Active defense method and system based on threat intelligence

Abstract

The invention relates to the technical field of threat intelligence processing, and discloses an active defense method and system based on threat intelligence, and the method comprises the steps: obtaining a current threat intelligence text, carrying out the deduplication processing of the current threat intelligence text, and obtaining a threat intelligence text after the deduplication processing; acquiring a historical attack event library, mining a strong association rule of the historical attack event library, and establishing a threat relationship network according to the strong association rule of the historical attack event library; matching the threat intelligence text subjected to the deduplication processing with a threat relationship network, and determining a current threat intelligence chain according to a matching result; and obtaining affected asset information corresponding to the current threat intelligence chain, determining a threat level according to the affected asset information, and performing threat early warning according to the threat level. According to the method, the incidence relation between the threat intelligence texts can be quickly and accurately identified, the threat intelligence chain is constructed, the capability of responding to threat intelligence is improved, and the real-time protection performance of network security is effectively improved.

Description

Technical Field

[0001] This application relates to the field of threat intelligence processing technology, and more specifically, to a proactive defense method and system based on threat intelligence. Background Technology

[0002] With the rapid development of cybersecurity technology, cyberattacks have become increasingly complex and diverse, making detection increasingly difficult. To counter these attacks, security professionals actively summarize patterns in cyberattacks and share this knowledge across organizations in the form of Cyber ​​Threat Intelligence (CTI) reports. CTI is a valuable source of information on cyberattacks; these reports describe many aspects of attacks in natural language, and the knowledge contained within them is crucial.

[0003] Existing technologies have weak capabilities in perceiving and tracing threat intelligence, and are mostly limited to isolated analysis of single alarm events, making it difficult to construct a complete attack chain, resulting in poor defense against threat intelligence by the system. Summary of the Invention

[0004] This invention provides a proactive defense method and system based on threat intelligence to address the problem of poor defense effectiveness of threat intelligence in existing technologies, including: The process involves: acquiring the current threat intelligence text, deduplicating it to obtain the deduplicated threat intelligence text; acquiring the historical attack event database, mining strong correlation rules from the database, and establishing a threat relationship network based on these rules; matching the deduplicated threat intelligence text with the threat relationship network, and determining the current threat intelligence chain based on the matching results; acquiring information on affected assets corresponding to the current threat intelligence chain, determining the threat level based on the affected asset information, and issuing a threat warning based on the threat level.

[0005] Furthermore, the deduplication process for the current threat intelligence text includes: preprocessing the threat intelligence text to remove meaningless words and obtain preprocessed threat intelligence text; segmenting the preprocessed threat intelligence text using the jieba word segmentation tool and determining the key words of the threat intelligence text based on the segmentation results; vectorizing the key words of the threat intelligence text using a preset vector algorithm to obtain key word vectors; clustering each threat intelligence text based on the key word vectors; and deduplicating all threat intelligence texts based on the clustering results.

[0006] Furthermore, the clustering of threat intelligence texts based on key word segmentation vectors includes: establishing a sample dataset based on the key word segmentation vectors of each threat intelligence text, setting a value k, and randomly selecting k initial cluster centers from the sample dataset based on the value k; calculating the Euclidean distance between the key word segmentation vectors in the sample dataset and the initial cluster centers, and clustering the threat intelligence texts into the cluster partitions with the closest Euclidean distance to the initial cluster centers; calculating the mean of the sample data in each cluster partition, and resetting new cluster centers based on the mean of the sample data in each cluster partition; repeatedly iterating the new cluster centers until the cluster centers no longer change or the preset maximum number of iterations is reached, to obtain the final cluster partitions of the k threat intelligence texts.

[0007] Furthermore, the step of mining strong association rules from the historical attack event database and establishing a threat relationship network based on these strong association rules includes: acquiring the historical attack event database; determining the threat intelligence data for each historical attack event based on the database; establishing an association dataset based on the threat intelligence data for each historical attack event; standardizing the association dataset; mining frequent itemsets from the standardized association dataset using the Apriori association rule algorithm; determining strong association rules between the threat intelligence data corresponding to each historical attack event based on the frequent itemsets; and establishing a threat relationship network based on the strong association rules between the threat intelligence data corresponding to each historical attack event.

