A network crime intelligence structured analysis method and system

Abstract

The application provides a network crime intelligence structured analysis method and system, communication text containing slang features is acquired; based on a pre-constructed slang knowledge graph, context-aware semantic mapping is performed on the communication text to obtain event elements expressed in standard security entities, wherein the semantic mapping eliminates slang reference ambiguity by using the association relationship between slang variant nodes and standard security entities in the slang knowledge graph; according to the event elements and attack stage association information stored in the slang knowledge graph, the damage chain stage of the network attack corresponding to the event elements is determined; and according to the time information of the event elements and the causal dependence relationship between the determined damage chain stages, structured attack intelligence containing event nodes, stage attribution and time sequence relationship is generated. By using the scheme of the application, reference ambiguity can be eliminated based on context-aware slang knowledge graph semantic mapping, thereby blocking the cascade conduction of ambiguity along the attack chain analysis link.

Description

Technical Field

[0001] This application relates to the field of cybersecurity intelligence analysis technology, and more specifically, to a structured analysis method and system for cybercrime intelligence. Background Technology

[0002] As cyberattack methods continue to evolve, the scale and organization of cybercrime industries are becoming increasingly prominent. Cybersecurity intelligence analysis has become a core support for proactive defense systems. This field is rapidly transforming from traditional manual rule-based judgment and static feature matching towards automated intelligence extraction and structured analysis based on knowledge graphs and natural language processing. It strives to efficiently extract key elements such as attack intent, attack resources, and attack stages from massive amounts of unstructured communication data, and build structured intelligence to support source tracing, judgment, and early warning response.

[0003] In the practical application of cybercrime intelligence analysis, unstructured communication texts commonly contain a large number of deliberately concealed and context-ambiguous slang terms, coded language, and variant words. For example, the same slang term may refer to completely different illegal targets or attack resources in different transaction contexts. Existing analysis methods mostly rely on static slang vocabularies or general security knowledge bases to perform simple string replacements, failing to perceive contextual differences. This leads to the same slang term being uniformly mapped to the same standard entity in different contexts such as inquiry, delivery, and acceptance, resulting in ambiguity. This ambiguity leads to misjudgment of security event types in subsequent event extraction stages, causes incorrect stage attribution in the attack phase determination stage, and amplifies step by step along the attack chain construction stage, ultimately causing the entire attack chain to break or be misreconstructed, forming a cascading propagation problem of ambiguity along the analysis stages. Therefore, how to eliminate referential ambiguity based on context-aware slang knowledge graph semantic mapping, thereby preventing the cascading propagation of ambiguity along the attack chain analysis stages, has become a challenge faced by the industry. Summary of the Invention

[0004] This application provides a structured analysis method and system for cybercrime intelligence, which can eliminate referential ambiguity based on context-aware slang knowledge graph semantic mapping, thereby blocking the cascading transmission of ambiguity along the attack chain analysis links.

[0005] Firstly, this application provides a structured analysis method for cybercrime intelligence, comprising the following steps: Retrieve communication text containing slang characteristics; Based on a pre-built slang knowledge graph, context-aware semantic mapping is performed on the communication text to obtain event elements expressed in standard security entities. The semantic mapping utilizes the association between slang variant nodes and standard security entities in the slang knowledge graph to eliminate ambiguity in slang reference. Based on the event elements and the attack phase association information stored in the slang knowledge graph, determine the kill chain phase of the network attack corresponding to the event elements. Based on the time information of the event elements and the causal dependencies between the determined kill chain stages, structured attack intelligence containing event nodes and their stage affiliations and temporal relationships is generated.

[0006] Preferably, the construction of the slang knowledge graph includes: Extracting slang variant words and their corresponding standard security entities from cybercrime communication corpora; Determine the explicit mapping relationship between the slang variant lexical units and the standard security entity, and use it as the explicit relation edge of the slang knowledge graph; The implicit mapping relationship between the slang variant lexical units and the standard security entity is determined and used as the implicit relation edge of the slang knowledge graph; The standard security entity is associated with a stage node of a preset network attack kill chain to obtain the association information of the attack stage; The slang knowledge graph is generated based on the explicit relation edges, the implicit relation edges, and the association information of the attack phase.

[0007] Preferably, determining the implicit mapping relationship between the slang variant morphemes and the standard security entity specifically includes: Identify the transaction context type of variant words in cybercrime communications corpus, wherein the transaction context type includes at least inquiry context, delivery context, and acceptance context; For slang variant words in the same transaction context type, detect their interaction paths with known standard security entities. When multiple slang variant words point to the same interaction target in the same transaction context, determine that there is an implicit mapping candidate relationship between the multiple slang variant words. Extract the context window of each slang variant word in the implicit mapping candidate relationship, calculate the distribution similarity between role words and action words in the context window, and determine the mapping relationship between each slang variant word involved in the implicit mapping candidate relationship with a distribution similarity exceeding a set threshold and the same interaction target as the implicit mapping relationship.

[0008] Preferably, based on a pre-constructed slang knowledge graph, the communication text is subjected to context-aware semantic mapping to obtain event elements expressed in standard security entities, specifically including: Load the aforementioned slang knowledge graph; Identify candidate slang terms in the communication text, query the slang knowledge graph for a first standard security entity that has an explicit mapping relationship with the candidate slang terms, and for a second standard security entity that is associated with the slang knowledge graph through an implicit relationship edge. Extract the candidate slang terms from the context co-occurring words in the communication text, and determine the context matching degree between the context co-occurring words and the typical context features associated with the first standard security entity and the second standard security entity, respectively. The typical context features are extracted from the historical context distribution of the corresponding nodes in the slang knowledge graph. When the context matching degree supports the second standard security entity, the candidate slang word character is mapped to the second standard security entity; otherwise, it is mapped to the first standard security entity. The corresponding slang terms in the communication text are replaced with the mapped standard security entities to generate event elements expressed in standard security entities.

[0009] Preferably, based on the event elements and the attack phase association information stored in the slang knowledge graph, the kill chain phase of the network attack corresponding to the event elements is determined to specifically include: Extract first-stage nodes that are explicitly associated with standard security entities in the event elements from the slang knowledge graph, and second-stage nodes that are accessible through implicit relation edges in the slang knowledge graph. The interaction action types between entities in the event element are detected, and the interaction action types are matched with the attack behavior characteristics associated with the first stage node and the second stage node, respectively, to determine the degree of conformity of the event element to the behavior of each stage node. The stage node with the highest behavioral conformity is identified as the kill chain stage corresponding to the event element.

