Threat intelligence scoring method and device based on semantics and risk features, and medium

Abstract

The application provides a threat intelligence scoring method and device based on semantic and risk characteristics and a medium, relating to the field of network security analysis. The method first uses a large language model to extract threat intelligence knowledge. Compared with traditional NLP algorithms and regular rules, it can more accurately identify entities such as IP and domain name and the correlation between entities such as attacks and controls, providing high-quality data support for subsequent analysis. The GTN algorithm is used for multi-path learning, which can cover all path combinations within a certain length. In addition, a gating mechanism is introduced into threat intelligence analysis to realize adaptive fusion of semantic features and threat level features, dynamically adjust the weights of the two types of features to improve information utilization efficiency. Furthermore, a double-path processing architecture is adopted, which not only incorporates graph structure information through a graph attention network, but also helps to ensure system stability through global average semantics, and balances feature fusion flexibility and overall reliability.

Description

Technical Field

[0001] This application relates to the field of cybersecurity analysis, and more specifically, to a threat intelligence scoring method, apparatus, and medium based on semantic and risk characteristics. Background Technology

[0002] In the field of cybersecurity, threat intelligence analysis is a core component for identifying potential attacks and preventing security risks. Existing threat scoring technologies have significant limitations: First, entity and relation extraction relies on traditional natural language processing methods or predefined rules, only adapting to structured data such as operation logs. They lack sufficient semantic understanding of unstructured data such as security alert reports and malicious emails, easily leading to omissions or errors in relation extraction. This results in fundamental flaws in the constructed cybersecurity knowledge graph, including incomplete entity relationships and excessive noise. Second, when using Residual Graph Convolutional Networks (Residual GCNs) to process the graph, the default assumption of isomorphic graphs makes it impossible to distinguish semantic differences in heterogeneous relationships, easily causing information confusion. Third, feature fusion uses static splicing or fixed weighting strategies, failing to dynamically adjust the weights of semantic and risk features according to the scenario, resulting in low efficiency in utilizing multimodal information. These problems lead to insufficient accuracy and generalization of threat scoring in existing technologies, making it difficult to meet the threat detection needs in complex network environments. Summary of the Invention

[0003] The purpose of this application is to provide a threat intelligence scoring method, apparatus and medium based on semantic and risk features, so as to solve the above-mentioned problems existing in the prior art and achieve accurate and efficient threat scoring.

[0004] Firstly, a threat intelligence scoring method based on semantic and risk features is provided, which may include: A semantic analysis model is used to process the acquired multi-source heterogeneous threat intelligence data to obtain multiple entities and the relationships between them. A cybersecurity knowledge graph is determined based on multiple entities and the relationships between them; Based on the aforementioned cybersecurity knowledge graph, a heterogeneous adjacency matrix representing entity relationships, a semantic feature matrix representing entity semantic attributes, and a risk feature matrix representing the threat level of entities are determined. The heterogeneous adjacency matrix is ​​processed using a configured graph transformation network to obtain the target adjacency matrix; By using a fusion mechanism, the semantic feature matrix, the risk feature matrix, and the target adjacency matrix are fused and classified to obtain the first threat probability. The semantic feature matrix and the risk feature matrix are concatenated, and the overall scene features are extracted through global pooling. Then, the second threat probability is output through classification processing. The first threat probability and the second threat probability are feature fused, and a fusion weight is generated through a weight adaptation mechanism. The two threat probabilities are calculated based on the fusion weight to obtain the target threat score.

[0005] In one possible implementation, the entities are IP addresses, domain names, and file hashes in the field of network security; the relationships are preset network security associations.

[0006] In one possible implementation, the heterogeneous adjacency matrix is ​​a set of adjacency matrices constructed for different types of entity associations in the knowledge graph; the semantic feature matrix is ​​generated by encoding entity semantic information through a semantic embedding model; and the risk feature matrix is ​​generated by quantifying the entity threat level.

[0007] In one possible implementation, the graph transformation network captures the structural information of multi-hop meta-paths between entities through multi-layer graph transformation operations, outputs a multi-channel meta-path adjacency matrix, and then obtains the target adjacency matrix through channel dimension fusion processing.

[0008] In one possible implementation, a fusion mechanism is used to perform fusion and classification processing on the semantic feature matrix, the risk feature matrix, and the target adjacency matrix to obtain a first-path threat probability, including: A gating mechanism is used to fuse the semantic feature matrix and the risk feature matrix: the semantic feature matrix is ​​transformed by a first linear layer and activated by ReLU to obtain semantic transformation features, and the risk feature matrix is ​​transformed by a second linear layer and activated by ReLU to obtain risk transformation features; a gating vector is generated based on the semantic feature matrix and the risk feature matrix; the semantic transformation features and the risk transformation features are weighted and summed using the gating vector to obtain the fused feature matrix; After the fused feature matrix is ​​processed by Dropout regularization, it is input into a graph attention network and combined with the target adjacency matrix for multi-round feature aggregation: the first layer graph attention network aggregates local neighborhood information of entities through multi-head attention, and the second layer graph attention network refines global graph structure information through single-head attention; the output features of the second layer graph attention network are subjected to global average pooling in the node dimension to obtain global structure features; the global structure features are input into a fully connected layer, and the output classification logits are activated by Softmax to obtain the first path threat probability.