[0008] Furthermore, the step of mining frequent itemsets in the standardized association dataset based on the Apriori association rule algorithm, and determining strong association rules between threat intelligence data corresponding to each historical attack event based on the frequent itemsets in the standardized association dataset, includes: discretizing the standardized association dataset to obtain a discretized association dataset; converting the discretized association dataset into a transactional data format to obtain a transactional association dataset; setting a minimum support threshold and a minimum confidence threshold, and iteratively scanning the transactional association dataset using the Apriori algorithm to generate candidate itemsets; calculating the support of each candidate itemset, and selecting frequent itemsets that meet the minimum support threshold from the candidate itemsets based on the support, and generating association rules based on the frequent itemsets; calculating the confidence of each association rule, and selecting strong association rules that meet the minimum confidence threshold from the association rules based on the confidence.

[0009] Furthermore, the step of establishing a threat relationship network based on strong correlation rules between threat intelligence data corresponding to each historical attack event includes: obtaining strong correlation rules between all threat intelligence data in the historical attack events; determining the threat intelligence data with correlations based on the strong correlation rules; setting each threat intelligence data as a threat intelligence node; making directed connections between the related threat intelligence nodes; and establishing a threat relationship network based on the connection results.

[0010] Furthermore, obtaining the affected asset information corresponding to the current threat intelligence chain includes: determining each historical threat intelligence chain and its corresponding affected asset information based on historical attack events; establishing a training sample set based on the historical threat intelligence chain and its corresponding affected asset information; establishing and training an initial impact assessment model based on the training sample set to obtain a trained impact assessment model; and inputting the current threat intelligence chain into the trained impact assessment model to obtain the current affected asset information.

[0011] Furthermore, determining the threat level based on the affected asset information includes: obtaining the asset type of the affected asset information, setting an impact weight according to the importance of the asset type; obtaining the amount of impact of the affected asset information, multiplying the impact weight by the amount of impact to obtain the risk parameter of the affected asset information, and determining the threat level based on the risk parameter.

[0012] Further, determining the threat level based on risk parameters includes: acquiring preset standard risk parameters, calculating the difference between the risk parameter and the preset standard risk parameters, and determining whether the difference between the risk parameter and the preset standard risk parameters is greater than a first preset threshold; if the difference between the risk parameter and the preset standard risk parameters is greater than the first preset threshold, then setting the first level as the threat level; if the difference between the risk parameter and the preset standard risk parameters is less than or equal to the first preset threshold, determining whether the difference between the risk parameter and the preset standard risk parameters is greater than a second preset threshold; if the difference between the risk parameter and the preset standard risk parameters is greater than the second preset threshold, then setting the second level as the threat level; if the difference between the risk parameter and the preset standard risk parameters is less than or equal to the second preset threshold, then setting the third level as the threat level.

[0013] To achieve the above objectives, the present invention also provides a proactive defense system based on threat intelligence, comprising: The first module is used to acquire the current threat intelligence text, deduplicate it, and obtain the deduplicated threat intelligence text. The second module is used to acquire a historical attack event database, mine strong correlation rules in the database, and establish a threat relationship network based on these rules. The third module is used to match the deduplicated threat intelligence text with the threat relationship network and determine the current threat intelligence chain based on the matching results. The fourth module is used to acquire information on affected assets corresponding to the current threat intelligence chain, determine the threat level based on this information, and issue a threat warning based on the threat level.

