Threat intelligence processing method, apparatus, device, medium, and program product

Abstract

The application provides a threat intelligence processing method and device, equipment, medium and program product, relates to the technical field of artificial intelligence, and is used for improving the processing efficiency of high-value intelligence. The specific technical scheme is: receiving N threat intelligence information, and recording the survival time information and the total hit frequency corresponding to each threat intelligence information; obtaining the intelligence utility index corresponding to each threat intelligence information in a predetermined time period, the intelligence utility index including: repeated hit rate, attack chain step correlation degree, resource coverage correlation and variation adaptation capability; determining the target priority of each threat intelligence based on the intelligence utility index, the survival time information and the total hit frequency corresponding to each threat intelligence information; and based on the target priority of the N threat intelligence information, sequentially distributing each threat intelligence information to a corresponding processing unit in a processing unit pool for corresponding processing. The application is applied to the scene of managing and processing threat intelligence information.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a threat intelligence processing method, apparatus, device, medium, and program product. Background Technology

[0002] With the continuous evolution of cyberattack methods and the ever-increasing frequency of attacks, modern system-on-chips (SoCs) are facing unprecedented alarm overload problems. Today, SoC analysts waste an average of 10 hours per week on ineffective troubleshooting and being overwhelmed by false alarms, which affects operational efficiency and may trigger a vicious cycle of "alarm fatigue - missed alarms - delayed response - staff turnover".

[0003] In recent years, with the rapid development of Large Language Model (LLM) and Artificial Intelligence (AI) technologies, a new direction has emerged: using automated models to assist in threat prioritization.

[0004] However, whether based on LLM or traditional machine learning, priority scores are usually assigned based on the "initial assessment" of intelligence, i.e., "one-time score, permanent use". This lack of continuous tracking of the utility lifecycle makes it impossible to accurately reflect the value changes of intelligence in subsequent use, resulting in poor actual processing efficiency of high-priority intelligence. Summary of the Invention

[0005] This application provides a threat intelligence processing method, apparatus, device, medium, and program product to improve the efficiency of processing high-value intelligence.

[0006] In a first aspect, embodiments of this application provide a threat intelligence processing method, which includes: receiving N threat intelligence information and recording the duration and total hit count of each threat intelligence information; obtaining intelligence utility indicators for each threat intelligence information within a predetermined time period, the intelligence utility indicators including: repeat hit rate, attack chain step correlation, resource coverage correlation, and mutation adaptability; the repeat hit rate is used to represent the hit situation of the threat intelligence information in a first historical time period, the attack chain step correlation is the correlation between the attack information of the threat intelligence information and preset intelligence feature information in the predetermined time period, the resource coverage correlation is the similarity between the intelligence information resource tag of the threat intelligence information and local resources, and the mutation adaptability is determined based on the false negative rate of the attack pattern corresponding to the threat intelligence information in a second historical time period; determining the target priority of each threat intelligence based on the intelligence utility indicators, duration and total hit count of each threat intelligence information; and, based on the target priorities of the N threat intelligence information, sequentially allocating each threat intelligence information to the corresponding processing unit in the processing unit pool for corresponding processing.

[0007] The technical solution provided in this application offers at least the following beneficial effects: The threat intelligence processing device can acquire intelligence utility indicators corresponding to threat intelligence information, such as repeat hit rate, attack chain progression correlation, resource coverage correlation, and mutation adaptability, to characterize the real-time utility of threat intelligence from four dimensions, thereby achieving comprehensive quantification of the real-time utility of intelligence. Simultaneously, the threat intelligence processing device can combine the storage time information of threat intelligence information with the total number of hits, that is, it can combine the time aging of threat intelligence information and the penalty for hit counts to accurately reflect the evolution of intelligence value in actual use. In this way, the priority issue of threat intelligence can be elevated from the "static evaluation logic" of "one-time scoring, permanent use" in related technologies to "dynamic orchestration," thereby improving the processing efficiency of high-value intelligence with limited resources.

[0008] One possible implementation involves determining the target priority of each threat intelligence information based on its intelligence utility index, duration information, and total hit count. This includes: determining the timeliness value index of each threat intelligence information by weighted summation based on its repeat hit rate, attack chain progression correlation, resource coverage relevance, and mutation adaptability; determining the decay coefficient of each threat intelligence information based on its duration information and total hit count; and determining the target priority of each threat intelligence information based on its timeliness value index and decay coefficient.

[0009] Another possible implementation involves assigning each threat intelligence message to a corresponding processing unit in the processing unit pool based on the target priority of the N threat intelligence messages. This includes: moving threat intelligence messages with a target priority greater than a preset priority to a first intelligence message queue; and assigning each threat intelligence message in the first intelligence message queue to a corresponding processing unit in the processing unit pool based on the target priority.

[0010] Another possible implementation method for the above threat intelligence processing method includes: moving threat intelligence information with a target priority less than or equal to a preset priority from among N threat intelligence information to a second intelligence information queue; and moving the first threat intelligence information to the first intelligence queue if the target priority of the first threat intelligence information in the second intelligence queue is greater than the preset activation priority.

[0011] Another possible implementation is that receiving N threat intelligence information includes: receiving N raw threat intelligence information from at least one heterogeneous data source; preprocessing the N raw threat intelligence information to obtain N threat intelligence information, wherein the preprocessing includes at least one of the following: deduplication and format processing.

[0012] Secondly, embodiments of this application provide a threat intelligence processing device, including: a receiving module, an acquiring module, a determining module, and a processing module; the receiving module is used to receive N threat intelligence information and record the duration information and total hit count of each threat intelligence information; the acquiring module is used to acquire the intelligence utility index corresponding to each threat intelligence information within a predetermined time period, the intelligence utility index including: repeat hit rate, attack chain step correlation, resource coverage correlation, and mutation adaptability; the repeat hit rate is used to represent the hit situation of threat intelligence information within a first historical time period, and the attack chain step correlation is the correlation between the threat intelligence information and the target threat intelligence information within a predetermined time period. The correlation between attack information and preset intelligence feature information within a time period is defined as follows: the resource coverage correlation is the similarity between the intelligence information resource tag of the threat intelligence information and local resources; the mutation adaptability is determined based on the false negative rate of the attack pattern corresponding to the threat intelligence information in the second historical time period; the determination module is used to determine the target priority of each threat intelligence based on the intelligence utility index, duration information and total hit count of each threat intelligence information acquired by the acquisition module; the processing module is used to allocate each threat intelligence information to the corresponding processing unit in the processing unit pool for corresponding processing based on the target priority of the N threat intelligence information determined by the determination module.