[0009] In one possible implementation, the semantic feature matrix and the risk feature matrix are concatenated, and after global pooling to extract the overall scene features, a second threat probability is output through classification processing, including: The semantic feature matrix and the risk feature matrix are concatenated along the feature dimension to obtain a joint feature matrix; The joint feature matrix is ​​subjected to global average pooling along the node dimension to obtain the overall scene features; The overall scene features are input into a classification network consisting of a linear layer, a ReLU activation layer, a Dropout layer, and an output linear layer. The output classification logits are then activated by Softmax to obtain the second threat probability.

[0010] In one possible implementation, the target threat score is obtained, including: The first threat probability and the second threat probability are concatenated along the feature dimension to obtain the weighted calculation feature; The weight calculation features are input into the weight adaptation network, which is then processed sequentially through a linear layer, a ReLU activation layer, another linear layer, and a Sigmoid activation layer to output the fusion weights with values ​​ranging from 0 to 1. Based on the fusion weights, the target threat score is determined.

[0011] Secondly, a threat intelligence scoring device based on semantics and risk characteristics is provided, which may include: The processing unit is used to process the acquired multi-source heterogeneous threat intelligence data using a semantic analysis model to obtain multiple entities and the relationships between them. The defining unit is used to define a cybersecurity knowledge graph based on multiple entities and the relationships between them. Furthermore, based on the aforementioned cybersecurity knowledge graph, a heterogeneous adjacency matrix representing entity relationships, a semantic feature matrix representing entity semantic attributes, and a risk feature matrix representing the threat level of entities are determined. The processing unit is further configured to process the heterogeneous adjacency matrix using a configured graph transformation network to obtain a target adjacency matrix. The fusion classification unit is used to perform fusion classification processing on the semantic feature matrix, the risk feature matrix and the target adjacency matrix through a fusion mechanism to obtain the first threat probability; The processing unit is further configured to concatenate the semantic feature matrix and the risk feature matrix, extract the overall scene features through global pooling, and output the second threat probability through classification processing. The calculation unit is used to perform feature fusion on the first threat probability and the second threat probability, generate fusion weights through a weight adaptation mechanism, and calculate the two threat probabilities based on the fusion weights to obtain the target threat score result.

[0012] Thirdly, an electronic device is provided, which includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When a processor executes a program stored in memory, it implements any of the steps described in the first aspect above.

[0013] Fourthly, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when executed by a processor, the computer program implements the steps of any of the methods described in the first aspect above.

[0014] This application provides a threat intelligence scoring method, device, and medium based on semantic and risk features. The method first utilizes a large language model to extract threat intelligence knowledge. Compared to traditional NLP algorithms and regular rules, it can more accurately identify the relationships between entities such as IP addresses and domain names, as well as entities involved in attacks and control, providing high-quality data support for subsequent analysis. Simultaneously, it employs the GTN algorithm for multi-path learning, covering all path combinations within a certain length. Compared to methods using custom meta-paths, it can capture richer meta-path information, fully leveraging the structural value of the cybersecurity knowledge graph. Furthermore, a gating mechanism is introduced into threat intelligence analysis to achieve adaptive fusion of semantic features and threat level features, dynamically adjusting the weights of the two types of features to improve information utilization efficiency. Moreover, a dual-path processing architecture is adopted, incorporating graph structure information through a graph attention network while leveraging global average semantics to ensure system stability, balancing feature fusion flexibility and overall reliability. In summary, this algorithm can more efficiently mine key knowledge from threat intelligence, and combined with multimodal fusion technology, it can better accomplish threat prediction-related tasks. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A system architecture diagram for a threat intelligence scoring method based on semantic and risk features, provided for embodiments of this application; Figure 2 A flowchart illustrating a threat intelligence scoring method based on semantic and risk features, provided for an embodiment of this application; Figure 3 This application provides a processing path diagram for the first threat probability in an embodiment of the present application. Figure 4 This application provides a processing path diagram for the second threat probability in an embodiment of the present application. Figure 5 A schematic diagram illustrating the adaptive weighted fusion and output process provided in an embodiment of this application; Figure 6 A diagram illustrating the overall data processing procedure provided in this application embodiment; Figure 7 A detailed schematic diagram illustrating a threat intelligence scoring method based on semantic and risk features, provided for an embodiment of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0018] The threat intelligence scoring method based on semantic and risk features provided in this application embodiment can be applied to... Figure 1 In the system architecture shown, such as Figure 1 As shown, the system may include: a server in the enterprise's backend and terminals for enterprise employees. The server can be a physical server, a server cluster consisting of multiple physical servers, or a distributed system. It can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal may be a user equipment (UE) such as a mobile phone, smartphone, laptop, digital radio receiver, personal digital assistant (PDA), tablet computer (PAD), handheld device, in-vehicle device, wearable device, computing device, or other processing device connected to a wireless modem, mobile station (MS), or mobile terminal. The terminal and server can be directly or indirectly connected via wired or wireless communication methods; this application does not limit the connection.