[0010] Preferably, based on the time information of the event elements and the causal dependencies between the determined kill chain stages, generating structured attack intelligence that includes event nodes and their stage affiliations and temporal relationships specifically includes: An initial event subgraph is established using the standard security entities in the event elements as nodes and the direct interaction relationships between entities in the event elements as explicit temporal edges. Based on the time information of the event elements, the timestamps of each node are determined, and implicit causal dependency edges across stages are added to the initial event subgraph according to the causal dependency relationship between the stages of the kill chain to obtain the time-series event subgraph. Perform an attack chain phase integrity check on the time-series event subgraph, detect missing attack phases, and use the attack chain constraint rules in the slang knowledge graph to infer and fill in the candidate event nodes corresponding to the missing attack phases. The output contains structured attack intelligence, including each event node, the stage of the kill chain to which the node belongs, and the explicit temporal relationships and implicit causal dependencies between nodes.

[0011] Preferably, the causal dependencies between the stages of the kill chain are predetermined in the following manner: From the sample communication texts labeled with attack chain stages, extract the timestamps of events corresponding to each kill chain stage, and count the frequency of occurrence of events between different kill chain stages; Kill chain stages that occur sequentially at frequencies higher than a frequency threshold are identified as explicit causal dependency pairs. For the explicit causal dependency pair, extract the causal trigger words and behavioral association words in the corresponding event context, determine the causal direction between the explicit causal dependency pairs based on the occurrence distribution of the causal trigger words, and construct the inter-stage directed causal dependency relationship; For kill chain stage pairs that occur successively at frequencies lower than the frequency threshold but higher than the minimum observation threshold, the overlap of the entity sets in their corresponding events and the connection features of the communication sessions are extracted. When the overlap and the connection features meet preset conditions, they are identified as implicit causal dependencies.

[0012] Secondly, this application provides a structured analysis system for cybercrime intelligence, comprising: The acquisition module is used to acquire communication text containing slang characteristics; The processing module is used to perform context-aware semantic mapping on the communication text based on a pre-built slang knowledge graph to obtain event elements expressed in standard security entities. The semantic mapping utilizes the association between slang variant nodes and standard security entities in the slang knowledge graph to eliminate slang referential ambiguity. The processing module is also used to determine the kill chain stage of the network attack corresponding to the event element based on the event element and the attack stage association information stored in the slang knowledge graph. The execution module is used to generate structured attack intelligence containing event nodes and their stage affiliations and temporal relationships, based on the time information of the event elements and the causal dependencies between the determined kill chain stages.

[0013] Thirdly, this application provides a computer device, the computer device including a memory and a processor, the memory storing code, and the processor being configured to acquire the code and execute the above-described structured analysis method for cybercrime intelligence.

[0014] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described structured analysis method for cybercrime intelligence.

[0015] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects: This application constructs a knowledge graph of slang that combines explicit and implicit relationships, deeply integrating context-evidence-driven semantic disambiguation, in-graph stage-linked reasoning, and explicit-implicit causal completion. This prevents the cascading transmission of slang referential ambiguity along the event extraction, attack stage determination, and attack chain reconstruction stages. In the semantic mapping stage, implicit relationship edges are used to expand the range of candidate entities, and competitive disambiguation is achieved through the matching degree of co-occurring words in the context with typical contextual features, eliminating the polysemy of the same slang term in different transaction contexts. In the attack stage determination stage, the explicit and implicitly associated stage nodes are linked... Synchronous inclusion uses the matching degree between interactive actions and attack behavior characteristics to uniformly determine the stage attribution, avoiding the rigid transmission of ambiguity to the stage determination stage; in the attack chain reconstruction stage, explicit and implicit causal dependencies are distinguished and missing stages are inferred and completed based on attack chain constraint rules, blocking the transmission of attack chain breaks caused by missing stages; in summary, this application unifies semantic disambiguation, stage inference and attack chain completion in the same knowledge graph framework, eliminating the structural defects of ambiguity amplification at each level in the separate architecture, and achieving full-link semantic consistency of structured cybercrime intelligence. Attached Figure Description

[0016] Figure 1 This is an exemplary flowchart of a structured analysis method for cybercrime intelligence according to some embodiments of this application; Figure 2 This is a flowchart illustrating the process of constructing a slang knowledge graph according to some embodiments of this application; Figure 3 This is a flowchart illustrating the determination of stages in the kill chain according to some embodiments of this application; Figure 4 This is a schematic diagram of the structure of a cybercrime intelligence structured analysis system according to some embodiments of this application; Figure 5 This is a schematic diagram of the structure of a computer device for implementing a structured analysis method for cybercrime intelligence, according to some embodiments of this application. Detailed Implementation

[0017] To better understand the technical solution of this application, the technical solution of this application will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] refer to Figure 1The figure is an exemplary flowchart of a structured analysis method for cybercrime intelligence according to some embodiments of this application. The structured analysis method for cybercrime intelligence mainly includes the following steps: In step 101, the communication text containing slang features is obtained.

[0019] It should be noted that the method of this application is applicable to cybercrime intelligence analysis scenarios, especially for the automated structuring of texts containing slang, coded language, and variant words generated from unstructured communication channels such as instant messaging tools, dark web forums, and encrypted groups. In such scenarios, participants generally use alternative expressions with deliberate concealment and contextual ambiguity to circumvent content censorship. The same slang term may point to completely different illegal targets or attack resources in different transaction contexts, and the word formation of slang evolves rapidly with time and groups. Traditional analysis methods based on static vocabularies or general security knowledge bases are difficult to cope with the dynamic ambiguity of slang and the need for automatic attribution of attack stages. The method of this application constructs a slang knowledge graph with both explicit and implicit mapping relationships and deeply embeds this graph into the entire process from semantic disambiguation to attack chain stage reasoning and event subgraph completion. It can achieve the output of structured attack intelligence from unstructured slang dialogue to include event stage attribution and causal temporal relationships in such scenarios, filling the capability gap of existing technologies in the automated analysis of slang-intensive cybercrime communications.

[0020] In practical applications, communication text containing slang features can be obtained through the following methods: Raw communication text streams are collected from instant messaging groups, dark web forums, encrypted session records, or case evidence mirrors via data interfaces. Feature pre-screening is performed on the raw communication text streams, and text fragments that match preset slang feature judgment conditions are extracted as target communication text. The slang features refer to character sequences in the communication text that exhibit at least one of the following linguistic anomalous attributes: anomalous character composition, manifested as homophonic substitution, character splitting and recombination, variant character substitution, or the substitution of content words with graphic symbols, causing the literal semantics of the character sequence to deviate from conventional expression; anomalous semantic combination, manifested as using words with non-referential meanings to refer to illegal targets or attack resources in a specific transaction context, and this referential relationship is not included in a general security dictionary; and anomalous co-occurrence distribution, manifested as the distribution of contextual role words and action words of the same word in multiple text fragments deviating from the statistical distribution in a general corpus by more than a preset threshold.