[0013] One possible implementation is that the aforementioned determining module is specifically used to determine the timeliness value index of each threat intelligence information by performing a weighted summation based on the repetition hit rate, attack chain step correlation, resource coverage correlation, and mutation adaptability of each threat intelligence information; and to determine the decay coefficient of each threat intelligence information based on the duration information and total hit count of each threat intelligence information; and to determine the target priority of each threat intelligence information based on the timeliness value index and decay coefficient of each threat intelligence information.

[0014] Another possible implementation is that the above-mentioned processing module is specifically used to move the threat intelligence information with a target priority greater than a preset priority from among the N threat intelligence information to the first intelligence information queue; and based on the target priority, sequentially allocate each threat intelligence information in the first intelligence information queue to the corresponding processing unit in the processing unit pool for corresponding processing.

[0015] In another possible implementation, the above processing module is also used to move the threat intelligence information with a target priority less than or equal to a preset priority from among the N threat intelligence information to the second intelligence information queue; and if the target priority of the first threat intelligence information in the second intelligence queue is greater than the preset activation priority, the first threat intelligence information is moved to the first intelligence queue.

[0016] Another possible implementation is that the receiving module is specifically used to receive N raw threat intelligence information from at least one heterogeneous data source; the processing module is specifically used to preprocess the N raw threat intelligence information to obtain N threat intelligence information, and the preprocessing includes at least one of the following: deduplication and format processing.

[0017] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory stores a program or instructions executable on the processor, wherein the program or instructions, when executed by the processor, implement the method of the first aspect described above.

[0018] Fourthly, this application provides a readable storage medium on which a program or instructions are stored, which, when executed by a computer, implement the method of the first aspect described above.

[0019] Fifthly, this application provides a computer program product stored in a storage medium, which, when executed by a computer, implements the method described in the first aspect.

[0020] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method described in the first aspect.

[0021] The beneficial effects of the second to sixth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0022] Figure 1 A schematic diagram of the network architecture for an application of a threat intelligence processing method provided in this application embodiment;

[0023] Figure 2 A flowchart illustrating a threat intelligence processing method provided in an embodiment of this application;

[0024] Figure 3 A flowchart illustrating another threat intelligence processing method provided in this application embodiment;

[0025] Figure 4 A flowchart illustrating another threat intelligence processing method provided in this application embodiment;

[0026] Figure 5 A flowchart illustrating the implementation process of a threat intelligence processing method provided in this application embodiment;

[0027] Figure 6 This is a schematic diagram of the structure of a threat intelligence processing system provided in an embodiment of this application;

[0028] Figure 7 A schematic diagram of the structure of a threat intelligence processing device provided in an embodiment of this application;

[0029] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] The threat intelligence processing methods, apparatus, equipment, media, and program products provided in this application will now be described in detail with reference to the accompanying drawings.

[0031] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0032] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0033] The terms "at least one," "at least one of," etc., used in the specification and claims of this application refer to any one, any two, or a combination of two or more of the included items. For example, at least one of a, b, and c can mean: "a," "b," "c," "a and b," "a and c," "b and c," and "a, b, and c," where a, b, and c can be single or multiple. Similarly, "at least two" refers to two or more items, and its meaning is similar to that of "at least one."

[0034] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0035] The threat intelligence processing method, apparatus, device, medium, and program product provided in this application embodiment can be applied to scenarios of managing and processing threat intelligence information.

[0036] With the continuous evolution of cyberattack methods and the ever-increasing frequency of attacks, SoCs are facing an unprecedented alarm overload problem. According to authoritative institutions such as Gartner, SoC analysts waste an average of 10 hours per week on ineffective troubleshooting and being overwhelmed by false alarms. This not only directly affects operational efficiency but also triggers a vicious cycle of "alarm fatigue—missed alerts—delayed response—personnel turnover." The core contradiction of this dilemma lies in the fact that the influx of threat intelligence far exceeds the processing capacity of analysts, while existing technologies generally lack dynamism and adaptability in prioritizing intelligence, resulting in a large amount of high-value intelligence being drowned out by the noise of low-value information.

[0037] Currently, threat prioritization tools are often rule-based static systems. The core idea is to predefine a set of rules or scorecards to assign a fixed priority level to intelligence, and then queue all intelligence according to that priority. However, such methods assume that intelligence priorities are static and unchanging; once entered into the database, they are assigned a fixed score, failing to reflect changes in intelligence value during subsequent use. A high-priority Indicators of Compromise (IOCs) may lose value after its first hit, yet the system still keeps it at the top of the queue; conversely, a new attack IOC with a low initial score but recent recurrence cannot be promptly upgraded. Furthermore, these methods rely on manual experience to set rules and thresholds, making rule maintenance extremely costly when the threat environment and asset architecture change.

[0038] Specifically, the threat intelligence lifecycle management method based on a single-dimensional decay model introduces an intelligence aging mechanism. This involves using an exponential decay function or a multinomial decay model to gradually reduce the score of intelligence based on its survival time. When the score falls below a set threshold, it is automatically discarded or archived. Further, a prediction method based on statistical learning is proposed, optimizing the decay parameters according to the observation frequency and source reliability of IOCs to determine the optimal validity period for each piece of intelligence. This approach considers only the impact of a single time dimension on intelligence value.

[0039] In recent years, with the rapid development of large language models and artificial intelligence technologies, a new direction has emerged: using automated models to assist in threat prioritization. However, regardless of whether it is based on LLM or traditional machine learning, the priority scores output by most solutions are still "initial assessments" of intelligence. After the intelligence is processed, its score is not automatically updated based on the actual hit effect or subsequent value decay. In essence, it is still a static logic of "one-time scoring, permanent use," lacking continuous tracking of the utility lifecycle.

[0040] Furthermore, such methods heavily rely on offline model training or periodic inference in LLMs. Once deployed, retraining becomes prohibitively expensive, making it difficult to adapt to real-time, changing threat environments and hindering continuous learning from each intelligence use. Moreover, these technologies generally lack coordination mechanisms with resource scheduling. Priority scoring only addresses the question of "which is more important," but not "how to allocate limited computing and analytical resources to high-value intelligence." The lack of an adaptive closed loop means that the actual processing efficiency of high-priority intelligence is not fundamentally improved.