[0014] By applying the above technical solutions, this invention can quickly and accurately identify the relationships between threat intelligence texts and construct threat intelligence chains, thereby improving the ability to respond to threat intelligence and effectively enhancing the real-time protection performance of network security. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 The diagram shows an overall flowchart of a proactive defense method based on threat intelligence proposed in an embodiment of the present invention. Figure 2 A schematic diagram of the structure of a proactive defense system based on threat intelligence proposed in an embodiment of the present invention is shown. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] This application provides a proactive defense method based on threat intelligence, such as... Figure 1 As shown, it includes: S101, Obtain the current threat intelligence text, perform deduplication on the current threat intelligence text, and obtain the deduplicated threat intelligence text; In some embodiments of this application, the deduplication process for the current threat intelligence text includes: preprocessing the threat intelligence text to remove meaningless words and obtain a preprocessed threat intelligence text; segmenting the preprocessed threat intelligence text using the jieba word segmentation tool and determining the key words of the threat intelligence text based on the segmentation results; vectorizing the key words of the threat intelligence text using a preset vector algorithm to obtain key word vectors; clustering each threat intelligence text based on the key word vectors; and deduplicating all threat intelligence texts based on the clustering results.

[0019] In this embodiment, since the system captures a large number of threat intelligence texts that are also numerous and disorganized, a clustering method is used to divide threat intelligence texts with high similarity into the same cluster partition and determine the threat intelligence text corresponding to the cluster center as the threat intelligence text of a cluster partition, thereby achieving deduplication of multiple threat intelligence texts.

[0020] In some embodiments of this application, the step of clustering threat intelligence texts based on key word segmentation vectors includes: establishing a sample dataset based on the key word segmentation vectors of each threat intelligence text, setting a value k, and randomly selecting k initial cluster centers in the sample dataset based on the value k; calculating the Euclidean distance between the key word segmentation vectors in the sample dataset and the initial cluster centers, and clustering the threat intelligence texts into the cluster partitions with the closest Euclidean distance to the initial cluster centers; calculating the mean of the sample data in each cluster partition, and resetting new cluster centers based on the mean of the sample data in each cluster partition; repeatedly iterating the new cluster centers until the cluster centers no longer change or the preset maximum number of iterations is reached, to obtain the final cluster partitions of the k threat intelligence texts.

[0021] In this embodiment, the value of k is set to 5. Based on the k-means clustering algorithm, the threat intelligence texts are clustered by key word segmentation vectors, and the threat intelligence texts are divided into 5 clustering partitions.

[0022] S102, Obtain the historical attack event database, mine the strong correlation rules in the historical attack event database, and establish a threat relationship network based on the strong correlation rules in the historical attack event database; In this embodiment, key word vectors corresponding to multiple sets of threat intelligence texts that appear within a preset time period of historical attack events are collected to obtain threat intelligence data and establish a historical attack event database. Threat relationship network between various threat intelligence data is established by mining the strong correlation rules of the historical attack event database.

[0023] In some embodiments of this application, the step of mining strong association rules from a historical attack event database and establishing a threat relationship network based on these strong association rules includes: acquiring a historical attack event database; determining threat intelligence data for each historical attack event based on the database; establishing an association dataset based on the threat intelligence data for each historical attack event; standardizing the association dataset; mining frequent itemsets from the standardized association dataset using the Apriori association rule algorithm; determining strong association rules between the threat intelligence data corresponding to each historical attack event based on the frequent itemsets; and establishing a threat relationship network based on the strong association rules between the threat intelligence data corresponding to each historical attack event.

[0024] In some embodiments of this application, the step of mining frequent itemsets of a standardized association dataset based on the Apriori association rule algorithm, and determining strong association rules between threat intelligence data corresponding to each historical attack event based on the frequent itemsets of the standardized association dataset, includes: discretizing the standardized association dataset to obtain a discretized association dataset; converting the discretized association dataset into a transactional data format to obtain a transactional association dataset; setting a minimum support threshold and a minimum confidence threshold, and iteratively scanning the transactional association dataset using the Apriori algorithm to generate candidate itemsets; calculating the support of each candidate itemset, and selecting frequent itemsets that meet the minimum support threshold from the candidate itemsets based on the support, and generating association rules based on the frequent itemsets; calculating the confidence of each association rule, and selecting strong association rules that meet the minimum confidence threshold from the association rules based on the confidence.