[0021] In step 102, based on the pre-built slang knowledge graph, the communication text is subjected to context-aware semantic mapping to obtain event elements expressed in standard security entities. The semantic mapping utilizes the association between slang variant nodes and standard security entities in the slang knowledge graph to eliminate ambiguity in slang reference.

[0022] It should be noted that the cybercrime communication corpus in this application refers to a collection of text data used to extract variant words of slang and construct a slang knowledge graph. It can be instant messaging group chat logs, dark web forum page text, encrypted session logs, communication content in case evidence mirrors, publicly available cybercrime case texts, or threat intelligence texts provided by cybersecurity vendors.

[0023] In some embodiments, reference Figure 2 As shown in the figure, this is a schematic diagram of the process of constructing a slang knowledge graph according to some embodiments of this application. In this embodiment, the construction of the slang knowledge graph can be achieved by the following steps: In step 1021, variant words of slang and the standard security entities they refer to are extracted from the cybercrime communication corpus; In step 1022, the explicit mapping relationship between the slang variant lexicon and the standard security entity is determined, which serves as the explicit relation edge of the slang knowledge graph; In step 1023, the implicit mapping relationship between the slang variant lexical units and the standard security entity is determined, and used as the implicit relation edge of the slang knowledge graph; In step 1024, the standard security entity is associated with a stage node of a preset network attack kill chain to obtain the association information of the attack stage; In step 1025, the slang knowledge graph is generated based on the explicit relation edges, the implicit relation edges, and the association information of the attack phase.

[0024] It should be noted that, in this application, slang variant lexical units refer to lexical units in communication text that replace standard security entities in a non-standard form; the standard security entity refers to the standardized description used in the network security terminology system to identify attack resources or illegal targets; the explicit mapping relationship reflects the direct referential relationship between slang variant lexical units and standard security entities that does not change with context; the implicit mapping relationship reflects the indirect referential relationship between slang variant lexical units and standard security entities obtained based on contextual reasoning, which is usually manifested as the semantic association generated by multiple different slang variant lexical units pointing to the same standard security entity; the network attack kill chain refers to the standardized phase sequence of a network attack from the reconnaissance phase to the action phase; the slang knowledge graph refers to a graph structure knowledge base with slang variant nodes, standard security entity nodes, and attack phase nodes as nodes, and explicit relationship edges, implicit relationship edges, and attack phase association edges as edges.

[0025] In practical applications, extracting variant slang terms and their corresponding standard security entities from cybercrime communication corpora can be achieved as follows: The text in the cybercrime communication corpus is segmented; terms that do not match a general security dictionary and have a frequency higher than a preset frequency threshold are marked as candidate slang terms; the context window of the communication text containing the candidate slang terms is extracted; words with behavioral indications are extracted from the context window as action words, and words with behavioral subject or object indications are extracted as role words; the action words are matched with a pre-built standard security entity behavior lexicon, and the role words are matched with a pre-built standard security entity behavior lexicon. The matching is performed using a list of standard security entity behavior terms and a list of standard security entity role terms. The standard security entity behavior term and the standard security entity role term respectively store the set of typical action terms and the set of typical role terms associated with known standard security entities in historical communication corpora. When the matching degree between the action term and the set of typical action terms of a certain standard security entity exceeds a first matching threshold, and the matching degree between the role term and the set of typical role terms of the standard security entity exceeds a second matching threshold, the standard security entity is determined as the standard security entity referred to by the candidate slang term. The candidate slang term determined by the above process is used as a slang variant term, and the correspondence between the slang variant term and the standard security entity it refers to is preserved.

[0026] It should be further explained that the threshold in this application can be set in the following way: collect the known correspondence between standard security entities and variant words of slang as a set of labeled samples, extract the action words and role words in the context window of each labeled sample, calculate the matching degree score between each action word and the typical action word set of the corresponding standard security entity, and the matching degree score between each role word and the typical role word set of the corresponding standard security entity; respectively, statistically analyze the distribution of the action word matching degree score and the role word matching degree score in all labeled samples, set the lowest action word matching degree score that enables the proportion of correctly matched labeled samples to reach the preset ratio requirement as the first matching threshold, and set the lowest role word matching degree score that enables the proportion of correctly matched labeled samples to reach the preset ratio requirement as the second matching threshold.

[0027] In practical applications, determining the explicit mapping relationship between the slang variant tokens and the standard security entity, and using this as an explicit relation edge in the slang knowledge graph, can be achieved in the following way: For each extracted pair of slang variant tokens and standard security entities, if the slang variant token explicitly points to the same standard security entity in multiple independent communication texts, and this pointing relationship does not change with the change of context, then it is determined that there is an explicit mapping relationship between the slang variant token and the standard security entity. In the slang knowledge graph, a directed edge is created with the node corresponding to the slang variant token as the starting point and the node corresponding to the standard security entity as the ending point, and this directed edge serves as the explicit relation edge of the slang knowledge graph.

[0028] In practical applications, associating the standard security entity with a pre-defined stage node of a network attack kill chain to obtain the association information of the attack stage can be achieved in the following ways: First, pre-construct a set of stage nodes for the network attack kill chain, including reconnaissance stage nodes, weaponization stage nodes, delivery stage nodes, exploitation stage nodes, installation stage nodes, command and control stage nodes, and action stage nodes. Second, obtain manual annotation information from network security experts regarding the functions of each standard security entity during the attack process, and establish a correspondence between standard security entities and attack stage nodes based on the manual annotation information. Alternatively, extract the correspondence between standard security entities and attack stages from publicly available threat intelligence reports. This specifically includes: parsing the structured fields or unstructured text of the threat intelligence report, extracting the security entity name and its corresponding attack stage description information, performing name matching or semantic similarity matching between the extracted security entity name and the standard security entity, and when a match is successful, determining the attack stage recorded in the threat intelligence report as the attack stage node associated with that standard security entity, and using the association relationship established through any of the above methods from the standard security entity node to the attack stage node as the association information of the attack stage.