[0019] The terminal is used to acquire threat intelligence data from multiple heterogeneous sources and send the threat intelligence data to the server; A server is used to receive threat intelligence data in order to execute a threat intelligence scoring method based on semantic and risk features provided in this application.

[0020] In the field of cybersecurity, threat intelligence analysis is a core component for identifying potential attacks and preventing security risks. Existing threat scoring technologies have significant limitations: First, entity and relation extraction relies on traditional natural language processing methods or predefined rules, only adapting to structured data such as operation logs. They lack sufficient semantic understanding of unstructured data such as security alert reports and malicious emails, easily leading to omissions or errors in relation extraction. This results in fundamental flaws in the constructed cybersecurity knowledge graph, including incomplete entity relationships and excessive noise. Second, when using Residual Graph Convolutional Networks (Residual GCNs) to process the graph, the default assumption of isomorphic graphs makes it impossible to distinguish semantic differences in heterogeneous relationships, easily causing information confusion. Third, feature fusion uses static splicing or fixed weighting strategies, failing to dynamically adjust the weights of semantic and risk features according to the scenario, resulting in low efficiency in utilizing multimodal information. These problems lead to insufficient accuracy and generalization of threat scoring in existing technologies, making it difficult to meet the threat detection needs in complex network environments.

[0021] Therefore, this application provides a threat intelligence scoring method based on semantic and risk features to solve the above-mentioned problems in the prior art, and can achieve accurate and efficient threat scoring.

[0022] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0023] Figure 2 This is a flowchart illustrating a threat intelligence scoring method based on semantic and risk features, provided as an embodiment of this application. Figure 2 As shown, the method may include: Step S210: Use a semantic analysis model to process the acquired multi-source heterogeneous threat intelligence data to obtain multiple entities and the relationships between them.

[0024] Specifically, it acquires multi-source heterogeneous threat intelligence data, covering common intelligence sources in the cybersecurity field, including but not limited to: operation logs generated by security devices (such as firewall access logs and intrusion detection system alarm logs), network traffic capture data (such as IP session data and domain name resolution records), malware-related indicators (such as malicious file hash values ​​and malicious code behavior reports), security alert documents released by third-party threat intelligence platforms, parsing information of the body and attachments of suspected malicious emails, and vulnerability-related description texts disclosed by vulnerability platforms.

[0025] Data processing is performed using a pre-trained semantic analysis model (rather than a traditional natural language processing model) that has been fine-tuned with specialized knowledge in the cybersecurity field. This model is fine-tuned using cybersecurity corpora (such as historical threat intelligence reports, network attack case documents, and security vulnerability database descriptions), and has the ability to accurately understand cybersecurity terminology and implicit threat relationships. It can overcome the limitations of traditional models in identifying multiple meanings (such as the difference between the descriptions of malicious IP and attack source IP) and complex relationships.

[0026] It can also be combined Figure 6 and Figure 7 As shown, the semantic analysis model described above performs source-by-source semantic parsing on the collected multi-source heterogeneous threat intelligence data to identify and extract core entities in the cybersecurity field. The entity type is limited to key objects for cybersecurity threat analysis, specifically including IP addresses, domain names, and file hash values ​​(MD5 / SHA256, etc.). During the extraction process, the specific attribute values ​​of the entities are obtained simultaneously (such as the specific value of the IP address 192.168.1.1, the complete text of the domain name xxx.com) to ensure that the entity information can be aligned with the attributes of existing threat intelligence databases (such as IP blacklist databases and malicious domain name databases), laying the foundation for subsequent feature fusion.

[0027] Based on the entity recognition results, a semantic analysis model is used to further extract the pre-defined network security relationships between entities. The relationship types are common threat relationship patterns in the network security field, specifically including 17 categories: exploitation, propagation, control, masquerading, deployment at, connection to, belonging to, affecting, remediation at, indication, attribution to, detected, mitigation, response to, dependence on, located at, and attack. After extraction, structured data in entity-relationship-entity format is formed (e.g., IP address 192.168.1.1-attack-domain name xxx.com, malicious file hash value xxx-propagation-IP address 10.0.0.1), ensuring consistent relationship representation and avoiding omissions or errors in relationships caused by incomplete rule pre-setting in traditional methods.

[0028] Step S220: Based on multiple entities and the relationships between them, determine the cybersecurity knowledge graph.

[0029] Specifically, Neo4j graph database is used as the storage and construction carrier for the cybersecurity knowledge graph. Cypher query language is used to import the previously extracted entity-relationship-entity structured data into the database to construct a complete cybersecurity knowledge graph.

[0030] An example of a Cypher statement for entity import is: "CREATE(ip1:IP{value:'192.168.1.1',threat_level:'high',source:'ThreatFeed_A'})". This type of statement creates entity nodes with attributes (such as entity value, threat level, and intelligence source); at the same time, the corresponding Cypher statements create the relationships between entities, ultimately forming a complete cybersecurity knowledge graph.