[0041] To address the aforementioned technical problems, this application provides a threat intelligence processing method, apparatus, device, medium, and program product. The threat intelligence processing apparatus can acquire intelligence utility indicators corresponding to threat intelligence information, such as repeat hit rate, attack chain progression correlation, resource coverage correlation, and mutation adaptability, to characterize the real-time utility of threat intelligence from four dimensions, thereby achieving comprehensive quantification of the real-time utility of intelligence. Simultaneously, the threat intelligence processing apparatus can combine the storage time information of threat intelligence information with the total number of hits, that is, it can combine the time aging of threat intelligence information and the hit count penalty to accurately reflect the evolution of intelligence value in actual use. In this way, the threat intelligence prioritization issue can be elevated from the "static evaluation logic" of "one-time scoring, permanent use" in related technologies to "dynamic orchestration," thereby improving the processing efficiency of high-value intelligence with limited resources.

[0042] The threat intelligence processing methods, apparatus, devices, media, and program products provided in this application will be described in detail below with reference to the accompanying drawings.

[0043] Figure 1 This illustration shows a network architecture for an application of a threat intelligence processing method provided in an embodiment of this application. For example... Figure 1 As shown, the network architecture includes a threat intelligence processing device 101 and a terminal device 102. The threat intelligence processing device 101 and the terminal device 102 are interconnected.

[0044] In some embodiments, the threat intelligence processing device 101 may be a server, a computer, or a processor or processing unit within a server or computer. The server may be a single server or a server cluster consisting of multiple servers. It should be noted that this application embodiment does not limit the specific device form of the threat intelligence processing device 101. Figure 1 The threat intelligence processing device 101 is illustrated as a single server.

[0045] In some embodiments, the terminal device may be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, personal computer (PC), ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., and the embodiments of this application do not specifically limit it. Figure 1 The example shown is a mobile phone, with terminal device 102 as an example.

[0046] In some embodiments, the threat intelligence processing device 101 can receive N threat intelligence information via a terminal device 102 or other means, and record the duration and total hit count of each threat intelligence information. Then, the threat intelligence processing device 101 can obtain intelligence utility indicators for each threat intelligence information within a predetermined time period. These indicators include: repeat hit rate, attack chain progression correlation, resource coverage correlation, and mutation adaptability. The repeat hit rate represents the hit rate of the threat intelligence information within a first historical time period. The attack chain progression correlation is the correlation between the attack information of the threat intelligence information and preset intelligence feature information within the predetermined time period. The resource coverage correlation is the similarity between the intelligence information resource tag of the threat intelligence information and local resources. The mutation adaptability is determined based on the false negative rate of the attack pattern corresponding to the threat intelligence information within a second historical time period. Therefore, the threat intelligence processing device 101 can determine the target priority of each threat intelligence based on its intelligence utility indicators, duration, and total hit count. Based on the target priorities of the N threat intelligence information, each threat intelligence information is sequentially assigned to a corresponding processing unit in the processing unit pool for processing.

[0047] It should be noted that the network architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As network architectures evolve, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0048] See Figure 2 This is a flowchart illustrating a threat intelligence processing method provided in an embodiment of this application. Figure 2As shown, the threat intelligence processing method provided in this application embodiment can be implemented by the aforementioned threat intelligence processing device, specifically including the following steps 201 to 204.

[0049] Step 201: The threat intelligence processing device receives N threat intelligence information and records the duration and total number of hits for each threat intelligence information.

[0050] In some embodiments, the "threat intelligence processing device receives N threat intelligence information" in step 201 above can be specifically implemented through the following steps 201a and 201b.

[0051] Step 201a: The threat intelligence processing device receives N raw threat intelligence information from at least one heterogeneous data source.

[0052] Step 201b: The threat intelligence processing device preprocesses the N original threat intelligence information to obtain N threat intelligence information.

[0053] In some embodiments, the above preprocessing may include, but is not limited to, at least one of the following: deduplication and format processing.

[0054] In some embodiments, the aforementioned heterogeneous data sources may include, but are not limited to, at least one of the following: STIX / TAXII sources, open-source threat intelligence, commercial threat intelligence, and internal alert intelligence generated by security devices.

[0055] In some embodiments, the threat intelligence processing device may receive N raw threat intelligence information from at least one heterogeneous data source via an intelligence access and standardization module.

[0056] In some embodiments, the intelligence access and standardization module described above may have multiple built-in protocol adapters (such as HTTP / HTTPS retrieval, Kafka consumption, Syslog listening) and format converters to uniformly convert intelligence of different formats into standardized internal intelligence objects (including intelligence type, content fields, creation time, associated asset (resource) tags, ATT&CK technical number and other attributes).

[0057] In some embodiments, the intelligence access and standardization module described above may include a deduplication filter to discard intelligence with the same content hash that appears within a short time window (such as 1 hour) to avoid duplicate processing.

[0058] In this way, the threat intelligence processing device can obtain threat intelligence information through at least one means, thereby reducing or avoiding risks caused by the omission of threat intelligence information. Furthermore, the threat intelligence processing device standardizes the received threat intelligence information to facilitate subsequent management of threat intelligence information and improves the convenience of threat intelligence management.

[0059] Understandably, the aforementioned duration information can represent the age of the threat intelligence information.

[0060] In some embodiments, after the threat intelligence processing device can perform deduplication and format unification on the original threat intelligence, the threat intelligence processing device can assign a unique ID to each piece of intelligence, record the creation time t0, initialize the total hit count to 0, set the status to "active", and store it in the time series database.

[0061] It is understandable that when a threat intelligence processing device receives a threat intelligence message for the first time, the receiving time can be used as the initial time t0 of the threat intelligence message, so that the duration information t-t0 can be calculated based on the initial time t0 in the future.

[0062] Step 202: The threat intelligence processing device acquires the intelligence utility index corresponding to each threat intelligence information within a predetermined time period.

[0063] In some embodiments, the threat intelligence processing device may initiate a timed task to read all intelligence objects in an "active" state from the database at intervals of ΔT to perform a priority calculation.

[0064] In some embodiments, the aforementioned intelligence utility metrics may include: repeat hit rate. Attack chain step correlation Resource coverage relevance and adaptability to variation .

[0065] In some embodiments, the aforementioned repeat hit rate It can be used to indicate the hit rate of threat intelligence information within the first historical time period.

[0066] For example, the duration of the first historical time period mentioned above can be 1 hour.

[0067] It should be noted that the duration of the first historical time period mentioned above can be determined according to actual needs, and this embodiment of the application does not limit it here.

[0068] In some embodiments, the above attack chain step correlation It can identify the correlation between threat intelligence information and attack information within a predetermined time period and preset intelligence feature information.

[0069] In some embodiments, the above resource coverage correlation It can be used to compare the similarity between threat intelligence information resource tags and local resources.