[0029] In practical applications, the slang knowledge graph can be generated based on the explicit relation edges, the implicit relation edges, and the association information of the attack phases, in the following way: Slang variant lexical units are mapped to slang variant nodes, standard security entities are mapped to standard security entity nodes, and attack phases are mapped to attack phase nodes; explicit relation edges are stored as directed connections from slang variant nodes to standard security entity nodes, where each directed connection indicates that the slang variant lexical unit corresponding to the slang variant node it connects to directly refers to the standard security entity node it points to. Quasi-secure entities; implicit relation edges are stored as directed connections from slang variant nodes to standard secure entity nodes, where the directed connection represents the indirect referential relationship obtained by contextual reasoning of the slang variant word corresponding to the slang variant node; the association information of the attack phase is stored as directed connections from standard secure entity nodes to attack phase nodes; the set of all constructed slang variant nodes, standard secure entity nodes, attack phase nodes, explicit relation edges, implicit relation edges, and directed connections transformed from the association information of the attack phase is persistently stored to generate a slang knowledge graph.

[0030] Preferably, in some embodiments, determining the implicit mapping relationship between the slang variant morphemes and the standard security entity can be achieved by the following steps: Identify the transaction context type of variant words in cybercrime communications corpus, wherein the transaction context type includes at least inquiry context, delivery context, and acceptance context; For slang variant words in the same transaction context type, detect their interaction paths with known standard security entities. When multiple slang variant words point to the same interaction target in the same transaction context, determine that there is an implicit mapping candidate relationship between the multiple slang variant words. Extract the context window of each slang variant word in the implicit mapping candidate relationship, calculate the distribution similarity between role words and action words in the context window, and determine the mapping relationship between each slang variant word involved in the implicit mapping candidate relationship with a distribution similarity exceeding a set threshold and the same interaction target as the implicit mapping relationship.

[0031] The distribution similarity in this application is an indicator that measures the degree of consistency between the distribution of role words and the distribution of action words in two slang variant words within their respective context windows. It is used to determine whether the two slang variant words have an implicit mapping relationship because they point to the same standard security entity.

[0032] In practical applications, the transaction context type of slang variant words in cybercrime communication corpora can be identified in the following way: In determining the implicit mapping relationship, it is necessary to identify the transaction context type of each slang variant word in the cybercrime communication corpus. Semantic analysis is performed on each communication text containing slang variant words, and it is divided into different transaction context types according to the specific intent words and interaction patterns in the text. For example, communication texts containing inquiry intent words such as "how much", "what price", and "quote a price" are classified as inquiry contexts; communication texts containing delivery confirmation words such as "sent", "sent", "check received", and "received" are classified as delivery contexts; and communication texts containing verification confirmation words such as "test", "usable", "passed", and "no problem" are classified as acceptance contexts. The identified transaction context type is labeled as the context attribute of the slang variant word in the current communication text.

[0033] In practical applications, for slang variant words in the same transaction context, their interaction paths with known standard security entities are detected. When multiple slang variant words point to the same interaction target in the same transaction context, determining that there is an implicit mapping candidate relationship between the multiple slang variant words can be achieved in the following way: extract the role words and action words that co-occur with the slang variant word from the communication text where the slang variant word is located; query whether the role words and action words appear simultaneously in the typical role word set and typical action word set associated with a certain known standard security entity in the historical communication corpus; if they appear simultaneously, it is determined that there is an interaction path between the slang variant word and the known standard security entity, and the known standard security entity is identified as the interaction target of the slang variant word in the communication text; when the interaction targets detected by multiple different slang variant words in the same transaction context are confirmed to be the same known standard security entity by entity name comparison, it is determined that there is an implicit mapping candidate relationship between the multiple slang variant words.

[0034] In practical applications, the context windows of each slang variant word element in the implicit mapping candidate relationship are extracted, and the distribution similarity between role words and action words within the context window is calculated. The mapping relationship between each slang variant word element involved in the implicit mapping candidate relationship whose distribution similarity exceeds a set threshold and the same interaction target is determined as an implicit mapping relationship. This can be achieved in the following way: Extract the context windows of each slang variant word element in the implicit mapping candidate relationship; statistically analyze the word frequency distribution of role words within each context window to construct a role word distribution vector; statistically analyze the word frequency distribution of action words within each context window to construct an action word distribution vector; calculate the first cosine similarity between the role word distribution vectors of two context windows, and the second cosine similarity between the action word distribution vectors. Similarity is calculated by taking the average of the first and second cosine similarities as the distribution similarity between role words and action words within the context window. Implicit mapping candidate relations with distribution similarity exceeding a set threshold are ultimately determined as implicit mapping relations. Specifically, for implicit mapping candidate relations with distribution similarity exceeding the set threshold, assuming the candidate relation involves multiple slang variant word units w1, w2, ..., wk and the known standard safe entity e that they all point to, then for each wi (i=1..ki=1..k), a directed edge is created in the slang knowledge graph from the slang variant node corresponding to wi to the standard safe entity node corresponding to e. This edge is the implicit relation edge, indicating that wi can indirectly refer to e in a specific context.

[0035] It should be further explained that the threshold in this embodiment can be set as the average value of all distribution similarities, or it can be calibrated based on the labeled verification sample set, and the lowest distribution similarity value that enables the implicit mapping relationship determination accuracy to reach the preset standard is determined as the set threshold.

[0036] In some embodiments, the following steps are used to perform context-aware semantic mapping on the communication text based on a pre-built slang knowledge graph to obtain event elements expressed as standard security entities: Load the aforementioned slang knowledge graph; Identify candidate slang terms in the communication text, query the slang knowledge graph for a first standard security entity that has an explicit mapping relationship with the candidate slang terms, and for a second standard security entity that is associated with the slang knowledge graph through an implicit relationship edge. Extract the candidate slang terms from the context co-occurring words in the communication text, and determine the context matching degree between the context co-occurring words and the typical context features associated with the first standard security entity and the second standard security entity, respectively. The typical context features are extracted from the historical context distribution of the corresponding nodes in the slang knowledge graph. When the context matching degree supports the second standard security entity, the candidate slang word character is mapped to the second standard security entity; otherwise, it is mapped to the first standard security entity. The corresponding slang terms in the communication text are replaced with the mapped standard security entities to generate event elements expressed in standard security entities.

[0037] It should be noted that, in this application, context co-occurring words refer to non-slang content words that are in the same context window as candidate slang words in the communication text; the context matching degree is an indicator that measures the degree of semantic overlap between the set of context co-occurring words of candidate slang words and the set of typical context features of standard security entities, and is used to determine the actual referent of candidate slang words in a specific context.