[0031] Step S230: Based on the network security knowledge graph, determine the heterogeneous adjacency matrix representing entity relationships, the semantic feature matrix representing entity semantic attributes, and the risk feature matrix representing entity threat level.

[0032] Among them, the heterogeneous adjacency matrix is ​​a set of adjacency matrices constructed for different types of entity associations in the knowledge graph; the semantic feature matrix is ​​generated by encoding the semantic information of entities through a semantic embedding model; and the risk feature matrix is ​​generated by quantifying the threat level of entities.

[0033] Specifically, A. Adjacency Matrix Construction: Construct adjacency matrices, denoted as A, for different relation types in the knowledge graph, to represent different types of connection relationships between entities. The structure of the created adjacency matrix is ​​as follows: (num_edge_types, num_nodes, num_nodes), where num_edge_types is the number of relation types between entities, and num_nodes is the number of nodes in the knowledge graph.

[0034] B. Semantic Feature Extraction: A lightweight BERT model is used to semantically embed entities, generating a node feature matrix rich in semantic information, denoted as... The matrix structure is: (num_nodes, in_features), where num_nodes is the number of nodes in the knowledge graph and in_features is the semantic feature dimension after semantic embedding.

[0035] C. Threat Level Assessment: Simultaneously generate a node threat level feature matrix, denoted as... The matrix structure is (num_nodes, risk_features), where num_nodes is the number of nodes in the knowledge graph and risk_features is the dimension of the entity threat level feature vector. The threat level of each node is represented by one-hot encoding. For example, if the threat level is high, it is represented by [0,0,1], and if there is no threat level, it is represented by a zero vector, thus quantifying the security threat level of each entity.

[0036] Step S240: Use the configured graph transformation network to process the heterogeneous adjacency matrix to obtain the target adjacency matrix.

[0037] Among them, the graph transformation network captures the structural information of multi-hop meta-paths between entities through multi-layer graph transformation operations, outputs a multi-channel meta-path adjacency matrix, and then obtains the target adjacency matrix through channel dimension fusion processing.

[0038] Specifically, the parameters of the graph transformation network used to process heterogeneous adjacency matrices are preset first. The core is to configure the meta-path length to 6-7 to cover common attack chain patterns in network security scenarios (such as malicious IP → connection domain name → deployment of malicious files → attack target device type multi-hop association path), avoiding the problem of incomplete path coverage caused by manually preset meta-paths.

[0039] The heterogeneous adjacency matrix (with shape (num_edge_types, num_nodes, num_nodes), generated based on the network security knowledge graph, is input into the configured GTN. The GTN captures the structural information of multi-hop meta-paths between entities through multi-level transformation operations and outputs a multi-channel meta-path adjacency matrix H with shape (num_channels, num_nodes, num_nodes), where num_channels is the number of meta-path channels, and each channel corresponds to a multi-hop association path pattern of an entity.

[0040] Step S250: Through the fusion mechanism, the semantic feature matrix, risk feature matrix and target adjacency matrix are fused and classified to obtain the first threat probability.

[0041] Specifically, in combination Figure 3 As shown, step S251 involves fusing the semantic feature matrix and the risk feature matrix using a gating mechanism: the semantic feature matrix is ​​transformed by a first linear layer and activated by ReLU to obtain semantic transformation features, and the risk feature matrix is ​​transformed by a second linear layer and activated by ReLU to obtain risk transformation features; a gating vector is generated based on the semantic feature matrix and the risk feature matrix; the semantic transformation features and the risk transformation features are weighted and summed using the gating vector to obtain the fused feature matrix. Step S251 specifically includes: inputting the semantic feature matrix (denoted as node_features, shape (num_nodes, in_features)) representing the semantic attributes of the entity into the preset first linear layer (self.sem_transform), and after processing by the ReLU activation function, obtaining the semantic transformation features (denoted as sem_transformed).

[0042] The linear layer (self.risk_transform), after being processed by the ReLU activation function, yields the risk transformation feature (denoted as risk_transformed). The two linear layers mentioned above are used to unify the dimensions of the two types of features, laying the foundation for subsequent fusion.

[0043] Next, node_features is input into the gated semantic linear layer (self.gate_sem) to obtain the semantic gated component (denoted as gate_sem); risk_features is input into the gated risk linear layer (self.gate_risk) to obtain the risk gated component (denoted as gate_risk); gate_sem and gate_risk are added together and input into the gated output linear layer (self.gate_output), which is processed by the Sigmoid activation function to generate a gate vector (denoted as gate), whose shape is consistent with sem_transformed and risk_transformed, and whose value range is 0~1, used to dynamically allocate the fusion weights of the two types of features.

[0044] The two types of transformed features are weighted and summed according to the formula fused_features=gate*sem_transformed+(1-gate)*risk_transformed to obtain the initial fused features. The initial fused features are input to the output linear layer (self.output_layer), activated by ReLU, and then the feature distribution differences are eliminated by layer normalization (self.layer_norm) to finally obtain the fused feature matrix (denoted as gated_features).