[0070] In some embodiments, the above-mentioned ability to adapt to variations The false negative rate can be determined based on the attack pattern corresponding to the threat intelligence information in the second historical time period.

[0071] For example, the duration of the second historical period mentioned above can be 7 days.

[0072] It should be noted that the duration of the aforementioned second historical time period can be determined according to actual needs, and this embodiment of the application does not impose any limitation on it.

[0073] It is understandable that the above-mentioned adaptive capacity... It can be updated on a rolling basis based on historical false negative rates to reflect the intelligence’s adaptability to attack variants.

[0074] In some embodiments, for each piece of threat intelligence, the threat intelligence processing device can obtain the hit count in the past hour from the feedback collector, obtain the shortest path distance between the current attack graph and the intelligence TTP (Tactics, Techniques, and Procedures) from the attack chain tracing service, calculate the Jaccard similarity between the intelligence asset (resource) tag and the local asset (resource) from the asset (resource) database, and calculate the false negative rate of the attack pattern corresponding to the intelligence in the past 7 days from the historical detection success rate table, thereby obtaining... , , and Four values.

[0075] Step 203: The threat intelligence processing device determines the target priority of each threat intelligence based on the intelligence utility index, duration information and total hit count corresponding to each threat intelligence information.

[0076] In some embodiments, combined with Figure 2 ,like Figure 3 As shown, step 203 can be implemented through steps 203a to 203c.

[0077] Step 203a: The threat intelligence processing device performs a weighted summation based on the repetition rate, attack chain progression correlation, resource coverage correlation, and mutation adaptability of each threat intelligence information to determine the timeliness value index of each threat intelligence information.

[0078] In some embodiments, the threat intelligence processing device may determine the timeliness value index of each threat intelligence information by using the following formula (1).

[0079] Formula (1)

[0080] in, , , and The specific requirements can be determined based on actual needs, and the embodiments in this application are not limited herein.

[0081] Step 203b: The threat intelligence processing device determines the attenuation coefficient of each threat intelligence information based on the duration of each threat intelligence information and the total number of hits.

[0082] In some embodiments, the threat intelligence processing device can base its actions on the duration of each threat intelligence message. Total hits The attenuation coefficient of each threat intelligence information is determined by the following formula (2).

[0083] Formula (2)

[0084] in, and It can be configured separately according to intelligence type.

[0085] In some embodiments, the above-mentioned intelligence types may include, but are not limited to, at least one of the following: IOC intelligence, TTP intelligence, threat subject intelligence, and vulnerability intelligence.

[0086] Step 203c: The threat intelligence processing device determines the target priority of each threat intelligence information based on the timeliness value index and decay coefficient of each threat intelligence information.

[0087] In some embodiments, the threat intelligence processing device may determine the target priority of each threat intelligence message using the following formula (3). .

[0088] Formula (3)

[0089] In this way, threat intelligence processing devices can construct a four-dimensional utility index system that includes repeat hit rate, attack chain step correlation, asset coverage correlation, and mutation adaptability, so as to achieve a comprehensive quantification of the real-time utility of intelligence; and can combine time aging with hit count penalty, that is, through a dual decay mechanism, to accurately reflect the evolution of intelligence value in the actual use process; thereby improving the accuracy of priority determination.

[0090] Step 204: Based on the target priority of N threat intelligence information, the threat intelligence processing device sequentially assigns each threat intelligence information to the corresponding processing unit in the processing unit pool for corresponding processing.

[0091] In some embodiments, combined with Figure 2 ,like Figure 4 As shown, step 204 can be implemented through steps 204a and 204b.

[0092] Step 204a: The threat intelligence processing device moves the threat intelligence information with a target priority greater than the preset priority from among the N threat intelligence information to the first intelligence information queue.

[0093] Understandably, the higher the priority, the greater the importance of the threat intelligence information.

[0094] It should be noted that the above-mentioned preset priority (θ_low) setting can be determined according to actual needs, and this application embodiment does not limit it here.

[0095] In some embodiments, the threat intelligence processing device can dynamically adjust the resource limits for different priority ranges using a proportional-integral controller through a resource quota manager. Simultaneously, dynamic upgrade / downgrade triggers can monitor abnormal situations of sudden priority changes to temporarily increase or decrease the scheduling weight of the corresponding intelligence.

[0096] Step 204b: Based on target priority, the threat intelligence processing device sequentially assigns each threat intelligence information in the first intelligence information queue to the corresponding processing unit in the processing unit pool for corresponding processing.

[0097] In some embodiments, the first intelligence information queue described above may be a weighted fair queue.

[0098] Understandably, the threat intelligence processing device can select the intelligence with the highest current weight each time based on the target priority of all threat intelligence information contained in the weighted fair queue, and assign it to the corresponding unit in the processing unit pool for execution, so as to achieve continuous dequeueing of intelligence to be processed.

[0099] In this way, the threat intelligence processing device can determine the threat intelligence information whose target priority is greater than the preset priority based on the relationship between the target priority and the preset priority of the threat intelligence information. That is, it can determine the relatively important threat intelligence information. Then, based on the priority of the relatively important threat intelligence information, it can process them one by one. This can prevent high-value intelligence from being buried in the noise of low-value information and realize the dynamic tilt of computing resources towards high-value intelligence.

[0100] In some embodiments, the above-mentioned processing unit pool may include multiple processing units, and each processing unit is capable of processing a specific type of intelligence.

[0101] In some embodiments, the above processing units may include, but are not limited to, at least one of the following: an IOC matching unit, a TTP association unit, and an asset enrichment unit.

[0102] In some embodiments, the IOC matching unit described above can be used to match Internet Protocol (IP), domain names, file hashes, and log or traffic data.

[0103] In some embodiments, the TTP association unit described above can be used to perform graph matching between the attack technique and the current attack chain.

[0104] In some embodiments, the asset enrichment unit described above can be used to associate asset tags in intelligence with asset information in the Configuration Management Database (CMDB).

[0105] In some embodiments, the threat intelligence processing apparatus may use a scheduler to select appropriate processing units from a pool to perform tasks based on the type of intelligence.

[0106] Understandably, threat intelligence processing devices can allocate CPU time slices and memory resources to each threat intelligence message based on target priority, in order to perform corresponding processing.

[0107] In some embodiments, if a match occurs during processing (e.g., an IOC hit log), the threat intelligence processing device can trigger a feedback event to increase the hit count of the intelligence; at the same time, it updates the last processing timestamp after the intelligence processing is completed.