[0038] It should also be noted that this application introduces implicit relation edges in the slang knowledge graph to include the indirect semantic associations between slang variants that point to the same standard security entity into the candidate disambiguation scope, thus solving the deficiency of existing technologies that rely solely on explicit fixed mappings and cannot cope with the polysemy of slang and new slang variants. At the same time, dynamic disambiguation driven by contextual evidence is achieved by comparing the matching degree of co-occurring words in the context with typical contextual features, so that the same slang word unit can be correctly mapped to the corresponding standard security entity in different transaction contexts, thus blocking the risk of ambiguity cascading along subsequent analysis stages.

[0039] In practical application, firstly, the word segments in the communication text that successfully match the recorded slang variant word segments are marked as candidate slang word segments. For each candidate slang word segment, its corresponding slang variant node is located in the loaded slang knowledge graph. Explicit relation edges originating from the slang variant node are queried. If they exist, the standard security entity node pointed to by the endpoint of the explicit relation edge is determined as the first standard security entity of the candidate slang word segment. At the same time, other slang variant nodes directly connected to the slang variant node through implicit relation edges are queried, and then explicit relation edges originating from these other slang variant nodes are queried. The standard security entity node pointed to by the endpoint of these other slang variant nodes is determined as the second standard security entity of the candidate slang word segment. The standard security entities directly associated through explicit relation edges are used as the first standard security entities, and the standard security entities indirectly associated through implicit relation edges are used as the second standard security entities.

[0040] Secondly, for each of the first and second standard security entities, typical contextual features are extracted from the attribute fields of the corresponding standard security entity node in the slang knowledge graph. The typical contextual features are generated as follows: during the construction of the slang knowledge graph, for each standard security entity, all co-occurring words in the context window of each occurrence of the standard security entity in the historical communication corpus are counted. The co-occurring words with the highest frequency or those with a frequency exceeding a preset frequency threshold are identified as the high-frequency co-occurring words of the standard security entity. The set of these high-frequency co-occurring words is stored as the typical contextual features of the standard security entity in the attribute field of the standard security entity node. Then, all non-slang words are extracted from the context window of the candidate slang words in the communication text to form a context co-occurring word set. The ratio of the intersection size of the context co-occurring word set to the union size of the typical contextual feature set is calculated. The calculated ratio is used as the context matching degree between the candidate slang words and the standard security entity.

[0041] Then, the context matching degree calculated for the first standard security entity is compared with the context matching degree calculated for the second standard security entity. If the context matching degree of the second standard security entity is greater than that of the first standard security entity, it is determined that the context matching degree supports the second standard security entity and the second standard security entity is identified as the mapping target. Otherwise, the first standard security entity is identified as the mapping target.

[0042] Finally, all candidate slang terms in the communication text are traversed, and each candidate slang term is replaced with the corresponding standard security entity's canonical name according to its semantic mapping result. The original vocabulary and word order structure of non-slang terms in the communication text are preserved, forming a new text sequence. The canonical text obtained after completing all replacement operations is used as the event element expressed in standard security entities.

[0043] In step 103, the kill chain stage of the network attack corresponding to the event element is determined based on the event element and the attack stage association information stored in the slang knowledge graph.

[0044] In some embodiments, reference Figure 3 As shown in the figure, this is a flowchart illustrating the determination of kill chain stages according to some embodiments of this application. In this embodiment, the determination of the kill chain stage of the network attack corresponding to the event element based on the event element and the attack stage association information stored in the slang knowledge graph can be achieved by the following steps: In step 1031, a first-stage node that is associated with an explicit attack stage with a standard security entity in the event element is extracted from the slang knowledge graph, and a second-stage node that is accessible through implicit relation edges in the slang knowledge graph. In step 1032, the interaction action type between entities in the event element is detected, and the interaction action type is matched with the attack behavior characteristics associated with the first stage node and the second stage node respectively to determine the behavior conformity of the event element to each stage node. In step 1033, the stage node with the highest behavior conformity is determined as the kill chain stage corresponding to the event element.

[0045] It should be noted that this application extracts both the nodes associated with the explicit attack stage and the nodes reachable by the implicit relation edges of the second attack stage as candidates. This allows the disambiguation results of the semantic mapping stage to be directly transmitted to the stage determination stage through the graph structure. The matching degree between the interactive action and the attack behavior features is used as the determination criterion. This ensures that the stage attribution and entity recognition results maintain semantic consistency within the unified knowledge graph framework, avoiding the cascading transmission of entity recognition errors to the stage determination stage in the separate architecture.

[0046] In practical application, firstly, for the standard security entities identified in the event elements, their corresponding standard security entity nodes are located in the slang knowledge graph; then, attack stage association edges starting from the standard security entity node and ending at the attack stage node are queried. If they exist, the attack stage node pointed to by the endpoint of the attack stage association edge is determined as the first stage node; simultaneously, explicit relationship edges ending from the standard security entity node are queried to obtain the slang variant nodes connected to the starting point of the explicit relationship edge, and then other slang variant nodes connected to the slang variant node through implicit relationship edges are queried. Then, explicit relationship edges starting from these other slang variant nodes are queried. After determining the other standard security entity nodes pointed to by the endpoints of the explicit relationship edges, attack stage association edges starting from these other standard security entity nodes are queried, and the attack stage node pointed to by the endpoint is determined as the second attack stage node.

[0047] Secondly, words describing the interaction relationships between entities are extracted from event elements as interaction action words. Attack behavior feature sets associated with the first-stage nodes and the second-stage attack nodes are obtained from the slang knowledge graph. These attack behavior feature sets are pre-stored in the attribute fields of each attack stage node and contain typical behavior description words corresponding to the attack stage in historical attack events. The interaction action words are compared one by one with the attack behavior feature sets of the first-stage nodes and the second-stage attack nodes. The number of times the interaction action words match words in each attack behavior feature set is counted. The ratio of the number of matches to the total number of words in each attack behavior feature set is used as the behavior conformity degree of the event element to each stage node. The behavior conformity degree is an indicator that measures the degree of matching between the interaction action words extracted from the event element and the attack behavior feature sets associated with the attack stage nodes, and is used to determine the probability that the event element belongs to the attack stage.

[0048] Then, the behavior conformity calculated for the first stage node is compared with the behavior conformity calculated for the second attack stage node. At the same time, the behavior conformity calculated for all second attack stage nodes is compared with each other. The stage node with the highest behavior conformity value is selected and the stage node with the highest behavior conformity value is determined as the kill chain stage corresponding to the event element.

[0049] In step 104, based on the time information of the event elements and the causal dependencies between the determined kill chain stages, structured attack intelligence containing event nodes and their stage affiliations and temporal relationships is generated.

