A threat intelligent analysis method, device and equipment based on multi-agent cooperation and a storage medium

Abstract

The application discloses a threat intelligent analysis method and device based on multi-agent cooperation, equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: acquiring a unified threat knowledge graph and confirmed threat data; a first agent matches fields in the threat data with the knowledge graph, generates an anchor node set, takes a preset hop number neighborhood, and combines to generate a seed subgraph; a second agent expands along a first relationship set to generate a threat perspective subgraph; a third agent expands along a second relationship set to generate an asset perspective subgraph; threat perspective confidence, asset perspective confidence, attack tactic damage degree and overall asset influence degree are calculated respectively; a fourth agent calculates a target comprehensive threat risk score according to the above-mentioned parameters, and obtains a structured threat analysis result. The method can improve the accuracy of the threat analysis result.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for threat intelligence analysis based on multi-agent collaboration. Background Technology

[0002] With the continuous expansion of critical information infrastructure and the ongoing evolution of cyberattack methods, single security devices or point-of-attack analysis methods are no longer sufficient to effectively address complex cyber threat scenarios. Different types of attacks are often scattered across different time points, network areas, and business systems, requiring cross-device and cross-regional collaborative analysis to reconstruct the complete attack chain.

[0003] Currently, threat intelligence analysis for critical information systems mainly relies on knowledge graph-based threat analysis and multi-agent threat intelligence analysis. However, existing threat intelligence analysis methods lack multi-perspective collaborative reasoning mechanisms and a unified shared memory carrier, resulting in poor accuracy of threat analysis results. Summary of the Invention

[0004] This application provides a threat intelligence analysis method, apparatus, device, and storage medium based on multi-agent collaboration, which can improve the accuracy of threat analysis results.

[0005] To achieve the above objectives, this application adopts the following technical solution: In a first aspect, this application provides a threat intelligence analysis method based on multi-agent collaboration, characterized in that the method includes: Acquire a unified threat knowledge graph and receive confirmed threat data; The first agent matches the fields in the confirmed threat data with the unified threat knowledge graph, generates an anchor node set based on the matching nodes, takes each anchor node in the anchor node set as the center, selects a neighborhood with a preset number of hops in the unified threat knowledge graph, merges them to generate a seed subgraph, and sends the seed subgraph to the second agent and the third agent respectively. The second agent starts with the seed subgraph and expands along the first relation set to generate a threat perspective subgraph; the third agent starts with the seed subgraph and expands along the second relation set to generate an asset perspective subgraph. The threat perspective confidence level is calculated on the threat perspective subgraph, and the asset perspective confidence level is calculated on the asset perspective subgraph. The second agent calculates the attack tactical harm level on the threat perspective subgraph; The third agent calculates the overall asset impact on the asset perspective subgraph. The fourth agent calculates the target's comprehensive threat risk score based on the threat perspective confidence level, the asset perspective confidence level, the attack tactical harm level, and the overall asset impact level. Based on the comprehensive threat risk score of the target, the structured threat analysis results are obtained.

[0006] Optionally, the step of calculating the threat view confidence on the threat view subgraph and calculating the asset view confidence on the asset view subgraph includes: The threat perspective confidence level is obtained based on the coverage of high-value evidence and the support of relationships in the threat perspective subgraph. The confidence level of the asset perspective is obtained based on the coverage of high-value evidence and the support of relationships in the asset perspective subgraph.

[0007] Optionally, the calculation of the attack tactical harm level includes: Nodes of type attacker are filtered from the threat perspective subgraph to form a candidate attacker set; Based on the threat perspective subgraph, determine the importance score of each attacker node in the candidate attacker set; Based on the importance score of each attacker node in the candidate attacker set, the total evidence score of each candidate attacker in the candidate attacker set is calculated. The total evidence score of each candidate attacker is divided by the sum of the total evidence scores of all candidate attackers to obtain the attribution probability of each candidate attacker. The attacker with the highest attribution probability is selected as the target attacker, and the attribution probability of the target attacker is obtained; Extract the tactical and technical nodes used by the target attacker, sort them in descending order of importance score, and obtain the tactical and technical sequence; The attack tactical harm level is calculated based on the stage number and importance score of each tactical technology node in the kill chain in the tactical technology sequence.

[0008] Optionally, the method further includes: Based on the target attacker, the attribution probability of the target attacker, the tactical technique sequence, and the hazard degree of the attack tactics, a threat perspective conclusion vector is obtained.

[0009] Optionally, the calculation of the overall asset impact includes: Nodes of type "asset" in the asset perspective subgraph are selected to form a set of victim assets; Extract the set of CVE vulnerability nodes associated with each asset in the set of victim assets; The asset impact of each asset is calculated based on the business importance attribute value of each asset in the set of affected assets and the highest general vulnerability scoring system CVE score of the associated CVE vulnerability. The asset impact of each asset is denoised or aggregated to calculate the overall asset impact.