[0108] The threat intelligence processing method provided in this application allows the threat intelligence processing device to acquire intelligence utility indicators corresponding to threat intelligence information, such as repeat hit rate, attack chain progression correlation, resource coverage correlation, and mutation adaptability, to characterize the real-time utility of threat intelligence from four dimensions, thereby achieving comprehensive quantification of the real-time utility of intelligence. Simultaneously, the threat intelligence processing device can combine the storage time information of threat intelligence information with the total number of hits, that is, it can combine the time aging of threat intelligence information and the penalty for hit counts to accurately reflect the evolution of intelligence value in actual use. In this way, the issue of threat intelligence prioritization can be elevated from the "static evaluation logic" of "one-time scoring, permanent use" in related technologies to "dynamic orchestration," thereby improving the processing efficiency of high-value intelligence with limited resources.

[0109] In some embodiments, in conjunction with the above steps 204a and 204b, the threat intelligence processing method provided in this application embodiment may further include the following steps 301 and 302.

[0110] Step 301: The threat intelligence processing device moves the threat intelligence information with a target priority less than or equal to the preset priority from among the N threat intelligence information to the second intelligence information queue.

[0111] In some embodiments, the threat intelligence processing device can move threat intelligence information with a target priority less than or equal to a preset priority (θ_low) from among N threat intelligence information to a second intelligence information queue (degraded cache) so that it no longer occupies the main computing resources.

[0112] Step 302: If the target priority of the first threat intelligence information in the second intelligence queue is greater than the preset activation priority, the threat intelligence processing device moves the first threat intelligence information to the first intelligence queue.

[0113] In some embodiments, the threat intelligence processing device can check whether there is any intelligence in the downgraded cache whose priority has been raised to above the preset activation priority (θ_activate) due to dynamic weight adjustment. If so, the reactivation can be moved back to the L2 queue (the first intelligence queue).

[0114] In this way, the threat intelligence processing device can determine threat intelligence information whose target priority is less than or equal to the preset priority based on the relationship between the target priority and the preset priority. This means identifying relatively unimportant threat intelligence information and moving it to a second intelligence information queue (a degraded cache) to reduce the consumption of primary computing resources. Simultaneously, the threat intelligence processing device can dynamically allocate computing resources to high-value intelligence by establishing a two-tier scheduling architecture.

[0115] In some embodiments of this application, the threat intelligence processing device may employ a multi-level classification scheduling architecture to divide threat intelligence information into multiple fixed intervals according to their priority values, with each level corresponding to an independent queue. Simultaneously, the scheduler may employ a strict priority SP algorithm, always prioritizing the processing of intelligence in higher-level queues.

[0116] It should be noted that the multi-level classification scheduling architecture described above can be applied to scenarios that are not sensitive to latency but require strict classification.

[0117] In some embodiments, the threat intelligence processing apparatus may receive feedback events tagged by each processing unit and analyst in real time through a feedback collector and store them in a circular buffer.

[0118] In some embodiments, upon completion of each evaluation cycle (ΔT) or when the buffer is full, the threat intelligence processing device can use the model optimizer to retrieve all feedback events within the most recent window and aggregate statistics on the average processing latency, hit rate, false negative rate, etc., for each intelligence.

[0119] In some embodiments, the threat intelligence processing apparatus may use online convex optimization to update the weight coefficients.

[0120] Specifically, the threat intelligence processing device can use an optimizer to calculate the squared error loss between the prediction priority and the actual value, and update the weight coefficients using the Follow the Regularized Leader (FTRL) algorithm. Specifically, the learning rate can be set to 0.01, and the gradient can be calculated based on the most recent 1000 feedback samples.

[0121] In this way, the threat intelligence processing device can utilize feedback events such as the actual hit effect of intelligence, processing delay, and analyst marking to update the weight coefficients of the four-dimensional indicators in real time using online convex optimization. As a result, the threat intelligence processing device does not require manual offline parameter tuning and can automatically adapt to the characteristics of different security operation environments, achieving self-adaptation of the priority model.

[0122] In some embodiments, the threat intelligence processing apparatus may employ a policy gradient method to directly learn the priority scoring function.

[0123] Specifically, the threat intelligence processing device can take the state characteristics of the intelligence as input, use a reinforcement learning framework, treat the scheduler as an intelligent agent, and use the overall response effect after processing the intelligence in each scheduling cycle as a reward signal to train the network parameters.

[0124] It should be noted that, since the above method uses reinforcement learning, it requires more training samples and computational resources compared to online convex optimization for updating weight coefficients.

[0125] In some embodiments, when the threat intelligence processing device calculates a new weighting coefficient, the threat intelligence processing device can issue the new weighting coefficient through the configuration center, and it will take effect in the next evaluation cycle.

[0126] In some embodiments, when a piece of intelligence is prioritized for 24 consecutive hours... When the value is below θ_low and there is no hit feedback, the threat intelligence processing device can mark its status as "archived" and migrate it from the active database to long-term storage or delete it to free up resources.

[0127] The threat intelligence processing method of this application will be described below through specific embodiments. Figure 5The flowchart shown illustrates that the implementation process of the threat intelligence processing method provided in this application embodiment may include the following S1 to S5:

[0128] S1. Intelligence Access and Standardization. The threat intelligence processing device receives raw threat intelligence from multiple sources. After deduplication and format standardization, it assigns a unique ID to each piece of intelligence, records the creation time, initializes the total hit count to 0, sets the status to "active," and stores it in the time-series database.

[0129] S2. Periodic Priority Assessment. The threat intelligence processing unit initiates a timed task, executing the following sub-steps every ΔT time interval:

[0130] S21. Read all intelligence objects whose status is "active" from the database.

[0131] S22. For each piece of intelligence, obtain the hit count in the past hour from the feedback collector, obtain the shortest path distance between the current attack graph and the intelligence TTP from the attack chain tracing service, calculate the Jaccard similarity between the intelligence asset tag and the local asset from the asset database, and calculate the false negative rate of the attack pattern corresponding to the intelligence in the past 7 days from the historical detection success rate table, thereby obtaining... , , and Four values.

[0132] S23. Calculate the timeliness value index based on the current weighting coefficients. .

[0133] S24. Calculate the decay coefficient based on the age t-t0 of intelligence acquisition and the total number of hits HitCount_total. , where λ and σ are configured according to the intelligence type.

[0134] S25. Calculate dynamic priority .

[0135] S26, will Intelligence below the threshold θ_low is exported to the degraded list, and the remaining intelligence is updated with its weight in the priority queue.

