely matched with a certain entity association pattern in the preset entity association pattern table, then the attack entity triple is a text attack association pattern obtained.

[0081] Based on all the text attack association patterns, the attack reconstruction master graph is generated; the generation process of the attack reconstruction master graph can be implemented with reference to relevant knowledge graph generation technologies, and will not be described in detail here.

[0082] This embodiment uses attack entity data models combined with technologies such as natural language processing, deep learning, and large language models to analyze and extract attack entity relationships from text intelligence data. This not only improves the efficiency of attack entity extraction but also effectively enhances the comprehensiveness and accuracy of text intelligence data analysis, ensuring that the attack reconstruction master map built based on text intelligence data has reliable attack tracing capabilities.

[0083] S13. Based on the preset code model and the attack entity retrieval database, perform attack entity relationship extraction and analysis on the attack vulnerability code to generate several attack reconstruction sub-graphs.

[0084] The pre-built code model can be any existing model capable of code parsing, such as the Code Llama model, and is not specifically limited here. The attack entity retrieval database can be understood as a pre-built text information database that facilitates retrieval enhancement by the pre-built code model. To ensure that attack behaviors associated with attack information in the text intelligence data are identified from the vulnerability code and effectively supplement the text intelligence analysis results, this embodiment preferably sets the attack entity retrieval database to be constructed based on the vectorized text data corresponding to the text intelligence data. That is, each intelligence data text in the text intelligence data is vectorized, and the corresponding vectorized text data is stored in the pre-built attack entity retrieval database. The specific text vectorization representation can be implemented using existing natural language processing techniques.

[0085] Specifically, the step of extracting and analyzing attack entity relationships in the vulnerability code based on a preset large code model and an attack entity retrieval database to generate several attack reconstruction subgraphs includes:

[0086] Based on the pre-defined code model, the vulnerability code is parsed using a prompt word engineering approach to generate a corresponding abstract syntax tree (AST) and obtain the node set of the AST. In practical applications, the vulnerability code can be uploaded to the pre-defined code model, and then a corresponding prompt word can be input (e.g., "You are an excellent code analyst, and you need to parse the code {vulnerable code} into an AST; requirements: the AST should contain all nodes in the code while ensuring the semantics of the code"). This allows the pre-defined code model to perform the code parsing task. Utilizing the code understanding capabilities of the pre-defined code model, the vulnerability code is parsed into an AST. Simultaneously, the node set corresponding to the AST is easily obtained by traversing the nodes of the AST using the breadth-first search (BFS) algorithm. This node set includes node information such as strings, variables, command-line operations, and parameters. This node information stores download addresses of processes and links that may have appeared in the text intelligence data, and may also contain malware and execution paths that have not appeared in the text intelligence data.

[0087] Based on the second major language model, the relevance of each node in the node set to the attack information in the attack entity's retrieval database is analyzed. Based on the relevance analysis results, the node set is filtered to obtain a candidate node list. The type of the second major language model can be selected based on actual application needs and can be the same as or different from the first major language model. In practical applications, the second major language model's text understanding capabilities can be fully utilized, and combined with the attack entity's retrieval database, to determine whether the node set and the attack behavior information in the attack entity's retrieval database are similar and related. A similarity score should be given; if the similarity score is less than a threshold (e.g., 0.1), the answer should be "no"; otherwise, "yes" should be given. Answers should be given in standard JSON format. This allows for the determination of whether the node information in the node set is related to the attack behavior in the text intelligence data, and the extraction of relevant nodes into the candidate node list.

[0088] Based on the preset entity association pattern table, association pattern matching analysis is performed on the nodes in the candidate node list to obtain several code attack association patterns. The association pattern matching analysis process can be understood as pairing the nodes in the candidate node list and performing matching analysis on all resulting node pairs against the preset entity association pattern table (i.e., if there are n nodes in the candidate node list, then...). If a match is found, the corresponding node is considered to be able to supplement the previously obtained text attack association pattern if it matches the association pattern in the preset entity association pattern table; otherwise, the corresponding node is considered to be not in the preset entity association pattern table.