[0010] Optionally, the method further includes: Based on the asset perspective subgraph, determine the importance score of each asset node in the victim asset set; Calculate the asset importance factor based on the importance score and business importance attribute value of each asset node in the victim asset set; Based on the set of affected assets, the asset importance factor, the set of CVE vulnerability nodes, and the overall asset impact, an asset-perspective conclusion vector is obtained.

[0011] Optionally, the calculation of the target comprehensive threat risk score includes: Based on the severity of the attack tactics and the confidence level of the threat perspective, a threat perspective risk score is obtained; Based on the overall asset impact and the asset perspective confidence level, an asset perspective risk score is obtained; A comprehensive threat risk score is obtained based on the threat perspective risk score and the asset perspective risk score. The perspective divergence degree is obtained based on the absolute value of the difference between the attack tactical harm degree and the overall asset impact degree, and the absolute value of the difference between the threat perspective confidence degree and the asset perspective confidence degree. The target's comprehensive threat risk score is obtained based on the comprehensive threat risk score and the perspective divergence degree.

[0012] Secondly, this application provides a threat intelligence analysis device based on multi-agent collaboration, comprising: The acquisition module is used to acquire the unified threat knowledge graph and receive confirmed threat data. The generation module is used to enable a first intelligent agent to match fields in the confirmed threat data with the unified threat knowledge graph, generate an anchor node set based on the matching nodes, and take a preset number of hops neighborhood in the unified threat knowledge graph as the center of each anchor node in the set, merge them to generate a seed subgraph, and send the seed subgraph to a second intelligent agent and a third intelligent agent respectively; the second intelligent agent uses the seed subgraph as the starting point and expands along a first relation set to generate a threat perspective subgraph; the third intelligent agent uses the seed subgraph as the starting point and expands along a second relation set to generate an asset perspective subgraph; The calculation module is used to calculate the threat perspective confidence level on the threat perspective subgraph, the asset perspective confidence level on the asset perspective subgraph, the attack tactical harm level on the threat perspective subgraph, and the overall asset impact level on the asset perspective subgraph. The analysis module is used to calculate the target comprehensive threat risk score based on the threat perspective confidence level, the asset perspective confidence level, the attack tactical harm level, and the overall asset impact level, and to obtain the structured threat analysis results based on the target comprehensive threat risk score.

[0013] Thirdly, this application provides a computing device, including a memory and a processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of the first aspects.

[0014] Fourthly, this application provides a computer-readable storage medium for storing a computer program for performing the method as described in any one of the first aspects.

[0015] As can be seen from the above technical solution, this application has at least the following beneficial effects: This application generates a seed subgraph through anchor mapping by a first intelligent agent; the second and third intelligent agents, starting from the same seed subgraph, extend in parallel along the first set of relations used to trace attacker identities and the second set of relations used to trace asset losses, respectively, to generate a threat perspective subgraph and an asset perspective subgraph, and calculate the confidence level of each subgraph; on the threat perspective subgraph, the second intelligent agent identifies the target attacker based on the degree of evidence correlation by screening candidate attackers, and extracts the tactical technology nodes used by the target attacker and calculates the attack tactical harm by combining them with the kill chain stage sequence number; on the asset perspective subgraph, the third intelligent agent calculates the overall asset impact by screening the set of affected assets and combining the business importance attributes of each asset with the associated CVE vulnerability information; the fourth intelligent agent, based on the collaborative analysis architecture of the perspective divergence correction comprehensive score, and the shared memory and evidence chain tracing mechanism of the unified threat knowledge graph, realizes a multi-dimensional comprehensive judgment of confirmed threats from attacker attribution, tactical harm assessment to asset impact analysis, which can improve the accuracy of threat analysis results.

[0016] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0017] Figure 1 A flowchart illustrating a threat intelligence analysis method based on multi-agent collaboration provided in this application embodiment; Figure 2 A schematic diagram of a threat intelligence analysis device based on multi-agent collaboration provided in an embodiment of this application; Figure 3 This is a schematic diagram of a computing device provided in an embodiment of this application. Detailed Implementation

[0018] The terms "first," "second," and "third," etc., used in this application specification and accompanying drawings are used to distinguish different objects, not to limit a specific order.

[0019] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0020] With the continuous expansion of critical information infrastructure and the ongoing evolution of cyberattack methods, single security devices or point-of-sight analysis methods are no longer sufficient to effectively address complex cyber threat scenarios. Different types of attacks are often scattered across different time points, network areas, and business systems, requiring cross-device and cross-regional collaborative analysis to reconstruct the complete attack chain. Currently, intelligent threat analysis for critical information systems mainly relies on knowledge graph-based threat analysis and multi-agent threat analysis. However, existing intelligent threat analysis methods still have the following shortcomings: threat intelligence from different sources cannot be effectively integrated; analysis and reasoning mostly remain at the shallow correlation stage, lacking in-depth collaborative analysis from both attacker and asset perspectives; and the reasoning process in intermediate stages of the entire analysis process cannot be effectively traced, resulting in poor accuracy of threat analysis results.