[0025] In this embodiment, threat intelligence data from each historical attack event are statistically analyzed and combined into an associated dataset. Strong association rules are then mined from the standardized associated dataset using the Apriori algorithm.

[0026] In some embodiments of this application, the step of establishing a threat relationship network based on strong correlation rules between threat intelligence data corresponding to each historical attack event includes: obtaining strong correlation rules between all threat intelligence data in the historical attack events; determining threat intelligence data with correlation relationships based on the strong correlation rules; setting each threat intelligence data as a threat intelligence node; performing directed connections between threat intelligence nodes with correlation relationships; and establishing a threat relationship network based on the connection results.

[0027] In this embodiment, two related threat intelligence data are connected in a directed manner according to the order of their appearance in the strong association rules. If the two threat intelligence data have the same order of appearance, they are connected in an undirected manner. A threat relationship network is established based on the connection results of all threat intelligence nodes.

[0028] S103, match the deduplicated threat intelligence text with the threat relationship network, and determine the current threat intelligence chain based on the matching results; In this embodiment, key word vectors are extracted from the deduplicated threat intelligence text. These key word vectors are then connected in a directed manner according to their appearance time; if they appear in the same order, they are connected undirectedly. The connection results are then matched with each threat intelligence node and its corresponding connection in the threat relationship network. The similarity between the connection results and the connection relationships of each threat intelligence node and its corresponding connection in the threat relationship network is calculated. The threat intelligence node and its corresponding connection with the highest similarity is taken as the current threat intelligence chain. It should be noted that if the similarity between the current threat intelligence chain and the connection results is lower than a preset minimum threshold, it indicates that there is no threat at present, and no further threat warning steps are performed.

[0029] S104: Obtain information on affected assets corresponding to the current threat intelligence chain, determine the threat level based on the affected asset information, and issue a threat warning based on the threat level.

[0030] In some embodiments of this application, obtaining the affected asset information corresponding to the current threat intelligence chain includes: determining each historical threat intelligence chain and its corresponding affected asset information based on historical attack events; establishing a training sample set based on the historical threat intelligence chain and its corresponding affected asset information; establishing and training an initial impact assessment model based on the training sample set to obtain a trained impact assessment model; and inputting the current threat intelligence chain into the trained impact assessment model to obtain the current affected asset information.

[0031] In this embodiment, a historical threat intelligence chain composed of strong correlation rules in historical attack events and the corresponding affected asset information are collected. A deep learning neural network model is established and trained using the historical threat intelligence chain and the corresponding affected asset information to obtain a trained impact assessment model and output the current affected asset information corresponding to the current threat intelligence chain.

[0032] In some embodiments of this application, determining the threat level based on the affected asset information includes: obtaining the asset type of the affected asset information, setting an impact weight according to the importance of the asset type; obtaining the amount of impact of the affected asset information, multiplying the impact weight by the amount of impact to obtain the risk parameter of the affected asset information, and determining the threat level based on the risk parameter.

[0033] In this embodiment, the importance of an asset type is determined by an asset type-importance mapping table, the importance is normalized to obtain the impact weight, and the impact amount is determined based on the changes in historical attack events corresponding to the current affected asset information, thereby obtaining risk parameters and determining the threat level.

[0034] In some embodiments of this application, determining the threat level based on risk parameters includes: obtaining preset standard risk parameters, calculating the difference between the risk parameters and the preset standard risk parameters, and determining whether the difference between the risk parameters and the preset standard risk parameters is greater than a first preset threshold; if the difference between the risk parameters and the preset standard risk parameters is greater than the first preset threshold, then setting the first level as the threat level; if the difference between the risk parameters and the preset standard risk parameters is less than or equal to the first preset threshold, determining whether the difference between the risk parameters and the preset standard risk parameters is greater than a second preset threshold; if the difference between the risk parameters and the preset standard risk parameters is greater than the second preset threshold, then setting the second level as the threat level; if the difference between the risk parameters and the preset standard risk parameters is less than or equal to the second preset threshold, then setting the third level as the threat level.