[0089] Based on each of the code attack association patterns, a corresponding attack reconstruction subgraph is generated; wherein, the attack reconstruction subgraph corresponds one-to-one with the code attack association pattern, that is, the number of attack reconstruction subgraphs can be obtained based on knowledge graph technology for the number of code attack association patterns.

[0090] This embodiment uses large language model technology combined with text intelligence data-based retrieval enhancement technology to extract attack entity relationships from vulnerable code. This effectively ensures the efficiency and accuracy of code-level attack behavior analysis, thereby providing reliable supplementary evidence for text intelligence data analysis results and facilitating the complete recovery of all process attack chains.

[0091] S14. Merge the attack reconstruction main graph and each of the attack reconstruction subgraphs to generate a target attack reconstruction graph. The target attack reconstruction graph can be understood as a complete attack chain reconstruction graph obtained by adding nodes from each attack reconstruction subgraph to the attack reconstruction main graph.

[0092] To ensure the reliability of the generated target attack reconstruction graph, this embodiment preferably employs a node knowledge alignment mechanism to establish connections between nodes in the attack reconstruction subgraph. Specifically, the step of merging the main attack reconstruction graph and each of the attack reconstruction subgraphs to generate the target attack reconstruction graph includes:

[0093] Based on the breadth-first search algorithm, the node access order lists corresponding to the attack reconstruction main graph and each of the attack reconstruction subgraphs are obtained respectively. The node access order lists are traversed and sorted using the breadth-first search algorithm, so that during the merging process of the attack reconstruction main graph and the attack reconstruction subgraphs, the graph can be processed layer by layer from the root of the attack reconstruction main graph, which can ensure the integrity of the graph structure during the merging process.

[0094] Based on the attack reconstruction main graph and the node access order list corresponding to each of the attack reconstruction subgraphs, the matching main graph node in the attack reconstruction main graph corresponding to each subgraph node in each attack reconstruction subgraph is obtained through traversal. The matching main graph node in the attack reconstruction main graph can be understood as the main graph node with the highest similarity to the subgraph node in the attack reconstruction subgraph, obtained based on node similarity analysis. Specifically, the step of obtaining the matching main graph node in the attack reconstruction main graph corresponding to each subgraph node in each of the attack reconstruction subgraphs based on the attack reconstruction main graph and the node access order list corresponding to each of the attack reconstruction subgraphs includes:

[0095] Based on the node access order list corresponding to the main graph of the attack reconstruction and each of the subgraphs of the attack reconstruction, the node alignment score between each subgraph node in each subgraph of the attack reconstruction and each main graph node in the main graph of the attack reconstruction is calculated by traversing the graph based on a preset node alignment score expression; the preset node alignment score is calculated based on the consistency of entity type and the similarity of entity name between nodes, and is expressed as follows:

[0096]

[0097] In the formula, Represents subgraph nodes With main image node Node alignment score; and Representing subgraph nodes respectively With main image node Entity type; Represents subgraph nodes With main image node The similarity between entity names can be obtained by calculating the cosine similarity between entity names using the BERT-Mini model; This represents the static alignment coefficient, which can be used to impose hard constraints on prior knowledge of the domain. This coefficient can be taken in the empirical range of 0.3 to 0.7, or it can be automatically calibrated based on Bayesian optimization.

[0098] Obtain the maximum node alignment score among all node alignment scores of each subgraph node in each of the attack reconstruction subgraphs, and take the main graph node corresponding to the maximum node alignment score as the corresponding matching main graph node; wherein, the maximum node alignment score of a certain subgraph node in the attack reconstruction subgraph can be understood as the maximum value among the node alignment scores between the subgraph node in the attack reconstruction subgraph and all main graph nodes in the attack reconstruction main graph; the matching main graph node corresponding to the subgraph node can be understood as a main graph node in the attack reconstruction main graph corresponding to the maximum value among the node alignment scores between the subgraph node and all main graph nodes in the attack reconstruction main graph.

