A threat intelligence map incentive mechanism based on a reference map

Abstract

The application discloses a threat intelligence map incentive mechanism based on a reference graph, and belongs to the field of network security, threat intelligence collaboration and contribution incentive. The mechanism receives intelligence nodes, associates front intelligence to build a directed reference graph representing logical dependence; relies on CVSS score to complete intelligence difficulty pricing, and implements instant incentive for high-difficulty first intelligence. When the intelligence set forms an attack chain closed loop, a dynamic credit pool is built, a value function is established in combination with attack stage coverage, graph connectivity and evidence confidence, and Shapley Value is used to calculate node basic contribution; then, in combination with the number of times of being cited and submission delay, a correction factor is generated, and each node delay profit sharing is obtained through normalization. The application can alleviate the fragmentation problem of threat intelligence, solve the problems of missing early-stage basic clue benefits and high-risk first intelligence incentive lag, and rely on audit snapshots to guarantee that the settlement process is traceable and interpretable.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, specifically to a threat intelligence collaboration and incentive method, and in particular to a threat intelligence map incentive mechanism based on directed citation graphs, dual-track incentives, Shapley contribution calculation, citation time correction, and audit snapshots. Background Technology

[0002] Threat intelligence is a crucial data resource in cybersecurity defense systems, used to describe the relationships between attackers, attack infrastructure, attack samples, exploits, attack tactics, victim assets, and attack activities. As attack patterns such as advanced persistent threats, ransomware, supply chain attacks, and zero-day exploits continue to evolve, a single organization or researcher can often only observe partial fragments of the attack chain, such as a suspicious IP address, a domain name, a file hash, an exploit snippet, a command and control address, a phishing template, or a log of attack behavior.

[0003] Existing threat intelligence sharing platforms typically reward individuals with single intelligence reports, final reports, or manual review results. While this approach can incentivize intelligence submissions to some extent, it remains significantly insufficient in collaborative scenarios involving complex attack chains.

[0004] First, existing systems struggle to express the logical dependencies between intelligence fragments. A large amount of threat intelligence exists as isolated entries, lacking explicit contextual, extensibility, and verification relationships. This makes it impossible for the platform to determine which prior clues a new intelligence piece is based on, or to assess the role a particular early clue played in reconstructing the subsequent attack chain.

[0005] Secondly, the existing incentive mechanism is prone to bias towards the final contributor. As the attack chain is gradually pieced together, the person who submits the key clues last is often more likely to gain the platform's attention and benefits, while contributors who submit basic IPs, sample hashes, vulnerability traces, or initial access clues early on, even if their clues are frequently used in subsequent research, find it difficult to obtain a reasonable share of the final commercial value.

[0006] Furthermore, the existing reward system struggles to balance the immediacy of high-risk initial intelligence with the time-delayed value of a complete attack chain. High-risk vulnerability exploits, unpublished payloads, or high-confidence attack samples have significant time-sensitive value. If rewards are only given after the attack chain is fully closed, it may reduce researchers' incentive to submit them immediately. However, rewarding only a single piece of high-risk intelligence immediately fails to reflect its continued reference value in subsequent intelligence maps.

[0007] Furthermore, existing allocation mechanisms lack an objective and verifiable contribution calculation process. Manual pricing and fixed-ratio allocation struggle to account for differences in contributions from different intelligence nodes; simple average allocation, on the other hand, leads to low-quality nodes free-riding, diminishing the incentive for high-quality contributors. Therefore, there is an urgent need for a technical solution that integrates threat intelligence map construction, citation tracking, objective difficulty pricing, immediate incentives, delayed bonuses, contribution calculation, time correction, and audit evidence storage. Summary of the Invention

[0008] The purpose of this invention is to provide a threat intelligence map incentive mechanism based on a citation graph, which aims to overcome the shortcomings of existing technologies such as the difficulty in piecing together fragmented threat intelligence, the difficulty in obtaining traceable benefits from early basic clues, the lag in incentives for high-risk first-release intelligence, and the lack of interpretability in the incentive allocation process. By constructing a directed citation graph and a dual-track dynamic bonus distribution process, the invention achieves traceability, calculability, and auditability of collaborative contributions to threat intelligence.