[0050] In some embodiments, the causal dependencies between stages of the kill chain can be determined in the following ways: From the sample communication texts labeled with attack chain stages, extract the timestamps of events corresponding to each kill chain stage, and count the frequency of occurrence of events between different kill chain stages; Kill chain stages that occur sequentially at frequencies higher than a frequency threshold are identified as explicit causal dependency pairs. For the explicit causal dependency pair, extract the causal trigger words and behavioral association words in the corresponding event context, determine the causal direction between the explicit causal dependency pairs based on the occurrence distribution of the causal trigger words, and construct the inter-stage directed causal dependency relationship; For kill chain stage pairs that occur successively at frequencies lower than the frequency threshold but higher than the minimum observation threshold, the overlap of the entity sets in their corresponding events and the connection features of the communication sessions are extracted. When the overlap and the connection features meet preset conditions, they are identified as implicit causal dependencies.

[0051] The sequential frequency in this application is a statistical indicator used to evaluate the degree to which events of two kill chain stages appear in a regular sequence in the time series of sample communication texts labeled with attack chain stages; the explicit causal dependency pair is used to record kill chain stage pairs that have been statistically verified to have a significant and stable sequential occurrence pattern; the directed causal dependency relationship is used to indicate the structured relationship between two kill chain stages based on the causal inference direction determined by the distribution of causal trigger words; the implicit causal dependency relationship is used to capture stage pairs that, although not reaching a significant statistical threshold, have an indirect causal relationship verified by both entity set overlap and communication session connection characteristics.

[0052] In practical application, firstly, sample communication texts with labeled attack chain stages are obtained. Each communication record in the sample communication text is labeled with its corresponding kill chain stage. The timestamp of each communication record is extracted, and the communication records are arranged in ascending order according to the timestamp to form a labeled event time series. The labeled event time series is traversed, and for any two kill chain stage types, the number of times the second stage event occurs after the first stage event in the entire time series without any other stage events in between is counted. This number is divided by the total number of all adjacent stage pairs in the sample communication text to obtain the frequency of occurrence between the two kill chain stage events.

[0053] Secondly, the sequential occurrence frequency of each kill chain stage is compared with a pre-set frequency threshold. The frequency threshold is set as follows: the timestamp sequence in the sample communication text is randomly shuffled, and the sequential occurrence frequency between any two kill chain stage events after shuffling is re-counted. This random shuffling and counting process is repeated several times, and the upper quantile of the sequential occurrence frequency distribution after random shuffling is taken as the frequency threshold; or, the frequency threshold is set as the mean of the sequential occurrence frequencies of all kill chain stage pairs plus a pre-set standard deviation. Kill chain stage pairs with sequential occurrence frequencies higher than the frequency threshold are selected, and it is determined that the sequential occurrence between their stages is not accidental, but rather has a stable causal dependency tendency. The selected kill chain stage pairs that meet the frequency threshold condition are taken as explicit causal dependency pairs.

[0054] Then, for each identified explicit causal dependency pair, the context text of the communication records corresponding to the two-stage events is extracted from the sample communication text; causal trigger words are extracted from the context text, which are words in a pre-summarized vocabulary set representing causal semantics, including "so", "therefore", "because", "lead to", "in order to", "so that", "thus", etc.; the occurrence positions of causal trigger words in the context text connecting the two-stage events are counted, if the causal trigger word is followed by a description of an event in a specific stage, then the causal direction of the explicit causal dependency pair is determined to be from one stage to that specific stage; based on this causal direction, the undirected explicit causal dependency pair is transformed into a directed inter-stage causal dependency relationship, and the inter-stage relationship with a clear causal direction is taken as a directed causal dependency relationship, thus completing the transformation of explicit causal dependency pairs into directed causal dependencies.

[0055] Finally, for kill chain phase pairs where the frequency of occurrence is below the frequency threshold but above the minimum observation threshold, the entity sets involved in each of the two phase events are extracted from the sample communication text. The ratio of the intersection size to the union size of the two entity sets is calculated, and this ratio is used as the overlap of the entity sets. Simultaneously, session features between the communication records corresponding to the two phase events are extracted. These session features include whether the communicating parties are the same, whether the communication time interval is within a preset connection time window, and whether there is a direct reference or response relationship between the closing sentence of the previous communication record and the starting sentence of the next communication record. When the overlap of the entity sets exceeds the overlap threshold, and the session features meet at least two of the above conditions, the preset conditions are satisfied, and the kill chain phase pair is identified as an implicit causal dependency. Kill chain phase pairs verified by both entity overlap and communication session connection features are considered as implicit causal dependencies.

[0056] In some embodiments, generating structured attack intelligence containing event nodes and their stage affiliations and temporal relationships, based on the time information of the event elements and the causal dependencies between the determined kill chain stages, can be achieved through the following steps: An initial event subgraph is established using the standard security entities in the event elements as nodes and the direct interaction relationships between entities in the event elements as explicit temporal edges. Based on the time information of the event elements, the timestamps of each node are determined, and implicit causal dependency edges across stages are added to the initial event subgraph according to the causal dependency relationship between the stages of the kill chain to obtain the time-series event subgraph. Perform an attack chain phase integrity check on the time-series event subgraph, detect missing attack phases, and use the attack chain constraint rules in the slang knowledge graph to infer and fill in the candidate event nodes corresponding to the missing attack phases. The output contains structured attack intelligence, including each event node, the stage of the kill chain to which the node belongs, and the explicit temporal relationships and implicit causal dependencies between nodes.

[0057] The temporal event subgraph described in this application is a graph structure used to integrate the timestamps of event nodes and the implicit causal dependency edges across stages, reflecting the chronological order and causal transmission path of attack events in the time dimension; the structured attack intelligence is output data used to describe the complete attack event chain, including event node identifiers, the kill chain stage to which the node belongs, explicit temporal relationships and implicit causal dependencies between nodes.

[0058] In practical applications, the initial event subgraph can be constructed using standard security entities in the event elements as nodes and direct interaction relationships between entities in the event elements as explicit temporal edges. This can be achieved as follows: Traverse all identified standard security entities in the event elements, creating an event node for each standard security entity, with the node identifier using the standard name of that entity; extract verbs or verb phrases describing the relationships between entities from the event elements, and match the extracted verbs or verb phrases with a pre-defined direct interaction verb vocabulary. This direct interaction verb vocabulary contains a set of verbs representing direct interaction behaviors such as data sending, data receiving, command issuance, file uploading, remote login, and privilege escalation; if the extracted verb or verb phrase matches the direct interaction verb vocabulary, it is determined that there is a direct interaction relationship between the two standard security entities associated with that verb or verb phrase, and an edge is created between the corresponding two event nodes, marking this edge as an explicit temporal edge, with the edge's attributes including the verb or verb phrase; use the completed set of all event nodes and explicit temporal edges as the initial event subgraph.