[0099] Each subgraph node in each of the attack reconstruction subgraphs is connected to the corresponding matching main graph node in the attack reconstruction main graph to generate an initial attack reconstruction graph. The establishment of the graph connection relationship can be understood as adding the association relationship between the subgraph nodes in the attack reconstruction subgraphs and the corresponding matching main graph nodes in the attack reconstruction main graph according to the corresponding entity association relationship.

[0100] The initial attack reconstruction graph is deduplicated to obtain the target attack reconstruction graph. Node deduplication considers that the same entity may appear in different forms in different threat intelligence sources. For example, in text intelligence data, attack entities may be recorded in natural language / names, while in code they often appear as variables. To prevent unnecessary expansion of the graph size due to attack reconstruction graph merging, duplicate nodes that may be generated during the merging process are eliminated. Specifically, the process includes: first, evaluating the similarity between all nodes in the initial attack reconstruction graph based on the character similarity of their names; if similar, merging or removing nodes is selected according to actual needs (e.g., if the character similarity is greater than the removal similarity threshold, the two nodes are removed; if the character similarity is greater than the merging similarity threshold but less than the removal similarity threshold, the two nodes are merged); if dissimilar, semantic deduplication analysis based on cosine similarity is performed.

[0101] The target attack reconstruction map can be obtained by following the above steps. To facilitate understanding of the target attack reconstruction map, the following uses... Figure 2 Taking the target attack reconstruction diagram shown below as an example, the attack process will be analyzed:

[0102] The attacker first entered the command `git clone xxx` (corresponding to the `git.exe` process) in the command prompt (cmd command line), retrieving a malicious PowerShell script from the attacker's repository (the PowerShell script is stored at https: / / github.com / xx / yy, and has been anonymized). To mislead security analysts, the attacker also performed other operations, such as viewing the Task Manager's `taskinfo.exe` (obtained from the logs, corresponding to the `taskinfo.exe` process). Furthermore, the attacker used a fileless attack method; the attack script superficially interacts with a web browser (corresponding to the `firefox.exe` process), but actually opens `winword.exe` and writes macros to a file (corresponding to `test.docx`). The macros open `explorer.exe` and execute `schtasks.exe` to write a scheduled task (since the scheduled task is executed separately, it is not shown in the attack graph), and write to the registry key (`\HKCU\Software`) via `reg.exe`. This example demonstrates that the target attack reconstruction graph obtained through the above multi-source threat intelligence analysis can comprehensively and finely reconstruct the complete attack behavior, facilitating reliable attack attribution analysis.

[0103] This embodiment, based on a static alignment coefficient constrained by introducing domain prior knowledge (entity type matching), combined with a preset node alignment score expression designed for dynamic similarity compensation based on named entity similarity, can not only effectively reduce invalid node alignment processing in knowledge alignment analysis, but also avoid semantic drift caused by relying solely on similarity analysis. It significantly reduces the number of redundant nodes in the target attack reconstruction graph, thereby ensuring reliable intelligent fusion of attack behavior information contained in text intelligence data and attack vulnerability code to form a unified and coherent attack knowledge graph. This allows for more granular reconstruction of complete attack behavior, providing a comprehensive and in-depth technical attack view, and thus providing a reliable reference for attack tracing analysis of power information networks.