[0045] Step S252: After the fused feature matrix is ​​processed by Dropout regularization, it is input into the graph attention network, and multi-round feature aggregation is performed in combination with the target adjacency matrix: the first layer graph attention network aggregates the local neighborhood information of entities through multi-head attention, and the second layer graph attention network refines the global graph structure information through single-head attention; the output features of the second layer graph attention network are subjected to global average pooling in the node dimension to obtain global structure features; the global structure features are input into the fully connected layer, and the output classification logits are activated by Softmax to obtain the first path threat probability.

[0046] Step S252 specifically includes: performing Dropout regularization on gated_features, using a preset Dropout probability (self.dropout, such as 0.5), randomly masking some feature dimensions to avoid model overfitting and enhance generalization ability. The processed features are still recorded as gated_features.

[0047] Input the regularized gated_features and the target adjacency matrix (shape (num_nodes, num_nodes)) into a custom graph attention layer (CustomGATConv, a subclass of GATConv): This layer internally uses the dense_to_sparse function to convert the target adjacency matrix into sparse edge indices (denoted as edge_index) and edge weights (denoted as edge_weight), adapting it to the GAT input format; Attention aggregation is performed using a preset number of heads (e.g., 8 heads), and the attention weight of each entity to its neighbors is dynamically calculated to highlight key neighborhood information; After the aggregation result is processed by the ELU activation function, Dropout regularization is performed again to obtain the first layer of GAT output features.

[0048] The output features of the first layer GAT are input into another CustomGATConv layer (configured with heads=1). Local features are integrated through a single-head attention mechanism to capture the global relationship structure between entities (such as attack chain relationships across multiple entities) and obtain more abstract node-level global features.

[0049] Then, for the node-level global features output by the second layer GAT, a global average pooling operation (torch.mean(x,dim=0,keepdim=True)) is performed in the node dimension (dim=0) to obtain a global structural feature with shape (1,hidden_dim1), thus realizing the transformation from node-level features to graph-level features.

[0050] The global structural features are input into the fully connected layer (self.fc), and the original classification score (denoted as logits1) is output. The Softmax activation function is applied to logits1 to map the score to a probability value of 0 to 1, and the first threat probability (denoted as probs1, shape (1, num_class)) is obtained, where num_class is the number of threat classification categories (such as normal and threat categories).

[0051] Step S260: Concatenate the semantic feature matrix and the risk feature matrix, extract the overall scene features through global pooling, and output the second threat probability through classification processing.

[0052] Specifically, in combination Figure 4As shown, the semantic feature matrix (denoted as node_features, with shape (num_nodes, in_features), which represents the semantic attributes of entities, is concatenated with the risk feature matrix (denoted as risk_features, with shape (num_nodes, risk_dim), where num_nodes is the number of entity nodes in the network security knowledge graph and in_features is the feature dimension after semantic embedding) which represents the threat level of entities, on the feature dimension (i.e., dimension 1).

[0053] Using a matrix concatenation tool (such as the torch.concat function in PyTorch), a joint feature matrix (denoted as raw_features) is obtained after concatenation. Its shape is (num_nodes, in_features+risk_dim), which realizes the direct integration of the two types of features and preserves the semantic information and risk level information of the entity.

[0054] Perform global average pooling on the node dimension (i.e. dimension 0) of the concatenated joint feature matrix raw_features (e.g., PyTorch's torch.mean(raw_features,dim=0,keepdim=True)).

[0055] This operation calculates the mean of all entity nodes across all feature dimensions, transforming node-level features into graph-level features that reflect the entire network security scenario, resulting in global scenario features (denoted as global_context), which have a shape of (1, in_features+risk_dim). This can intuitively represent the global threat scenario information composed of multiple entities working together.

[0056] The overall scene features, global_context, are input into a pre-defined global semantic classifier (denoted as self.global_classifier). This classifier has a sequential structure of linear layer → ReLU activation layer → Dropout layer → linear layer. The specific processing flow is as follows: Feature transformation and activation: global_context is first input into the first linear layer. After the feature dimension is adapted, the effective features are filtered by the ReLU activation function to enhance the classifier's ability to capture non-linear features. Regularization to prevent overfitting: Perform Dropout regularization on the activated features (using a preset Dropout probability, such as self.dropout) to randomly mask some feature dimensions and prevent the model from overfitting due to feature redundancy; Classification score generation: The features processed by Dropout are input into the second linear layer, and the raw classification score (denoted as logits2) is output. Probability transformation: The Softmax activation function is applied to logits2 to map the original scores to probability values ​​of 0 to 1, resulting in the second threat probability (denoted as probs2), which has the shape (1, num_class), where num_class is the number of threat categories (e.g., normal scenarios and threat scenarios). The probability value directly corresponds to the probability that the scenario belongs to each category.