[0035] In this embodiment, the threat level is set by the difference between the risk parameter and the preset standard risk parameter. The larger the difference, the higher the threat level, the greater the threat, and the more urgent the warning situation.

[0036] Based on the same technological concept, such as Figure 2 As shown, the present invention also provides a proactive defense system based on threat intelligence, comprising: The first module is used to acquire the current threat intelligence text, deduplicate it, and obtain the deduplicated threat intelligence text. The second module is used to acquire a historical attack event database, mine strong correlation rules in the database, and establish a threat relationship network based on these rules. The third module is used to match the deduplicated threat intelligence text with the threat relationship network and determine the current threat intelligence chain based on the matching results. The fourth module is used to acquire information on affected assets corresponding to the current threat intelligence chain, determine the threat level based on this information, and issue a threat warning based on the threat level.

[0037] By applying the above technical solutions, this invention obtains current threat intelligence text, performs deduplication on the current threat intelligence text to obtain deduplicated threat intelligence text; acquires a historical attack event database, mines strong correlation rules in the historical attack event database, and establishes a threat relationship network based on the strong correlation rules in the historical attack event database; matches the deduplicated threat intelligence text with the threat relationship network, and determines the current threat intelligence chain based on the matching results; acquires the affected asset information corresponding to the current threat intelligence chain, determines the threat level based on the affected asset information, and issues threat warnings based on the threat level. This invention can quickly and accurately identify the correlation between threat intelligence texts and construct threat intelligence chains, improving the response capability to threat intelligence and effectively enhancing the real-time protection performance of network security.

[0038] Through the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be implemented in hardware or by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) and includes several instructions to cause a computer device (such as a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0039] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A proactive defense method based on threat intelligence, characterized in that, include: Obtain the current threat intelligence text, perform deduplication on the current threat intelligence text, and obtain the deduplicated threat intelligence text; Obtain a database of historical attack events, mine the strong correlation rules in the database, and build a threat relationship network based on the strong correlation rules in the database. The deduplicated threat intelligence text is matched with the threat relationship network, and the current threat intelligence chain is determined based on the matching results; Obtain information on affected assets corresponding to the current threat intelligence chain, determine the threat level based on the affected asset information, and issue threat warnings based on the threat level.

2. The proactive defense method based on threat intelligence according to claim 1, characterized in that, The deduplication process for the current threat intelligence text includes: The threat intelligence text is preprocessed to remove meaningless words, resulting in preprocessed threat intelligence text. The preprocessed threat intelligence text is segmented using the jieba word segmentation tool, and the key words of the threat intelligence text are determined based on the segmentation results. The key words in the threat intelligence text are vectorized according to a preset vector algorithm to obtain key word vectors. The threat intelligence texts are clustered based on key word segmentation vectors, and then deduplicated based on the clustering results.

3. The proactive defense method based on threat intelligence according to claim 2, characterized in that, The clustering of threat intelligence texts based on key word segmentation vectors includes: A sample dataset is established based on the key word segmentation vectors of each threat intelligence text. A value of k is set, and k initial cluster centers of the sample dataset are randomly selected based on the value of k. Calculate the Euclidean distance between the key word vectors in the sample dataset and the initial cluster center, and cluster the threat intelligence texts into the cluster partitions that are closest to the initial cluster center in terms of Euclidean distance; Calculate the mean of the sample data within each cluster partition, and reset the new cluster centers based on the mean of the sample data within each cluster partition; Repeatedly iterate over new cluster centers until the cluster centers no longer change or the preset maximum number of iterations is reached, to obtain the final cluster partitions of k threat intelligence texts.

4. The proactive defense method based on threat intelligence according to claim 1, characterized in that, The process involves mining strong correlation rules from a historical attack event database and establishing a threat relationship network based on these rules, including: Obtain a database of historical attack events, determine the threat intelligence data for each historical attack event based on the database, and establish a related dataset based on the threat intelligence data for each historical attack event. The associated dataset is standardized, and frequent itemsets of the standardized associated dataset are mined based on the Apriori association rule algorithm. Based on the frequent itemsets of the standardized associated dataset, strong association rules between threat intelligence data corresponding to each historical attack event are determined. A threat relationship network is established based on strong correlation rules between threat intelligence data corresponding to each historical attack event.