[0104] This invention employs a multi-source threat intelligence data model, including text intelligence data and vulnerability code, from a power information network based on preset search keywords. It then uses a preset attack entity data model and a preset entity association pattern table, which includes various attack entity types and their corresponding natural language descriptions and attributes, to extract and analyze attack entity relationships from the text intelligence data, generating an attack reconstruction master graph. Finally, it uses an attack entity retrieval database, constructed based on a preset code model and vectorized text data corresponding to the text intelligence data, to extract and analyze attack entity relationships from the vulnerability code, generating several attack reconstruction sub-graphs. Finally, it merges the attack reconstruction master graph and the various attack reconstruction sub-graphs to generate a target attack reconstruction graph. By using natural language processing and deep learning technologies, this multi-source attack graph reconstruction mechanism extracts attack entity relationships from multi-source heterogeneous data including text intelligence data and vulnerability code based on a pre-built attack entity data model, and then performs attack graph reconstruction fusion analysis based on attack entity relationships from different data sources. This not only effectively improves the accuracy and comprehensiveness of attack entity identification but also ensures the reliability of threat detection and attack tracing analysis, thereby enhancing the security defense capabilities of the power information network.

[0105] It should be noted that although the steps in the flowchart above are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise explicitly stated in this document, there is no strict order requirement for the execution of these steps, and they can be executed in other orders.

[0106] In one embodiment, such as Figure 3 As shown, a multi-source threat intelligence analysis system for power information networks is provided, the system comprising:

[0107] Data acquisition module 1 is used to acquire multi-source threat intelligence data to be analyzed from the power information network according to preset search keywords; the multi-source threat intelligence data to be analyzed includes text intelligence data and attack vulnerability code; the text intelligence data includes network threat intelligence, system security logs and security web page information;

[0108] The main image reconstruction module 2 is used to extract and analyze the attack entity relationships of the text intelligence data according to the preset attack entity data model and the preset entity association pattern table, and generate an attack reconstruction main image; the preset attack entity data model includes a variety of attack entity types and natural language descriptions and attributes corresponding to each attack entity type; the attack entity types include processes, files, sockets, general vulnerability disclosure information and attack organizations.

[0109] Subgraph reconstruction module 3 is used to extract and analyze the attack entity relationships of the attack vulnerability code based on a preset code large model and an attack entity retrieval database, and generate several attack reconstruction subgraphs; the attack entity retrieval database is constructed based on the vectorized text data corresponding to the text intelligence data;

[0110] The fusion processing module 4 is used to merge the main attack reconstruction map and each of the attack reconstruction sub-maps to generate a target attack reconstruction map.

[0111] Specific limitations regarding the multi-source threat intelligence analysis system for power information networks can be found in the limitations of the multi-source threat intelligence analysis method for power information networks described above; the corresponding technical effects are equivalent and will not be repeated here. Each module in the aforementioned multi-source threat intelligence analysis system for power information networks can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0112] Figure 4 An internal structural diagram of a computer device is shown in one embodiment. This computer device may specifically be a terminal or a server. Figure 4 As shown, the computer device includes a processor, memory, network interface, display, camera, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used for communication with external terminals via a network connection. The computer program, executed by the processor, can implement a multi-source threat intelligence analysis method for power information networks. The display screen can be an LCD screen or an e-ink display. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0113] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the computer device to which the present invention is applied. A specific computing device may include more or fewer components than those shown in the figure, or combine certain components, or have the same component arrangement.

[0114] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described above.

[0115] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0116] In summary, the multi-source threat intelligence analysis method, system, device, and medium for power information networks provided by this invention employs natural language processing and deep learning technologies. Based on a pre-built attack entity data model, it extracts attack entity relationships from multi-source heterogeneous data, including text intelligence data and attack vulnerability code. Then, based on the attack entity relationships from different data sources, it performs attack graph reconstruction and fusion analysis. This multi-source attack graph reconstruction mechanism not only effectively improves the accuracy and comprehensiveness of attack entity identification but also ensures the reliability of threat detection and attack tracing analysis, thereby enhancing the security defense capabilities of power information networks.