[0136] S3, Two-level queue scheduling. The threat intelligence processing unit runs a main scheduling loop:

[0137] S31. Scan the active intelligence every certain period of time, move intelligence whose priority is consistently lower than θ_low to the degraded cache (L1), and check if there is any intelligence in the degraded cache whose priority has been raised to above θ_activate due to dynamic weight adjustment. If so, reactivate it and move it back to the weighted fair queue (L2).

[0138] The S32 and L2 weighted fair queue scheduler continuously dequeues pending intelligence, selecting the intelligence with the highest current weight each time and assigning it to the corresponding unit in the processing unit pool for execution.

[0139] S33. During the processing, if a match occurs (e.g., an IOC hit log), a feedback event is triggered to increase the hit count of the intelligence; at the same time, the last processing timestamp is updated after the intelligence is processed.

[0140] S4. Feedback Collection and Model Optimization.

[0141] S41. The feedback collector receives feedback events marked by each processing unit and analyst in real time and stores them in a circular buffer.

[0142] S42. After each evaluation cycle (ΔT) is completed or the buffer is full, the model optimizer pulls all feedback events in the most recent window and aggregates and calculates the average processing latency, hit rate, and false negative rate for each piece of intelligence.

[0143] S43. The optimizer calculates the squared error loss between the predicted priority and the actual value, and updates the weight coefficients using the FTRL algorithm. The learning rate can be set to 0.01, and the gradient is calculated based on the most recent 1000 feedback samples.

[0144] S44. The new weighting coefficients are issued through the configuration center and will take effect in the next evaluation cycle.

[0145] S5, Intelligence Lifecycle Ends. This occurs when an intelligence item has been prioritized for 24 consecutive hours. When the value is below θ_low and there is no hit feedback, the threat intelligence processing device marks its status as "archived" and migrates it from the active database to long-term storage or deletes it to free up resources.

[0146] Thus, the threat intelligence processing method provided in this application embodiment can achieve the following effects:

[0147] (1) Construct a four-dimensional utility index system that includes repeat hit rate, attack chain step correlation, asset coverage correlation and mutation adaptability to achieve comprehensive quantification of the real-time utility of intelligence.

[0148] (2) Design a dual decay mechanism that combines time aging with hit count penalty to accurately reflect the evolution of intelligence value in real use.

[0149] (3) Establish a two-level scheduling architecture that combines L1 pre-filtering and L2 weighted fair queue to realize the dynamic tilt of computing resources toward high-value intelligence.

[0150] Specifically, the L1 pre-filter automatically downgrades and archives low-value intelligence based on dynamic priority thresholds, freeing up computing resources. The L2 weighted fair queue scheduler uses real-time priority as scheduling weights and employs a weighted fair queue (WFQ) / weighted round-robin (WRR) algorithm to allocate CPU time and memory resources. A state transition mechanism is provided between the two levels, enabling flexible resource management.

[0151] (4) Introduce a feedback loop based on FTRL online convex optimization to enable the priority model to continuously learn from the actual hit effect and automatically optimize the parameters.

[0152] Specifically, the threat intelligence processing device can utilize feedback events such as actual intelligence hit rate, processing delay, and analyst marking to update the weight coefficients of four-dimensional indicators in real time using online convex optimization. This eliminates the need for manual offline parameter tuning and allows the device to automatically adapt to the characteristics of different security operation environments, thus achieving self-adaptation of the priority model.

[0153] In other words, the threat intelligence processing method provided in this application can elevate the threat intelligence priority issue from the "static evaluation logic" of "one-time scoring and permanent use" in related technologies to "dynamic orchestration and adaptive scheduling," thereby solving the problem of low intelligence processing efficiency in SoC, improving the processing efficiency of high-value intelligence with limited resources, and enhancing the level of threat operations.

[0154] It should be noted that the descriptions of each step S1 to S5 in this embodiment can be found in the descriptions in the above embodiments, and will not be repeated here.

[0155] It should be noted that the above-described method embodiments, or the various possible implementations of the method embodiments, can be executed individually, or, provided there is no conflict, they can be combined with each other. The specific implementation can be determined according to actual usage requirements, and this application embodiment does not impose any restrictions on this.

[0156] Figure 6 This is a schematic diagram of the structure of a threat intelligence processing system provided in an embodiment of this application. Figure 6 As shown, the threat intelligence processing system 800 may include: an intelligence access and standardization module 801, an intelligence utility lifecycle assessment module 802, a priority queue and resource orchestration engine 803, an intelligence processing execution unit pool 804, a runtime feedback collector 805, and a model adaptive optimizer 806.

[0157] The intelligence access and standardization module 801 is used to receive raw threat intelligence from multiple heterogeneous data sources, including but not limited to STIX / TAXII sources, open-source threat intelligence, commercial threat intelligence, and internal alerts generated by security devices. This module incorporates multiple protocol adapters (such as HTTP / HTTPS retrieval, Kafka consumption, and Syslog listening) and format converters to uniformly convert intelligence of different formats into standardized internal intelligence objects (including attributes such as intelligence type, content fields, creation time, associated asset tags, and ATT&CK technical IDs). Simultaneously, this module includes a deduplication filter to discard intelligence with the same content hash appearing within a short time window (such as 1 hour), avoiding duplicate processing.

[0158] Intelligence utility lifecycle assessment module 802: Connected to the intelligence access and standardization module 801, it is used to calculate the dynamic priority of each active intelligence piece. This module includes a four-dimensional utility quantification unit, an aging decay calculation unit, and a priority scoring engine. A repeat hit rate is set. Attack chain step correlation Asset Coverage Relevance and adaptability to variation The system comprises four quantitative units: an aging and decay calculation unit that calculates the decay coefficient Decay based on the intelligence's age and total hit count; and a priority scoring engine that combines these results and assigns them to priority scoring units according to their respective dimensions. Outputs dynamic priority values. This module periodically recalculates the priority of all active intelligence.

[0159] Priority queue and resource orchestration engine 803: Connected to the intelligence utility lifecycle assessment module 802, it is responsible for two-stage pipeline scheduling of intelligence based on priority values. It includes an L1 pre-filter, an L2 weighted fair queue scheduler, a resource quota manager, and dynamic upgrade / downgrade triggers. The L1 pre-filter moves intelligence with a priority below a preset threshold θ_low into a degraded cache, preventing it from occupying major computing resources. The L2 scheduler uses a weighted fair queue algorithm, allocating CPU time slices and memory resources based on priority values. The resource quota manager uses a proportional-integral controller to dynamically adjust the resource limits for different priority ranges. The dynamic upgrade / downgrade triggers monitor for abnormal priority changes and temporarily increase or decrease the scheduling weight of the corresponding intelligence.