[0009] To achieve the above objectives, the present invention provides the following technical solution: a threat intelligence map incentive mechanism based on a reference map, comprising the following steps:

[0010] S1.1: Receive threat intelligence nodes submitted by researchers and record basic node information, attack phase, evidence materials, confidence level, security score vector, upstream first discovery time and novelty parameters;

[0011] S1.2: Retrieve candidate predecessor nodes based on the key features of the new node, and receive researchers' citation selections for the candidate predecessor nodes;

[0012] S1.3: Generate directed reference edges based on the reference selection, construct a threat intelligence reference graph, and calculate the reference set, referenced set, and reference count of each node;

[0013] S1.4: Calculate the node difficulty integral based on CVSS v4.0 or an equivalent security scoring standard, and apply immediate incentives to high-difficulty nodes;

[0014] S1.5: Determine whether the threat intelligence map forms a closed loop of attack chain based on the attack phase coverage, reference graph connectivity, and number of effective nodes;

[0015] S1.6: After the attack chain is closed, a dynamic total score pool is generated based on the difficulty scores of the points involved in the closure.

[0016] S1.7: Construct a value function based on attack phase coverage, reference graph connectivity, and evidence confidence, and use Shapley Value to calculate the basic contribution of each node;

[0017] S1.8: Calculate the citation and time correction factors based on the number of citations and commit latency of each node;

[0018] S1.9: Normalize the corrected contribution value to obtain the final delayed dividend result;

[0019] S1.10: Generate an audit snapshot and display or submit it to a trusted audit system.

[0020] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0021] 1. This invention organizes scattered threat intelligence nodes into a traceable threat intelligence map through a directed reference graph, enabling the system to clearly record which prior clues new intelligence is based on, and which early nodes are continuously used by subsequent attack chains.

[0022] 2. This invention employs a dual-track incentive mechanism to balance the value of high-risk initial intelligence and the closed-loop value of a complete attack chain. High-difficulty nodes can trigger immediate incentives, while all valid nodes participate in delayed profit sharing after the attack chain is closed.

[0023] 3. This invention uses CVSS v4.0 or an equivalent security scoring standard for difficulty pricing, reducing inconsistencies caused by subjective human pricing and enabling different types of threat intelligence to be mapped to a unified technical value scale.

[0024] 4. This invention introduces the marginal contribution of Shapley Value calculation nodes to the threat intelligence map closed loop, so that the dividend results are related to attack phase coverage, map connectivity and evidence confidence, avoiding the free-rider problem caused by simple average distribution.

[0025] 5. This invention introduces a logarithmic gain mechanism based on the number of citations, enabling early basic clues that are frequently cited in subsequent studies to obtain retrospective benefits. At the same time, the logarithmic function limits the growth of benefits and reduces the impact of citation spamming on the allocation results.

[0026] 6. This invention introduces an exponential decay mechanism for submission delay, which makes effective intelligence submitted earlier have higher timeliness value and encourages researchers to disclose threat clues in a timely manner; the exponential decay term is always positive, avoiding the problem of negative benefits caused by linear penalties.

[0027] 7. This invention ensures that the final total amount distributed equals the dynamic total points pool by using a normalized dividend formula. This allows the reference gain and time decay to only change the relative proportions between nodes without changing the total pool size, which facilitates platform budget control and audit review.

[0028] 8. This invention can generate formula trajectories, parameter snapshots, node snapshots, reference edge snapshots, and settlement result snapshots, and submit them to the blockchain or a trusted auditing system, making the reward process transparent, explainable, and traceable. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0030] Figure 1 This is a flowchart of the threat intelligence map incentive mechanism method based on reference graphs of the present invention.

[0031] Figure 2 This is a schematic diagram of the threat intelligence reference map structure of the present invention.

[0032] Figure 3 This is a flowchart of the dual-track excitation and delayed dividend calculation of the present invention.

[0033] Figure 4 This is a schematic diagram of the settlement audit snapshot structure of the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the scope of protection of the present invention.

[0035] like Figure 1 As shown in the figure, the threat intelligence map incentive mechanism based on reference graphs described in this embodiment includes the following steps.

[0036] In some embodiments, the process of performing step S1.1 includes:

[0037] S1.1.1: The system receives threat intelligence nodes submitted by researchers and generates a unique identifier for each node. Nodes can represent IP addresses, domain names, file hashes, attack samples, exploit fragments, payloads, attack techniques and tactics, evidence of attack phases, sample analysis reports, or other threat clues.