[0117] The various embodiments in this specification are described in a progressive manner. For directly identical or similar parts of the embodiments, refer to each other. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. It should be noted that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0118] The above-described embodiments are merely preferred embodiments of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various improvements and substitutions without departing from the principles of the present invention, and these improvements and substitutions should also be considered within the scope of protection of the present invention. Therefore, the scope of protection of this invention should be determined by the scope of the claims.

Claims

1. A method for power information network multi-source threat intelligence analysis, characterized in that, The method comprises: According to the preset search keywords, the power information network is obtained The multi-source threat intelligence data to be analyzed; The multi-source threat intelligence data to be analyzed includes text intelligence data and attack vulnerability code; The text intelligence data includes network threat intelligence, system security log and security webpage information; According to the preset attack entity data model and the preset entity association mode table, the attack entity relationship extraction analysis is carried out on the text intelligence data, and the attack reconstruction main graph is generated; The preset attack entity data model includes a plurality of attack entity types and the natural language description and attribute corresponding to each attack entity type; The attack entity type includes process, file, socket, common vulnerability disclosure vulnerability information and attack organization; Based on the preset code large model and the attack entity retrieval database, the attack entity relationship extraction analysis is carried out on the attack vulnerability code, and a plurality of attack reconstruction subgraphs are generated; The attack entity retrieval database is constructed based on the vectorized text data corresponding to the text intelligence data; The attack reconstruction main graph and each attack reconstruction subgraph are merged to generate a target attack reconstruction graph; Wherein, the step of extracting attack entity relationship based on the preset code large model and the attack entity retrieval database on the attack vulnerability code to generate a plurality of attack reconstruction subgraphs comprises: According to the preset code large model, the code analysis is carried out on the attack vulnerability code based on the prompt word engineering, the corresponding abstract syntax tree is generated, and the node set of the abstract syntax tree is obtained; According to the second large language model, the relevance of each node in the node set and the attack information in the attack entity retrieval database is analyzed, and the node set is screened according to the obtained relevance analysis result to obtain a candidate node list; According to the preset entity association mode table, the nodes in the candidate node list are matched and analyzed to obtain a plurality of code attack association modes; According to each code attack association mode, the corresponding attack reconstruction subgraph is generated.

2. The power information network multi-source threat intelligence analysis method of claim 1, wherein, The step of extracting attack entity relationship based on the preset attack entity data model and the preset entity association mode table on the text intelligence data to generate an attack reconstruction main graph comprises: The non-log data text in the text intelligence data is short sentence split, the log data text in the text intelligence data is record split, each text short sentence and each log record are converted into corresponding triple data, and a text triple data set is generated; The triple data is composed of subject, predicate and object; According to the preset attack entity data model and the prebuilt attack entity extraction model, the attack entity extraction analysis is carried out on the text triple data set, and a plurality of attack entity triples are obtained; Each attack entity triple is matched and analyzed with the preset entity association mode table to obtain a plurality of text attack association modes; According to all the text attack association modes, the attack reconstruction main graph is generated.

3. The power information network multi-source threat intelligence analysis method of claim 1, wherein, The construction step of the preset entity association mode table comprises: Acquire a text intelligence data set of the power information network, and preprocess the text intelligence data set to obtain a corresponding intelligence triple data set; Based on the pre-set attack entity data model and the pre-constructed attack entity extraction model, the attack entity extraction analysis is performed on the intelligence triple data set to obtain an attack entity set; According to the text intelligence data set and the first large language model, the attack entities in the attack entity set are analyzed by the role-playing method to obtain a standard attack entity set; According to the text intelligence data set, the word frequency co-occurrence analysis is performed on each attack entity in the standard attack entity set to obtain a multi-dimensional co-occurrence word frequency matrix, and according to the multi-dimensional co-occurrence word frequency matrix and the Apriori algorithm, the association analysis is performed on the attack entities in the standard attack entity set to obtain a plurality of associated attack entity pairs; According to the first large language model and the text intelligence data set, the text position restoration analysis is performed on each associated attack entity pair based on the prompt word engineering to generate the association mode of each associated attack entity pair; Each associated attack entity pair and the corresponding association mode are summarized to generate the pre-set entity association mode table.