[0057] Step S270: Perform feature fusion on the first threat probability and the second threat probability, generate fusion weights through a weight adaptation mechanism, calculate the two threat probabilities based on the fusion weights, and obtain the target threat score result.

[0058] Specifically, in combination Figure 5 As shown, the original classification score logits1 corresponding to the first threat probability (denoted as probs1) is obtained (from the output of the subsequent fully connected layer of the first graph attention network), and the original classification score logits2 corresponding to the second threat probability (denoted as probs2) is obtained (from the output of the second global semantic classifier). A matrix concatenation tool (torch.cat function) is used to concatenate logits1 and logits2 along the feature dimension to obtain the concatenated feature (denoted as feature_for_adapter) used for weight calculation. Both logits1 and logits2 have a shape of (1, num_class) (where num_class is the number of threat classification categories, such as normal and threat), therefore feature_for_adapter has a shape of (1, num_class × 2), achieving preliminary integration of the two classification information.

[0059] The concatenated feature_for_adapter is input into a pre-defined weight adaptation network (denoted as self.weight_adapter). This network has a sequence structure of linear layer → ReLU activation layer → linear layer → Sigmoid activation layer. The specific processing flow is as follows: First, dimensional adaptation and non-linear activation; Specifically, the feature_for_adapter is first input into the first linear layer to complete the feature dimension transformation (to adapt to subsequent calculation needs), and then processed by the ReLU activation function to enhance the network's ability to capture feature association information; Secondly, weighting dimension adjustment and range constraints; Specifically, the activated features are input into the second linear layer, and the feature dimension is adjusted to (1, num_class) (consistent with the shape of the single-path threat probability). Finally, the output value is constrained to the range of 0~1 by the Sigmoid activation function to generate adaptive fusion weights (denoted as adaptive_alpha).

[0060] Each element in adaptive_alpha corresponds to the fusion weight of a type of threat. For example, if an element has a value of 0.6, it means that in the score of this type of threat, the first probability weight accounts for 60% and the second probability weight accounts for 40%.

[0061] Finally, a weighted summation formula is used to merge probs1 and probs2, as follows: adaptive_final_probs=adaptive_alpha*probs1+(1-adaptive_alpha)*probs2; Here, `adaptive_final_probs` represents the target threat score, with a shape of (1, num_class), where each element represents the final probability (0~1) of the corresponding threat category. For example, if probs1 is [0.1, 0.9] (normal probability 10%, threat probability 90%), probs2 is [0.2, 0.8] (normal probability 20%, threat probability 80%), and `adaptive_alpha` is [0.7, 0.7], then the target threat score is [0.1×0.7+0.2×0.3, 0.9×0.7+0.8×0.3]=[0.13, 0.87], meaning the threat score for the current scenario is determined to be 87%.

[0062] This application presents a threat intelligence scoring method based on semantic and risk features, which demonstrates significant advantages in threat intelligence scoring tasks. Firstly, it utilizes a large language model for threat intelligence knowledge extraction, which, compared to traditional NLP algorithms and regular rules, more accurately identifies the relationships between entities such as IP addresses and domain names, as well as entities involved in attacks and control, providing high-quality data support for subsequent analysis. Secondly, it employs the GTN algorithm for multi-path learning, covering all path combinations within a certain length. Compared to methods using custom meta-paths, it captures richer meta-path information, fully leveraging the structural value of the cybersecurity knowledge graph. Thirdly, it introduces a gating mechanism into threat intelligence analysis, enabling adaptive fusion of semantic features and threat level features, dynamically adjusting the weights of the two types of features to improve information utilization efficiency. Finally, it adopts a dual-path processing architecture, incorporating graph structure information through a graph attention network while leveraging global average semantics to ensure system stability, balancing feature fusion flexibility with overall reliability. In summary, this algorithm can more efficiently mine key knowledge from threat intelligence, and combined with multimodal fusion technology, it can better accomplish threat prediction-related tasks.

[0063] Corresponding to the above method, this application also provides a threat intelligence scoring device based on semantics and risk features, the device comprising: The processing unit is used to process the acquired multi-source heterogeneous threat intelligence data using a semantic analysis model to obtain multiple entities and the relationships between them. The defining unit is used to define a cybersecurity knowledge graph based on multiple entities and the relationships between them. Furthermore, based on the aforementioned cybersecurity knowledge graph, a heterogeneous adjacency matrix representing entity relationships, a semantic feature matrix representing entity semantic attributes, and a risk feature matrix representing the threat level of entities are determined. The processing unit is further configured to process the heterogeneous adjacency matrix using a configured graph transformation network to obtain a target adjacency matrix. The fusion classification unit is used to perform fusion classification processing on the semantic feature matrix, the risk feature matrix and the target adjacency matrix through a fusion mechanism to obtain the first threat probability; The processing unit is further configured to concatenate the semantic feature matrix and the risk feature matrix, extract the overall scene features through global pooling, and output the second threat probability through classification processing. The calculation unit is used to perform feature fusion on the first threat probability and the second threat probability, generate fusion weights through a weight adaptation mechanism, and calculate the two threat probabilities based on the fusion weights to obtain the target threat score result.