[0059] In practical applications, based on the time information of event elements, the timestamps of each node are determined, and implicit causal dependency edges across stages are added to the initial event subgraph according to the causal dependencies between the stages of the kill chain. The resulting time-series event subgraph can be achieved in the following way: Extract time information from event elements, determine the occurrence time corresponding to each event node, and attach the occurrence time as a timestamp to the corresponding node attribute; load the pre-determined causal dependencies between the stages of the kill chain, including directed causal dependencies and implicit causal dependencies; traverse the event nodes in the initial event subgraph, and if there are two event nodes that belong to two kill chain stages with causal dependencies, and there is no direct connection edge between the two event nodes in the initial event subgraph, then create a new edge between the two event nodes, mark the edge as an implicit causal dependency edge, and the edge attribute includes the type of causal dependency relationship it depends on and its causal direction. The event subgraph after the implicit causal dependency edge is added is used as the time-series event subgraph.

[0060] In practical applications, the attack chain phase integrity check is performed on the time-series event subgraph to detect missing attack phases. The following method can be used to infer and fill in the missing attack phases using attack chain constraint rules in the slang knowledge graph: Query the attack chain constraint rules from the slang knowledge graph to obtain the entity acceptance conditions that the missing phase must satisfy with its preceding phase, and the entity preparatory conditions that the missing phase must satisfy with its following phase. Starting with the standard secure entities involved in the event nodes of the preceding phase and ending with the standard secure entities involved in the event nodes of the following phase, search the slang knowledge graph for intermediate entities that simultaneously satisfy the entity acceptance and entity preparatory conditions. If an intermediate entity exists, it is determined as the entity that the missing phase should include, and an interaction action description corresponding to the missing phase is generated based on the typical interaction actions defined in the attack chain constraint rules for that phase. A new candidate event node is generated based on the determined entity and interaction action description, and this candidate event node is added to the time-series event subgraph, connected to the event nodes of the preceding and following phases respectively through implicit causal dependency edges.

[0061] In practical applications, the output of structured attack intelligence, including each event node, the kill chain stage to which the node belongs, and the explicit temporal relationships and implicit causal dependencies between nodes, can be achieved in the following way: Traverse all event nodes in the completed temporal event subgraph, extract the node identifier, kill chain stage to which each event node belongs, and timestamp; extract all explicit temporal edges and the two event nodes they connect, and record them as explicit temporal relationships between nodes; extract all implicit causal dependency edges and the two event nodes they connect, and record them as implicit causal dependencies between nodes; organize the extracted event node information, explicit temporal relationship information, and implicit causal dependency information according to a preset data format to generate structured attack intelligence.

[0062] In summary, this application constructs a slang knowledge graph that simultaneously includes explicit and implicit mapping relationships. It introduces a competitive disambiguation mechanism based on the matching degree of co-occurring words in the context and typical context features during the semantic mapping stage. This ensures that the same slang term can be correctly mapped to the corresponding standard security entity in different transaction contexts, fundamentally preventing the risk of slang ambiguity cascading along event extraction, attack stage determination, and attack chain construction. By simultaneously including the second attack stage nodes reachable by both explicit attack stage associations and implicit relationship edges in the candidate scope, and using the matching degree between interaction action type and attack behavior features as the stage determination criterion, it ensures that stage attribution and entity recognition results maintain semantic consistency within the unified knowledge graph framework. By distinguishing between explicit causal dependencies and implicit causal dependencies, and introducing a missing stage reasoning completion mechanism driven by attack chain constraint rules in the construction of the temporal event subgraph, it improves the completeness of attack chain reconstruction and the interpretability of causal logic.

[0063] On the other hand, in some embodiments, this application provides a structured analysis system for cybercrime intelligence, with reference to Figure 4 The figure is a schematic diagram of the structure of a cybercrime intelligence structured analysis system according to some embodiments of this application. The cybercrime intelligence structured analysis system 400 includes: an acquisition module 401, a processing module 402, and an execution module 403, which are described below: The acquisition module 401 in this application is mainly used to acquire communication text containing slang features; Processing module 402, in this application, is used to perform context-aware semantic mapping on the communication text based on a pre-built slang knowledge graph to obtain event elements expressed in standard security entities. The semantic mapping utilizes the association between slang variant nodes and standard security entities in the slang knowledge graph to eliminate slang referential ambiguity. In this application, the processing module 402 is also used to determine the kill chain stage of the network attack corresponding to the event element based on the event element and the attack stage association information stored in the slang knowledge graph. The execution module 403 in this application is mainly used to generate structured attack intelligence containing event nodes and their stage affiliation and temporal relationship based on the time information of the event elements and the causal dependency relationship between the determined kill chain stages.

[0064] In addition, this application also provides a computer device, the computer device including a memory and a processor, the memory storing code, and the processor being configured to acquire the code and execute the above-described structured analysis method for cybercrime intelligence.

[0065] In some embodiments, reference Figure 5 The figure is a schematic diagram of the structure of a computer device implementing a structured analysis method for cybercrime intelligence according to some embodiments of this application. The structured analysis method for cybercrime intelligence in the above embodiments can... Figure 5 The computer device shown is used to implement this, and the computer device 500 includes at least one processor 501, a communication bus 502, a memory 503, and at least one communication interface 504.

[0066] Processor 501 can be a general-purpose central processing unit (CPU) or an application-specific integrated circuit (ASIC).

[0067] The communication bus 502 can be used to transmit information between the aforementioned components.

[0068] Memory 503 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CDROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile optical discs, Blu-ray discs, etc.), magnetic disks or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 503 may exist independently and be connected to processor 501 via communication bus 502. Memory 503 may also be integrated with processor 501.

[0069] The memory 503 stores program code for executing the scheme of this application, and its execution is controlled by the processor 501. The processor 501 executes the program code stored in the memory 503. The program code may include one or more software modules. In the above embodiment, the structured analysis method for cybercrime intelligence can be implemented by the processor 501 and one or more software modules in the program code in the memory 503.

[0070] Communication interface 504 uses any transceiver-like device to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0071] In a specific implementation, as one example, a computer device may include multiple processors, each of which may be a single-core (single CPU) processor or a multi-core (multi CPU) processor. Here, a processor may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0072] The aforementioned computer device can be a general-purpose computer device or a special-purpose computer device. In specific implementations, the computer device can be a desktop computer, a portable computer, a network server, a handheld digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. This application does not limit the type of computer device.

[0073] In addition, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described structured analysis method for cybercrime intelligence.