5. The proactive defense method based on threat intelligence according to claim 4, characterized in that, The method involves mining frequent itemsets from the standardized association dataset using the Apriori association rule algorithm, and determining strong association rules between threat intelligence data corresponding to each historical attack event based on these frequent itemsets. This includes: The standardized associated dataset is discretized to obtain a discretized associated dataset. The discretized associative dataset is transformed into a transactional data format to obtain a transactional associative dataset; Set minimum support threshold and minimum confidence threshold, and use the Apriori algorithm to iteratively scan the transactional association dataset to generate a candidate set; Calculate the support of each candidate itemset, and select frequent itemsets that meet the minimum support threshold from the candidate itemsets based on the support. Generate association rules based on the frequent itemsets. Calculate the confidence score of each association rule, and then filter out the strong association rules that meet the minimum confidence score threshold based on the confidence score.

6. The proactive defense method based on threat intelligence according to claim 4, characterized in that, The establishment of a threat relationship network based on strong correlation rules between threat intelligence data corresponding to each historical attack event includes: Obtain strong correlation rules among all threat intelligence data in historical attack events, and determine the related threat intelligence data based on the strong correlation rules; Each threat intelligence data point is designated as a threat intelligence node. Related threat intelligence nodes are connected in a directed manner, and a threat relationship network is established based on the connection results.

7. The proactive defense method based on threat intelligence according to claim 1, characterized in that, The acquisition of affected asset information corresponding to the current threat intelligence chain includes: Based on historical attack events, identify each historical threat intelligence chain and the corresponding affected asset information, and establish a training sample set based on the historical threat intelligence chains and the corresponding affected asset information; An initial impact assessment model is established and trained based on the training sample set, resulting in a well-trained impact assessment model. Input the current threat intelligence chain into the trained impact assessment model to obtain information on currently affected assets.

8. The proactive defense method based on threat intelligence according to claim 1, characterized in that, The determination of threat level based on affected asset information includes: The types of assets whose information is affected are identified, and their impact weights are assigned based on the importance of each asset type. The impact amount of the affected asset information is obtained, the impact weight is multiplied by the impact amount to obtain the risk parameter of the affected asset information, and the threat level is determined based on the risk parameter.

9. The proactive defense method based on threat intelligence according to claim 8, characterized in that, The determination of threat level based on risk parameters includes: Obtain the preset standard risk parameter, calculate the difference between the risk parameter and the preset standard risk parameter, and determine whether the difference between the risk parameter and the preset standard risk parameter is greater than the first preset threshold. If the difference between the risk parameter and the preset standard risk parameter is greater than the first preset threshold, then the first level is set as the threat level. If the difference between the risk parameter and the preset standard risk parameter is less than or equal to the first preset threshold, determine whether the difference between the risk parameter and the preset standard risk parameter is greater than the second preset threshold. If the difference between the risk parameter and the preset standard risk parameter is greater than the second preset threshold, then the second level will be set as the threat level. If the difference between the risk parameter and the preset standard risk parameter is less than or equal to the second preset threshold, then the third level is set as the threat level.

10. A proactive defense system based on threat intelligence, characterized in that, include: The first module is used to obtain the current threat intelligence text, perform deduplication on the current threat intelligence text, and obtain the deduplicated threat intelligence text. The second module is used to obtain a historical attack event database, mine strong correlation rules in the historical attack event database, and establish a threat relationship network based on the strong correlation rules in the historical attack event database. The third module is used to match the deduplicated threat intelligence text with the threat relationship network, and determine the current threat intelligence chain based on the matching results; The fourth module is used to obtain information on affected assets corresponding to the current threat intelligence chain, determine the threat level based on the affected asset information, and issue threat warnings based on the threat level.

Images