[0160] Intelligence Processing Execution Unit Pool 804: Contains multiple processing units, each capable of processing a specific type of intelligence. For example, the IOC matching unit matches IP addresses, domain names, and file hashes with log or traffic data; the TTP association unit performs graph matching between attack techniques and the current attack chain; and the asset enrichment unit associates asset tags in the intelligence with asset information in the CMDB. The scheduler selects an appropriate processing unit from the pool to execute the task based on the intelligence type.

[0161] Runtime Feedback Collector 805: This collector is embedded in the intelligence processing execution unit pool and the security analyst's interface to capture feedback events such as the number of times each intelligence report is actually hit, processing time, whether false positives or false negatives occur, and whether new variants appear. Feedback data is written to a circular buffer in the form of structured events and periodically sent in batches to the model adaptive optimizer.

[0162] Model Adaptive Optimizer 806: Connected to the runtime feedback collector 805, it employs an online convex optimization algorithm (FTRL) to dynamically adjust the weight coefficients (α, β, γ, δ) and aging decay parameters (λ, σ) of the four-dimensional utility metrics based on feedback data. The optimizer includes a sliding window statistical unit to calculate the average hit rate, false negative rate, and other metrics over the most recent N feedback cycles. It then updates the model parameters based on the loss function gradient and distributes the updated parameters to the evaluation module via the configuration center, achieving closed-loop adaptation.

[0163] It should be noted that for a detailed explanation of the steps performed by each module and their beneficial effects, please refer to the description in the above embodiments, which will not be repeated here.

[0164] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0165] This application embodiment can divide the threat intelligence processing device into functional modules according to the above method example. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0166] In some embodiments, this application also provides a threat intelligence processing apparatus. The threat intelligence processing apparatus may include one or more functional modules for implementing the threat intelligence processing method of the above method embodiments.

[0167] For example, Figure 7 This is a schematic diagram of a threat intelligence processing device provided in an embodiment of this application. Figure 7 As shown, the threat intelligence processing device 900 includes: a receiving module 901, an acquisition module 902, a determination module 903, and a processing module 904;

[0168] The receiving module 901 is used to receive N threat intelligence information and record the duration and total number of hits for each threat intelligence information.

[0169] The aforementioned acquisition module 902 is used to acquire intelligence utility indicators corresponding to each threat intelligence information within a predetermined time period. These intelligence utility indicators include: repeat hit rate, attack chain progression correlation, resource coverage correlation, and mutation adaptability. The repeat hit rate is used to represent the hit rate of threat intelligence information within a first historical time period. The attack chain progression correlation is the correlation between the attack information of threat intelligence information and preset intelligence feature information within the predetermined time period. The resource coverage correlation is the similarity between the intelligence information resource tags of threat intelligence information and local resources. The mutation adaptability is determined based on the false negative rate of the attack pattern corresponding to the threat intelligence information within a second historical time period.

[0170] The aforementioned determining module 903 is used to determine the target priority of each threat intelligence based on the intelligence utility index, duration information and total hit count corresponding to each threat intelligence information acquired by the acquisition module 902.

[0171] The aforementioned processing module 904 is used to allocate each threat intelligence information to the corresponding processing unit in the processing unit pool for corresponding processing based on the target priority of the N threat intelligence information determined by the determining module 903.

[0172] The threat intelligence processing device provided in this application can acquire intelligence utility indicators corresponding to threat intelligence information, such as repeat hit rate, attack chain progression correlation, resource coverage correlation, and mutation adaptability, to characterize the real-time utility of threat intelligence from four dimensions, thereby achieving comprehensive quantification of the real-time utility of intelligence. Simultaneously, the threat intelligence processing device can combine the storage time information of threat intelligence information with the total number of hits, that is, it can combine the time aging of threat intelligence information and the penalty for hit counts to accurately reflect the evolution of intelligence value in the actual use process. In this way, the issue of threat intelligence prioritization can be elevated from the "static evaluation logic" of "one-time scoring, permanent use" in related technologies to "dynamic orchestration," thereby improving the processing efficiency of high-value intelligence with limited resources.

[0173] In some embodiments, the determining module 903 is specifically used to determine the timeliness value index of each threat intelligence information by performing a weighted summation based on the repeat hit rate, attack chain step correlation, resource coverage correlation, and mutation adaptability of each threat intelligence information; and to determine the decay coefficient of each threat intelligence information based on the duration information and total number of hits of each threat intelligence information; and to determine the target priority of each threat intelligence information based on the timeliness value index and decay coefficient of each threat intelligence information.

[0174] In other embodiments, the processing module 904 is specifically used to move the threat intelligence information with a target priority greater than a preset priority from among the N threat intelligence information to the first intelligence information queue; and based on the target priority, sequentially allocate each threat intelligence information in the first intelligence information queue to the corresponding processing unit in the processing unit pool for corresponding processing.

[0175] In some other embodiments, the processing module 904 is further configured to move the threat intelligence information with a target priority less than or equal to a preset priority from among the N threat intelligence information to the second intelligence information queue; and if the target priority of the first threat intelligence information in the second intelligence queue is greater than the preset activation priority, move the first threat intelligence information to the first intelligence queue.

[0176] In some other embodiments, the receiving module 901 is specifically used to receive N raw threat intelligence information from at least one heterogeneous data source; the processing module 904 is specifically used to preprocess the N raw threat intelligence information to obtain N threat intelligence information, the preprocessing including at least one of the following: deduplication processing and format processing.

[0177] It should be noted that the threat intelligence processing device can implement all the processes implemented in the above method embodiments and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0178] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 8 As shown, the electronic device 90 includes: a processor 92, a communication interface 93, and a bus 94. Optionally, the electronic device 90 may also include a memory 91.

[0179] Processor 92 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0180] Communication interface 93 is used to connect with other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0181] The memory 91 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0182] In one possible implementation, the memory 91 can exist independently of the processor 92. The memory 91 can be connected to the processor 92 via a bus 94 and is used to store instructions or program code. When the processor 92 calls and executes the instructions or program code stored in the memory 91, it can implement the threat intelligence processing method provided in the embodiments of this application.

[0183] In another possible implementation, memory 91 can also be integrated with processor 92.