[0038] S1.1.2: The system records the submitter's identity, submitter's display name, submission time, node status, intelligence title, intelligence type, and attack phase of the node. The attack phase can be the ATT&CK phase, the kill chain phase, or a platform-defined phase.

[0039] S1.1.3: The system records the evidence materials and confidence level corresponding to the node. Evidence materials may include sandbox logs, traffic evidence, vulnerability verification code, reproduction steps, sample analysis reports, or third-party sources.

[0040] S1.1.4: The system records the node's security score vector, upstream first discovery time, and novelty parameter. The security score vector is used to calculate the node's difficulty integral, the upstream first discovery time is used to calculate the submission latency, and the novelty parameter is used to calculate the immediate incentive.

[0041] In some embodiments, the execution of steps S1.2 and S1.3 includes:

[0042] S1.2.1: The system retrieves candidate preceding nodes from the existing node database based on the keywords, attack stage, attacker identifier, asset identifier, sample characteristics, tag information, or historical node relationships of the newly submitted node.

[0043] S1.2.2: Researchers select one or more cited nodes from the candidate preceding nodes and fill in the citation relationship type and reason for citation. The citation relationship type may include dependency, extension, verification, same attacker, or same attack activity.

[0044] S1.3.1: As Figure 2 As shown, the system generates directed reference edges based on the reference selection. Each reference edge includes the new node that initiates the reference, the predecessor node that is referenced, the reference relationship type, the reason for the reference, the reference confidence, the creation time, and the creator.

[0045] S1.3.2: System builds threat intelligence reference map: Where V represents the set of threat intelligence nodes, E represents the set of reference edges, and reference edge e=(u,v) indicates that the new node u references the previous node v;

[0046] S1.3.3: The system performs citation statistics for each node. For node i, its citation set, cited set, and citation count are as follows: Where References(i) represents the set of preceding nodes referenced by node i, CitedBy(i) represents the set of subsequent nodes referencing node i, and Cᵢ represents the number of times node i is cited. The larger Cᵢ is, the more times node i is cited in subsequent research.

[0047] like Figure 3As shown, in some embodiments, the process of performing step S1.4 includes:

[0048] S1.4.1: The system uses CVSS v4.0 or an equivalent security scoring standard to price the difficulty of nodes. Let the score of node i be CVSSᵢ, and CVSSᵢ∈[0,10].

[0049] S1.4.2: The system maps the score to a difficulty score: The value range of Score(i) is [0, 100].

[0050] S1.4.3: The system classifies difficulty levels according to thresholds:

[0051] S1.4.4: When a node satisfies CVSSᵢ≥ highThreshold, the system triggers an immediate stimulus. The formula for calculating the immediate stimulus is: Where Iᵢ represents the immediate reward of node i; Ibase represents the base immediate reward; Wᵢ represents the dynamic node weight; and σᵢ represents the novelty and timeliness coefficient. For newly discovered traces of new APT variants, undisclosed 0-day payloads, or high-confidence high-risk vulnerability exploit nodes, σᵢ can be set to [1.5, 2.0]; for supplementary analysis or regular in-depth analysis nodes of known high-risk threats, σᵢ can be set to [0.5, 1.0].

[0052] S1.4.5: The system calculates dynamic node weights based on repetition rate, evidence quality, and confidence level. Where Fᵢ represents the feature set of node i, Fknown represents the feature set of the existing threat intelligence on the platform; overlapRateᵢ represents the duplication rate, with a value range of [0,1]; deduplicationFactorᵢ represents the deduplication factor, with a higher deduplication factor for a lower duplication rate; 1(sandboxLog,i), 1(trafficCapture,i), 1(PoC,i), and 1(reproductionSteps,i) are all indicator variables, taking the value 1 when there is corresponding evidence, and 0 otherwise; confidenceᵢ represents the confidence level of the evidence, with a value range of [0,1].

[0053] The clamp(x,l,u) function is defined as follows:

[0054] Therefore, Wᵢ is restricted to the range [0.2,2] to avoid distortion of immediate rewards caused by a single factor anomaly.

[0055] In some embodiments, the execution of steps S1.5 and S1.6 includes:

[0056] S1.5.1: The system obtains the set of audited nodes A, the set of target attack stages R, and the set of attack stages covered by the node set Covered(A).