4. The power information network multi-source threat intelligence analysis method of claim 2 or 3, wherein, The construction steps of the attack entity extraction model include: Acquire a text intelligence data set of the power information network, and perform named entity recognition extraction on the text intelligence data set based on a pre-set regular expression to obtain a named entity set; According to the named entity set, the named entity annotation is performed on the text intelligence data set to obtain a text intelligence training set; According to the text intelligence training set, the pre-set named entity recognition model is trained to obtain an initial attack entity extraction model; Acquire a power grid attack case in the ATT&CK matrix, and based on the power grid attack case and the power grid advanced persistent threat report, the initial attack entity extraction model is trained to obtain the attack entity extraction model.

5. The power information network multi-source threat intelligence analysis method of claim 1, wherein, The step of merging the attack reconstruction main graph and each attack reconstruction subgraph to generate a target attack reconstruction graph includes: Based on the breadth-first search algorithm, the node access order list corresponding to the attack reconstruction main graph and each attack reconstruction subgraph is acquired respectively; According to the node access order list corresponding to the attack reconstruction main graph and each attack reconstruction subgraph, each subgraph node in each attack reconstruction subgraph corresponding to the matching main graph node in the attack reconstruction main graph is acquired by traversal; Each subgraph node in each attack reconstruction subgraph and the corresponding matching main graph node in the attack reconstruction main graph are connected by a graph connection relationship to generate an initial attack reconstruction graph; The node of the initial attack reconstruction graph is removed to obtain the target attack reconstruction graph.

6. The power information network multi-source threat intelligence analysis method of claim 5, wherein, The step of acquiring each subgraph node in each attack reconstruction subgraph corresponding to the matching main graph node in the attack reconstruction main graph according to the node access order list corresponding to the attack reconstruction main graph and each attack reconstruction subgraph includes: According to the attack reconstruction main graph and the node access order list corresponding to each attack reconstruction subgraph, the node alignment score of each subgraph node in each attack reconstruction subgraph and each main graph node in the attack reconstruction main graph is calculated based on a preset node alignment score expression; the preset node alignment score is calculated based on entity type consistency and entity name similarity between nodes; Obtain the maximum node alignment score in all node alignment scores of each subgraph node in each attack reconstruction subgraph, and take the main graph node corresponding to the maximum node alignment score as the corresponding matching main graph node.

7. A power information network multi-source threat intelligence analysis system, characterized in that, The system is applied to the power information network multi-source threat intelligence analysis method of claim 1, and the system comprises: A data acquisition module is configured to acquire multi-source threat intelligence data to be analyzed of a power information network according to a preset search keyword; the multi-source threat intelligence data to be analyzed comprises text intelligence data and attack vulnerability code; the text intelligence data comprises network threat intelligence, system security log, and security webpage information; A main graph reconstruction module is configured to perform attack entity relationship extraction analysis on the text intelligence data according to a preset attack entity data model and a preset entity association mode table, and generate an attack reconstruction main graph; the preset attack entity data model comprises a plurality of attack entity types and natural language descriptions and attributes corresponding to each attack entity type; the attack entity types comprise processes, files, sockets, common vulnerability disclosure vulnerability information, and attack organizations; A subgraph reconstruction module is configured to perform attack entity relationship extraction analysis on the attack vulnerability code based on a preset code large model and an attack entity search database, and generate a plurality of attack reconstruction subgraphs; the attack entity search database is constructed based on vectorized text data corresponding to the text intelligence data; A fusion processing module is configured to merge the attack reconstruction main graph and each attack reconstruction subgraph, and generate a target attack reconstruction graph.

8. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the steps of the method of any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method of any one of claims 1 to 6.

Images