[0064] The functions of each unit in the threat intelligence scoring device based on semantic and risk features provided in the above embodiments of this application can be implemented through the above methods and steps. Therefore, the specific working process and beneficial effects of each unit in the threat intelligence scoring device based on semantic and risk features provided in the embodiments of this application will not be repeated here.

[0065] This application embodiment also provides an electronic device, including a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540.

[0066] Memory 530 is used to store computer programs; When the processor 510 executes the program stored in the memory 530, it performs the following steps: A semantic analysis model is used to process the acquired multi-source heterogeneous threat intelligence data to obtain multiple entities and the relationships between them. A cybersecurity knowledge graph is determined based on multiple entities and the relationships between them; Based on the aforementioned cybersecurity knowledge graph, a heterogeneous adjacency matrix representing entity relationships, a semantic feature matrix representing entity semantic attributes, and a risk feature matrix representing the threat level of entities are determined. The heterogeneous adjacency matrix is ​​processed using a configured graph transformation network to obtain the target adjacency matrix; By using a fusion mechanism, the semantic feature matrix, the risk feature matrix, and the target adjacency matrix are fused and classified to obtain the first threat probability. The semantic feature matrix and the risk feature matrix are concatenated, and the overall scene features are extracted through global pooling. Then, the second threat probability is output through classification processing. The first threat probability and the second threat probability are feature fused, and a fusion weight is generated through a weight adaptation mechanism. The two threat probabilities are calculated based on the fusion weight to obtain the target threat score.

[0067] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0068] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0069] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0070] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0071] The implementation methods and beneficial effects of the various components of the electronic device in the above embodiments for solving the problem can be found in [reference needed]. Figure 2 The steps in the illustrated embodiments are used to implement the electronic device. Therefore, the specific working process and beneficial effects of the electronic device provided in this application will not be repeated here.

[0072] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores instructions that, when executed on a computer, cause the computer to perform a threat intelligence scoring method based on semantic and risk features as described in any of the above embodiments.

[0073] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute a threat intelligence scoring method based on semantic and risk features as described in any of the above embodiments.

[0074] Those skilled in the art will understand that the embodiments in this application can be provided as methods, systems, or computer program products. Therefore, the embodiments in this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments in this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0075] This application describes embodiments of methods, apparatus (systems), and computer program products according to embodiments of this application with reference to flowchart illustrations and / or block diagrams. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0076] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0077] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0078] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected," "coupled," or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0079] Although preferred embodiments have been described in this application, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the embodiments in this application are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments in this application.

[0080] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the embodiments of this application and their equivalents, then these modifications and variations are also intended to be included in the embodiments of this application.

Claims

1. A threat intelligence scoring method based on semantic and risk features, characterized in that, The method includes: Semantic analysis models are used to process the acquired multi-source heterogeneous threat intelligence data to obtain multiple entities and the relationships between them. The data types of multi-source heterogeneous threat intelligence data include: operation logs generated by security devices, network traffic capture data, malware-related indicators, and vulnerability-related description texts disclosed by vulnerability platforms. A cybersecurity knowledge graph is determined based on multiple entities and the relationships between them; Based on the aforementioned cybersecurity knowledge graph, a heterogeneous adjacency matrix representing entity relationships, a semantic feature matrix representing entity semantic attributes, and a risk feature matrix representing the threat level of entities are determined. The heterogeneous adjacency matrix is ​​processed using a configured graph transformation network to obtain the target adjacency matrix; By using a fusion mechanism, the semantic feature matrix, the risk feature matrix, and the target adjacency matrix are fused and classified to obtain the first threat probability. The semantic feature matrix and the risk feature matrix are concatenated, and the overall scene features are extracted through global pooling. Then, the second threat probability is output through classification processing. The first threat probability and the second threat probability are fused using features. A fusion weight is generated through a weight adaptation mechanism. The two threat probabilities are calculated based on the fusion weight to obtain the target threat score. Specifically, through a fusion mechanism, the semantic feature matrix, the risk feature matrix, and the target adjacency matrix are fused and classified to obtain the first threat probability, including: A gating mechanism is used to fuse the semantic feature matrix and the risk feature matrix: the semantic feature matrix is ​​transformed by a first linear layer and activated by ReLU to obtain semantic transformation features, and the risk feature matrix is ​​transformed by a second linear layer and activated by ReLU to obtain risk transformation features; a gating vector is generated based on the semantic feature matrix and the risk feature matrix; the semantic transformation features and the risk transformation features are weighted and summed using the gating vector to obtain the fused feature matrix; The fused feature matrix, after being processed by Dropout regularization, is input into a graph attention network. Multiple rounds of feature aggregation are then performed in conjunction with the target adjacency matrix: the first-layer graph attention network aggregates local neighborhood information of entities through multi-head attention, and the second-layer graph attention network refines global graph structure information through single-head attention; the output features of the second-layer graph attention network are then subjected to global average pooling along the node dimension to obtain global structural features; these global structural features are input into a fully connected layer, and the output classification logits are then activated by Softmax to obtain the first path threat probability; The semantic feature matrix and the risk feature matrix are concatenated, and after global pooling to extract overall scene features, a second threat probability is output through classification processing, including: The semantic feature matrix and the risk feature matrix are concatenated along the feature dimension to obtain a joint feature matrix; The joint feature matrix is ​​subjected to global average pooling along the node dimension to obtain the overall scene features; The overall scene features are input into a classification network consisting of a linear layer, a ReLU activation layer, a Dropout layer, and an output linear layer. The output classification logits are then activated by Softmax to obtain the second threat probability.