[0057] S1.5.2: System calculates attack phase coverage: Where Covered(A) represents the set of attack stages covered by the audited node set A, R represents the target attack stage set, and coverage represents the coverage ratio of the target attack stage in the current threat intelligence map.

[0058] S1.5.3: The system determines whether the attack chain is closed-loop: Here, `connectedNodeCount` represents the number of valid nodes connected via reference edges. This condition is used to prevent isolated thread sets from being incorrectly settled.

[0059] S1.6.1: When closed=true, the system obtains the set of nodes N={1,2,…,n} that participate in the closed loop.

[0060] S1.6.2: System calculates dynamic total integral pool: Where Ptotal represents the dynamic total score pool of the closed-loop threat intelligence map, N represents the set of nodes participating in the closed loop, and Score(i) represents the difficulty score of node i.

[0061] In some embodiments, the process of performing step S1.7 includes:

[0062] S1.7.1: The system defines the value function of a subset S of nodes: in: Where S represents any subset of nodes participating in the computation; stageCoverage(S) represents the coverage ratio of the node subset S to the target attack stage set R; graphConnectivity(S) represents the ratio of the number of reference edges within the node subset S to the number of minimum connected edges; E_S represents the set of reference edges formed within the node subset S; and averageConfidence(S) represents the average confidence of evidence for all nodes in the node subset S. The values ​​0.5, 0.3, and 0.2 in the value function represent the weights of attack stage coverage, reference graph connectivity, and average confidence of evidence, respectively.

[0063] S1.7.2: The system uses Shapley Value to calculate the basic contribution ratio of node i: Where φᵢ(v) represents the Shapley contribution ratio of node i; N represents the entire set of nodes participating in the loop closure; S represents any subset of nodes that does not contain node i; |S|!(|N|-|S|-1)! / |N|! represents the combined weight of the subset in all possible splicing orders; v(S∪{i})-v(S) represents the marginal value increment brought by node i after being added to subset S.

[0064] S1.7.3: The fundamental integral of system computation node i: Where Bᵢ represents the basic integral of node i before reference and time correction.

[0065] In some embodiments, the execution of steps S1.8 and S1.9 includes:

[0066] S1.8.1: The system calculates the submission delay time Δtᵢ of node i, where the submission delay time is the time difference between the node's submission time and the upstream's first discovery time. Where createdAtᵢ represents the submission timestamp of node i, upstreamFirstSeenAtᵢ represents the first discovery timestamp of the upstream event or preceding clue corresponding to node i, and 86400 represents the number of seconds in a day.

[0067] S1.8.2: The system calculates the correction factor based on the number of citations and the submission delay time. Where λ is the citation gain parameter and γ is the time decay parameter. The more times a file is cited, the greater the logarithmic gain; the later the submission, the more pronounced the exponential decay.

[0068] This correction factor can be broken down into: Among them, citationBoostᵢ represents the citation gain term, which is used to increase the benefit of basic clues that are frequently cited by subsequent nodes; timePenaltyᵢ represents the time decay term, with a value range of (0,1], which is used to express the timeliness value of threat intelligence as time goes by.

[0069] S1.8.3: Weighted contribution of system computing node i: Where W′ᵢ represents the weighted contribution of node i after reference and time correction.

[0070] S1.9.1: The system normalizes the weighted contributions to obtain the final delayed dividend: Where Z represents the weighted sum of contributions from all closed-loop nodes. Equivalent land: Here, finalᵢ represents the final delayed dividend for node i.

[0071] S1.9.2: The system ensures that the final total dividend amount equals the dynamic total integral pool through normalization constraints.

[0072] In some specific embodiments, it is assumed that a threat intelligence map consists of nodes A, B, C, and D, forming a closed loop attack chain through referencing relationships. Node A is a brand new 0-day payload with a CVSS score of 8.5, referenced 3 times by subsequent nodes, and has a submission latency of 0 days; node D is a suspicious domain with a CVSS score of 4.5, has been referenced 0 times, and has a submission latency of 15 days. If λ=0.5 and γ=0.05, then the correction factor for node A is:

[0073] The correction factor for node D is:

[0074] This example demonstrates that source nodes that are referenced multiple times in the early stages can obtain a reference premium, while end nodes that are delayed and not referenced will be affected by time decay, but can still obtain closed-loop dividends based on their Shapley base contribution.