[0074] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0075] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A structured analysis method for cybercrime intelligence, characterized in that, Includes the following steps: Retrieve communication text containing slang characteristics; Based on a pre-built slang knowledge graph, context-aware semantic mapping is performed on the communication text to obtain event elements expressed in standard security entities. The semantic mapping utilizes the association between slang variant nodes and standard security entities in the slang knowledge graph to eliminate ambiguity in slang reference. Based on the event elements and the attack phase association information stored in the slang knowledge graph, determine the kill chain phase of the network attack corresponding to the event elements. Based on the time information of the event elements and the causal dependencies between the determined kill chain stages, structured attack intelligence containing event nodes and their stage affiliations and temporal relationships is generated.

2. The method as described in claim 1, characterized in that, The construction of the slang knowledge graph includes: Extracting slang variant words and their corresponding standard security entities from cybercrime communication corpora; Determine the explicit mapping relationship between the slang variant lexical units and the standard security entity, and use it as the explicit relation edge of the slang knowledge graph; The implicit mapping relationship between the slang variant lexical units and the standard security entity is determined and used as the implicit relation edge of the slang knowledge graph; The standard security entity is associated with a stage node of a preset network attack kill chain to obtain the association information of the attack stage; The slang knowledge graph is generated based on the explicit relation edges, the implicit relation edges, and the association information of the attack phase.

3. The method as described in claim 2, characterized in that, Determining the implicit mapping relationship between the slang variant morphemes and the standard security entity specifically includes: Identify the transaction context type of variant words in cybercrime communications corpus, wherein the transaction context type includes at least inquiry context, delivery context, and acceptance context; For slang variant words in the same transaction context type, detect their interaction paths with known standard security entities. When multiple slang variant words point to the same interaction target in the same transaction context, determine that there is an implicit mapping candidate relationship between the multiple slang variant words. Extract the context window of each slang variant word in the implicit mapping candidate relationship, calculate the distribution similarity between role words and action words in the context window, and determine the mapping relationship between each slang variant word involved in the implicit mapping candidate relationship with a distribution similarity exceeding a set threshold and the same interaction target as the implicit mapping relationship.

4. The method as described in claim 1, characterized in that, Based on a pre-constructed slang knowledge graph, the communication text is subjected to context-aware semantic mapping to obtain event elements expressed in standard security entities, specifically including: Load the aforementioned slang knowledge graph; Identify candidate slang terms in the communication text, query the slang knowledge graph for a first standard security entity that has an explicit mapping relationship with the candidate slang terms, and for a second standard security entity that is associated with the slang knowledge graph through an implicit relationship edge. Extract the candidate slang terms from the context co-occurring words in the communication text, and determine the context matching degree between the context co-occurring words and the typical context features associated with the first standard security entity and the second standard security entity, respectively. The typical context features are extracted from the historical context distribution of the corresponding nodes in the slang knowledge graph. When the context matching degree supports the second standard security entity, the candidate slang word character is mapped to the second standard security entity; otherwise, it is mapped to the first standard security entity. The corresponding slang terms in the communication text are replaced with the mapped standard security entities to generate event elements expressed in standard security entities.

5. The method as described in claim 1, characterized in that, Based on the event elements and the attack phase association information stored in the slang knowledge graph, the kill chain phases of the network attack corresponding to the event elements are determined to specifically include: Extract first-stage nodes that are explicitly associated with standard security entities in the event elements from the slang knowledge graph, and second-stage nodes that are accessible through implicit relation edges in the slang knowledge graph. The interaction action types between entities in the event element are detected, and the interaction action types are matched with the attack behavior characteristics associated with the first stage node and the second stage node, respectively, to determine the degree of conformity of the event element to the behavior of each stage node. The stage node with the highest behavioral conformity is identified as the kill chain stage corresponding to the event element.

6. The method as described in claim 1, characterized in that, Based on the temporal information of the event elements and the causal dependencies between the determined kill chain stages, structured attack intelligence is generated, including event nodes, their stage affiliations, and temporal relationships. Specifically, this includes: An initial event subgraph is established using the standard security entities in the event elements as nodes and the direct interaction relationships between entities in the event elements as explicit temporal edges. Based on the time information of the event elements, the timestamps of each node are determined, and implicit causal dependency edges across stages are added to the initial event subgraph according to the causal dependency relationship between the stages of the kill chain to obtain the time-series event subgraph. Perform an attack chain phase integrity check on the time-series event subgraph, detect missing attack phases, and use the attack chain constraint rules in the slang knowledge graph to infer and fill in the candidate event nodes corresponding to the missing attack phases. The output contains structured attack intelligence, including each event node, the stage of the kill chain to which the node belongs, and the explicit temporal relationships and implicit causal dependencies between nodes.

7. The method as described in claim 1, characterized in that, The causal dependencies between the stages of the kill chain are predetermined in the following manner: From the sample communication texts labeled with attack chain stages, extract the timestamps of events corresponding to each kill chain stage, and count the frequency of occurrence of events between different kill chain stages; Kill chain stages that occur sequentially at frequencies higher than a frequency threshold are identified as explicit causal dependency pairs. For the explicit causal dependency pair, extract the causal trigger words and behavioral association words in the corresponding event context, determine the causal direction between the explicit causal dependency pairs based on the occurrence distribution of the causal trigger words, and construct the inter-stage directed causal dependency relationship; For kill chain stage pairs that occur successively at frequencies lower than the frequency threshold but higher than the minimum observation threshold, the overlap of the entity sets in their corresponding events and the connection features of the communication sessions are extracted. When the overlap and the connection features meet preset conditions, they are identified as implicit causal dependencies.

8. A structured analysis system for cybercrime intelligence, characterized in that, include: The acquisition module is used to acquire communication text containing slang characteristics; The processing module is used to perform context-aware semantic mapping on the communication text based on a pre-built slang knowledge graph to obtain event elements expressed in standard security entities. The semantic mapping utilizes the association between slang variant nodes and standard security entities in the slang knowledge graph to eliminate slang referential ambiguity. The processing module is also used to determine the kill chain stage of the network attack corresponding to the event element based on the event element and the attack stage association information stored in the slang knowledge graph. The execution module is used to generate structured attack intelligence containing event nodes and their stage affiliations and temporal relationships, based on the time information of the event elements and the causal dependencies between the determined kill chain stages.

9. A computer device comprising a memory and a processor, the memory storing code, characterized in that, The processor is configured to acquire the code and execute the structured analysis method for cybercrime intelligence as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the structured analysis method for cybercrime intelligence as described in any one of claims 1 to 7.

Images