2. The method as described in claim 1, characterized in that, The entities are IP addresses, domain names, and file hash values ​​in the field of network security; the relationships are preset network security associations.

3. The method as described in claim 1, characterized in that, The heterogeneous adjacency matrix is ​​a set of adjacency matrices constructed for different types of entity associations in the knowledge graph; the semantic feature matrix is ​​generated by encoding entity semantic information through a semantic embedding model; and the risk feature matrix is ​​generated by quantifying the entity threat level.

4. The method as described in claim 1, characterized in that, The graph transformation network captures the structural information of multi-hop meta-paths between entities through multi-layer graph transformation operations, outputs a multi-channel meta-path adjacency matrix, and then obtains the target adjacency matrix through channel dimension fusion processing.

5. The method as described in claim 1, characterized in that, The target threat score results are obtained, including: The first threat probability and the second threat probability are concatenated along the feature dimension to obtain the weighted calculation feature; The weight calculation features are input into the weight adaptation network, which is then processed sequentially through a linear layer, a ReLU activation layer, another linear layer, and a Sigmoid activation layer to output the fusion weights with values ​​ranging from 0 to 1. Based on the fusion weights, the target threat score is determined.

6. A threat intelligence scoring device based on semantic and risk features, characterized in that, The device includes: The processing unit is used to process the acquired multi-source heterogeneous threat intelligence data using a semantic analysis model to obtain multiple entities and the relationships between them. The data types of the multi-source heterogeneous threat intelligence data include: operation logs generated by security devices, network traffic capture data, malware-related indicators, and vulnerability-related description texts disclosed by vulnerability platforms. The defining unit is used to define a cybersecurity knowledge graph based on multiple entities and the relationships between them. Furthermore, based on the aforementioned cybersecurity knowledge graph, a heterogeneous adjacency matrix representing entity relationships, a semantic feature matrix representing entity semantic attributes, and a risk feature matrix representing the threat level of entities are determined. The processing unit is further configured to process the heterogeneous adjacency matrix using a configured graph transformation network to obtain a target adjacency matrix. The fusion classification unit is used to perform fusion classification processing on the semantic feature matrix, the risk feature matrix and the target adjacency matrix through a fusion mechanism to obtain the first threat probability; The processing unit is further configured to concatenate the semantic feature matrix and the risk feature matrix, extract the overall scene features through global pooling, and output the second threat probability through classification processing. The calculation unit is used to perform feature fusion on the first threat probability and the second threat probability, generate fusion weights through a weight adaptation mechanism, calculate the two threat probabilities based on the fusion weights, and obtain the target threat score result. Specifically, through a fusion mechanism, the semantic feature matrix, the risk feature matrix, and the target adjacency matrix are fused and classified to obtain the first threat probability, including: A gating mechanism is used to fuse the semantic feature matrix and the risk feature matrix: the semantic feature matrix is ​​transformed by a first linear layer and activated by ReLU to obtain semantic transformation features, and the risk feature matrix is ​​transformed by a second linear layer and activated by ReLU to obtain risk transformation features; a gating vector is generated based on the semantic feature matrix and the risk feature matrix; the semantic transformation features and the risk transformation features are weighted and summed using the gating vector to obtain the fused feature matrix; The fused feature matrix, after being processed by Dropout regularization, is input into a graph attention network. Multiple rounds of feature aggregation are then performed in conjunction with the target adjacency matrix: the first-layer graph attention network aggregates local neighborhood information of entities through multi-head attention, and the second-layer graph attention network refines global graph structure information through single-head attention; the output features of the second-layer graph attention network are then subjected to global average pooling along the node dimension to obtain global structural features; these global structural features are input into a fully connected layer, and the output classification logits are then activated by Softmax to obtain the first path threat probability; The semantic feature matrix and the risk feature matrix are concatenated, and after global pooling to extract overall scene features, a second threat probability is output through classification processing, including: The semantic feature matrix and the risk feature matrix are concatenated along the feature dimension to obtain a joint feature matrix; The joint feature matrix is ​​subjected to global average pooling along the node dimension to obtain the overall scene features; The overall scene features are input into a classification network consisting of a linear layer, a ReLU activation layer, a Dropout layer, and an output linear layer. The output classification logits are then activated by Softmax to obtain the second threat probability.

7. An electronic device, characterized in that, The electronic device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a computer program stored in memory, implements the steps of the method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-5.

Images