[0075] In some embodiments, during the execution of step S1.10, such as Figure 4 As shown, the system generates an audit snapshot. This audit snapshot includes settlement identifiers, threat intelligence map identifiers, node snapshots, reference edge snapshots, contributor list, instant reward results, delayed dividend results, formula parameters, calculation trajectory, generation time, and status information. The system can display the audit snapshot on the dividend dashboard or submit it to a blockchain, consortium blockchain, trusted timestamp system, tamper-proof log system, or database audit table for subsequent review.

[0076] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," and "specific embodiment" indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment is included in at least one embodiment of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments.

[0077] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to specific implementations. Clearly, many modifications and variations can be made based on the content of this specification. These embodiments have been selected and specifically described in this specification to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A threat intelligence map incentive mechanism based on reference graphs, characterized in that, The incentive mechanism includes the following steps: S1.1: Receive threat intelligence nodes submitted by researchers and record the submitter's identity, submission time, intelligence type, attack stage, evidence materials, confidence level, security score information, upstream first discovery time and novelty parameters of the threat intelligence nodes; S1.2: Based on the key characteristics of the threat intelligence nodes, search for candidate front nodes in the existing threat intelligence node database, and receive researchers' selection of references for the candidate front nodes; S1.3: Generate directed reference edges based on the reference selection, construct a threat intelligence reference graph consisting of a set of threat intelligence nodes and a set of reference edges, and count the reference relationships and reference status of each threat intelligence node; S1.4: Determine the difficulty information of each threat intelligence node according to the preset security scoring standard or equivalent security scoring model, and determine whether the newly submitted threat intelligence node meets the high difficulty immediate incentive conditions; if it does, generate the immediate reward result based on the basic immediate reward, dynamic node weight and novelty parameters. S1.5: Based on the attack phases covered by the threat intelligence nodes, the connectivity of the reference graph, and the number of effective nodes, determine whether the current threat intelligence map forms a closed loop of the attack chain; S1.6: When an attack chain loop is formed, a dynamic total score pool is generated based on the difficulty information of the threat intelligence nodes participating in the loop. S1.7: Contribution evaluation indicators are constructed based on attack phase coverage, reference graph connectivity, and evidence confidence, and a marginal contribution allocation algorithm is used to determine the basic contribution of each threat intelligence node to the attack chain loop. S1.8: Generate citation and time correction factors based on the number of times each threat intelligence node is cited and the submission delay time, and correct the basic contribution. S1.9: Normalize the corrected contribution values ​​to obtain the final delayed bonus distribution results for each threat intelligence node; S1.10: Generate an audit snapshot containing node snapshots, reference edge snapshots, calculation parameters, calculation trajectories, immediate reward results, and delayed dividend results, and display or submit the audit snapshot to the trusted audit system.

2. The mechanism according to claim 1, characterized in that, Step S1.1 includes the following sub-steps: S2.1: Assign a unique node identifier to each threat intelligence node and record the submitter identifier, submitter display name, node submission time, node status, intelligence title, and intelligence type; S2.2: Record the attack stage, evidence materials, and evidence confidence level corresponding to the threat intelligence node. The attack stage includes at least one of the kill chain stage, ATT&CK stage, or platform-customized attack stage. S2.3: Record the security score information, upstream first discovery time, and novelty parameter of the threat intelligence node, wherein the security score information is used to determine the node difficulty, the upstream first discovery time is used to determine the submission delay, and the novelty parameter is used to determine the immediate incentive.

3. The mechanism according to claim 1, characterized in that, Step S1.2 includes the following sub-steps: S3.1: Extract at least one retrieval feature from newly submitted threat intelligence nodes, including keywords, attack phase, attacker identifier, asset identifier, sample features, tag information, or historical node relationships; S3.2: Based on the search features, retrieve candidate front nodes in the existing threat intelligence node database, and generate a candidate list according to at least one of the following conditions: relevance, time order, evidence confidence, or node status. S3.3: Receive the researcher's citation selection of candidate predecessor nodes and record the citation relationship type, citation reason, citation confidence, creation time and creator.

4. The mechanism according to claim 1, characterized in that, Step S1.3 includes the following sub-steps: S4.1: Generate directed reference edges based on the researcher's citation selection. The directed reference edges include the new threat intelligence node that initiates the citation, the preceding threat intelligence node that is being cited, and the citation relationship attribute. S4.2: Construct a threat intelligence reference graph based on the threat intelligence node set and the directed reference edge set. The reference graph is used to express the dependency, extension, verification, homology or homoactivity relationship of new nodes to previous nodes. S4.3: Perform citation statistics on the threat intelligence citation graph to obtain the preceding nodes cited by each node, the subsequent nodes that cite that node, and the number of times that node is cited by subsequent nodes.