[0184] Bus 94 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 94 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 8 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0185] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0186] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described threat intelligence processing method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0187] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0188] This application also provides a readable storage medium storing a program or instructions that, when executed by a computer, implement the threat intelligence processing method provided in the above embodiments. It is understood that all or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware; the readable storage medium can be any of the foregoing embodiments or memory; the readable storage medium can also be an external storage device of the service invocation device, such as a plug-in hard drive, SmartMedia Card (SMC), Secure Digital (SD) card, flash card, etc., equipped on the service invocation device. Further, the readable storage medium can include both internal storage units of the service invocation device and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the service invocation device. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0189] This application also provides a computer program product, which is stored in a storage medium and implements the threat intelligence processing method provided in the above embodiments when the computer program product is executed by a computer.

[0190] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0191] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0192] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A threat intelligence processing method, characterized in that, include: Receive N threat intelligence messages and record the duration and total hit count for each threat intelligence message; The intelligence utility index corresponding to each threat intelligence information within a predetermined time period is obtained. The intelligence utility index includes: repeat hit rate, attack chain progression correlation, resource coverage correlation, and mutation adaptability. The repeat hit rate is used to represent the hit rate of threat intelligence information in the first historical time period. The attack chain progression correlation is the correlation between the attack information of threat intelligence information and preset intelligence feature information in the predetermined time period. The resource coverage correlation is the similarity between the intelligence information resource tag of threat intelligence information and local resources. The mutation adaptability is determined based on the false negative rate of the attack pattern corresponding to the threat intelligence information in the second historical time period. Based on the intelligence utility index, the duration information and the total number of hits corresponding to each threat intelligence information, the target priority of each threat intelligence is determined; Based on the target priority of the N threat intelligence information, each threat intelligence information is sequentially assigned to the corresponding processing unit in the processing unit pool for corresponding processing.

2. The threat intelligence processing method according to claim 1, characterized in that, The determination of the target priority for each threat intelligence based on the intelligence utility index, the duration information, and the total number of hits corresponding to each threat intelligence information includes: The timeliness value index of each threat intelligence information is determined by weighted summation based on the repeat hit rate, attack chain step correlation, resource coverage correlation and mutation adaptability of each threat intelligence information; Based on the duration information and the total number of hits for each threat intelligence message, determine the attenuation coefficient for each threat intelligence message; The target priority of each threat intelligence message is determined based on the timeliness value index and the decay coefficient of each threat intelligence message.

3. The threat intelligence processing method according to claim 1, characterized in that, Based on the target priority of the N threat intelligence information, each threat intelligence information is sequentially assigned to a corresponding processing unit in the processing unit pool for corresponding processing, including: Threat intelligence information whose target priority is greater than the preset priority among the N threat intelligence information is moved to the first intelligence information queue; Based on the target priority, each threat intelligence information in the first intelligence information queue is sequentially assigned to the corresponding processing unit in the processing unit pool for corresponding processing.

4. The threat intelligence processing method according to claim 3, characterized in that, The threat intelligence processing method also includes: The threat intelligence information whose target priority is less than or equal to the preset priority among the N threat intelligence information is moved to the second intelligence information queue; If the target priority of the first threat intelligence information in the second intelligence queue is greater than the preset activation priority, the first threat intelligence information is moved to the first intelligence queue.

5. The threat intelligence processing method according to claim 1, characterized in that, The receipt of N threat intelligence messages includes: Receive N raw threat intelligence messages from at least one heterogeneous data source; The N original threat intelligence information is preprocessed to obtain N threat intelligence information. The preprocessing includes at least one of the following: deduplication and format processing.

6. A threat intelligence processing device, characterized in that, include: The module consists of a receiving module, an acquiring module, a determining module, and a processing module. The receiving module is used to receive N threat intelligence information and record the duration and total number of hits for each threat intelligence information. The acquisition module is used to acquire intelligence utility indicators corresponding to each threat intelligence information within a predetermined time period. The intelligence utility indicators include: repeat hit rate, attack chain progression correlation, resource coverage correlation, and mutation adaptability. The repeat hit rate is used to represent the hit rate of threat intelligence information in the first historical time period. The attack chain progression correlation is the correlation between the attack information of threat intelligence information and preset intelligence feature information in the predetermined time period. The resource coverage correlation is the similarity between the intelligence information resource tags of threat intelligence information and local resources. The mutation adaptability is determined based on the false negative rate of the attack pattern corresponding to the threat intelligence information in the second historical time period. The determining module is used to determine the target priority of each threat intelligence based on the intelligence utility index, the duration information and the total number of hits corresponding to each threat intelligence information acquired by the acquiring module. The processing module is used to allocate each threat intelligence information to a corresponding processing unit in the processing unit pool for corresponding processing based on the target priority of the N threat intelligence information determined by the determining module.

7. The threat intelligence processing device according to claim 6, characterized in that, The determining module is specifically used to perform a weighted summation based on the repeat hit rate, attack chain step correlation, resource coverage correlation and mutation adaptability of each threat intelligence information to determine the timeliness value index of each threat intelligence information. Based on the duration of each threat intelligence message and the total number of hits, a decay coefficient for each threat intelligence message is determined. Furthermore, based on the timeliness value index and the decay coefficient of each threat intelligence message, the target priority of each threat intelligence message is determined.

8. The threat intelligence processing device according to claim 6, characterized in that, The processing module is specifically used to move the threat intelligence information with a target priority greater than a preset priority from the N threat intelligence information to the first intelligence information queue; and based on the target priority, sequentially allocate each threat intelligence information in the first intelligence information queue to the corresponding processing unit in the processing unit pool for corresponding processing.

9. The threat intelligence processing device according to claim 8, characterized in that, The processing module is further configured to move threat intelligence information whose target priority is less than or equal to the preset priority from the N threat intelligence information to the second intelligence information queue; and if the target priority of the first threat intelligence information in the second intelligence queue is greater than the preset activation priority, move the first threat intelligence information to the first intelligence queue.

10. The threat intelligence processing device according to claim 6, characterized in that, The receiving module is specifically used to receive N raw threat intelligence information from at least one heterogeneous data source; the processing module is specifically used to preprocess the N raw threat intelligence information to obtain N threat intelligence information, wherein the preprocessing includes at least one of the following: deduplication and format processing.

11. An electronic device, characterized in that, It includes a processor and a memory, the memory storing programs or instructions that can run on the processor, the programs or instructions being executed by the processor to implement the threat intelligence processing method as described in any one of claims 1-5.

12. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a computer, implement the threat intelligence processing method as described in any one of claims 1-5.

13. A computer program product, characterized in that, The computer program product is stored in a storage medium, and when executed by a computer, the computer program product implements the threat intelligence processing method as described in any one of claims 1-5.

Images