5. The mechanism according to claim 1, characterized in that, Step S1.4 includes the following sub-steps: S5.1: Price the difficulty of threat intelligence nodes based on preset security scoring standards or equivalent security scoring models, and map the scoring results to node difficulty information; S5.2: Determine whether to trigger high-difficulty instant incentive based on node difficulty information and preset high-difficulty threshold. Nodes below the high-difficulty threshold will not trigger instant incentive but will retain the qualification to participate in the delayed profit sharing after the closed loop. S5.3: For nodes that trigger immediate incentives, generate immediate reward results by combining the basic immediate reward, the dynamic node weights obtained from the repetition rate, evidence quality, and evidence confidence, and the novelty parameter.

6. The mechanism according to claim 1, characterized in that, Step S1.5 includes the following sub-steps: S6.1: Obtain the set of audited threat intelligence nodes, the set of target attack stages, the set of attack stages covered by the node set, and the reference edge connection relationships; S6.2: Based on the coverage of the attack phase, the number of audited nodes, and the number of valid nodes connected through reference edges, the closed-loop judgment criteria for the current threat intelligence map are obtained; S6.3: When the closed-loop judgment criteria meet the preset attack stage coverage conditions, preset node size conditions, and preset reference connectivity conditions, it is determined that the current threat intelligence map forms an attack chain closed loop.

7. The mechanism according to claim 1, characterized in that, Step S1.6 includes the following sub-steps: S7.1: After the attack chain is closed, determine the set of threat intelligence nodes participating in this closed-loop settlement and exclude nodes that have not passed the review or have not met the validity conditions; S7.2: Summarize the difficulty information of participating in the closed-loop process and generate a dynamic total points pool for delayed dividends; S7.3: Record the node composition, difficulty source, generation time, and settlement identifier corresponding to the dynamic total points pool for subsequent allocation and auditing.

8. The mechanism according to claim 1, characterized in that, Step S1.7 includes the following sub-steps: S8.1: Construct contribution evaluation metrics for evaluating the contribution of node sets based on attack phase coverage, reference graph connectivity, and evidence confidence. S8.2: Employ a marginal contribution allocation algorithm to compare the contribution changes of threat intelligence nodes before and after adding different node combinations, and determine the basic contribution ratio of each threat intelligence node to the attack chain closed loop. S8.3: Based on the aforementioned basic contribution ratio and dynamic total integration pool, obtain the basic contribution value of each threat intelligence node before citation and time correction.

9. The mechanism according to claim 1, characterized in that, Step S1.8 includes the following sub-steps: S9.1: Obtain the number of times each threat intelligence node is cited and the submission delay time, wherein the submission delay time is determined by the node submission time and the upstream first discovery time; S9.2: Generate a reference gain term based on the number of references and a time decay term based on the commit delay time. The reference gain term is used to increase the basic clue benefit that is frequently referenced by subsequent nodes, and the time decay term is used to reduce the timeliness weight of delayed commit nodes. S9.3: Generate a reference and time correction factor based on the reference gain term and the time decay term, and use the reference and time correction factor to correct the basic contribution value to obtain a weighted contribution value.

10. The mechanism according to claim 1, characterized in that, Steps S1.9 and S1.10 include sub-steps: S10.1: Perform proportional normalization on the weighted contribution values ​​of the nodes participating in the closed loop to obtain the final delayed bonus result of each threat intelligence node, and match the total amount of the final delayed bonus result with the dynamic total points pool. S10.2: Generate node-level settlement results based on the final delayed dividend results and instant reward results, and associate the node-level settlement results with the corresponding contributors; S10.3: Generate an audit snapshot, which includes a settlement identifier, a threat intelligence map identifier, a node snapshot, a reference edge snapshot, a contributor list, an instant reward result, a delayed dividend result, calculation parameters, a calculation trajectory, a generation time, and status information; S10.4: Display the audit snapshot on the dividend dashboard or submit it to a trusted audit system, wherein the trusted audit system includes at least one of a consortium blockchain, a trusted timestamp system, an immutable log system, or a database audit table.

Images