[0021] In view of this, this application provides a threat intelligence analysis method based on multi-agent collaboration. In this embodiment, the method can be executed by an agent cluster, which includes a first agent, a second agent, a third agent, and a fourth agent.

[0022] To address the lack of multi-perspective collaborative reasoning mechanisms in existing technologies, this application generates a seed subgraph through anchor point mapping by a first agent. The second and third agents use the same seed subgraph as a common starting point. The second agent expands along a first relation set to generate a threat perspective subgraph, and the third agent expands along a second relation set to generate an asset perspective subgraph. This achieves parallel analysis of two orthogonal perspectives: attacker attribution and asset impact, avoiding the accumulation and amplification of errors in a serial pipeline. Furthermore, to address the issues of conflicting multi-source intelligence fusion and superficial analytical reasoning capabilities in existing technologies, this application calculates threats separately by the second and third agents. The fourth agent uses both perspective confidence and asset perspective confidence to weight the attack tactical harm and overall asset impact, and adjusts the comprehensive score based on the divergence between the two perspectives. This achieves self-calibration based on logical consistency, effectively suppressing the interference of misjudgment from a single perspective on the final result. Addressing the problem of uncontrollable and untraceable errors in intermediate steps in existing technologies, this application uses a unified threat knowledge graph as a shared memory carrier for all agents. When each agent writes its analysis results into the graph, it adds a source identifier, timestamp, and confidence level, achieving complete evidence chain traceability and making the analysis conclusions verifiable.

[0023] To make the technical solution of this application clearer and easier to understand, the application scenarios of the technical solution of this application are introduced.

[0024] This application scenario focuses on the intelligent analysis and assessment of network threat events. In this scenario, security devices such as firewalls, IDS (Intrusion Detection System), WAF (Web Application Firewall), and EDR (Endpoint Detection and Response) detect and confirm network security events, output threat data, and report this data to the threat analysis system. The threat analysis system deploys an intelligent agent cluster. Upon receiving the threat data, it triggers a multi-agent collaborative threat analysis process. The intelligent agent cluster performs collaborative analysis and outputs a structured threat analysis report. Security analysts obtain this structured threat analysis report, complete a security assessment based on its content, and formulate corresponding response decisions.

[0025] The multi-agent collaborative threat analysis process is as follows: The threat analysis system inputs the received threat data into the first agent in the agent cluster. The first agent extracts key fields from the threat data (e.g., threat type, attacker, asset, CVE (Common Vulnerabilities and Exposures) information, TTPs (Tactics, Techniques and Procedures) number, etc.), matches and locates these fields with a unified threat knowledge graph, merges the associated threat intelligence context into a seed subgraph, and sends it to the second and third agents. The second agent starts from the seed subgraph and expands along the attack chain relationship to generate a threat perspective subgraph, filters attacker nodes, calculates the attribution probability based on the importance of the evidence nodes associated with each attacker, determines the most likely attacker and the sequence of tactics and techniques used, and calculates the attack tactical harm based on the kill chain stage. At the same time, the third agent starts from the same seed subgraph and expands along the asset impact relationship to generate an asset perspective subgraph, filters affected assets, and calculates the overall asset impact based on the business importance of the assets and the associated CVE vulnerability information. The fourth agent in the agent cluster receives analysis conclusions from two perspectives and obtains a final risk score. Finally, the fourth agent summarizes the target attacker, attribution probability, tactical sequence, attack tactical severity, set of affected assets, overall asset impact, and final risk score to generate a structured threat analysis report for security analysts to refer to in decision-making.

[0026] To make the technical solution of this application clearer and easier to understand, the following describes a threat intelligence analysis method based on multi-agent collaboration provided by an embodiment of this application, in conjunction with the above application scenarios. Figure 1As shown, this figure is a flowchart of a threat intelligence analysis method based on multi-agent collaboration provided in an embodiment of this application. In this embodiment, the method includes: S101, The first intelligent agent acquires the unified threat knowledge graph and receives confirmed threat data.

[0027] A unified threat knowledge graph is a knowledge base that models and stores various fields and their relationships from multi-source threat intelligence data in a unified graph structure. Confirmed threat data is a confirmed threat alert record, representing a network activity or security incident that has been initially identified as malicious and requires further in-depth analysis and assessment.

[0028] In this application, the unified threat knowledge graph is denoted as:

[0029] in, To unify the threat knowledge graph; A set of nodes; Let it be the set of edges; Functions for node attributes; This is an edge attribute function. In this application, the confirmed threat data is a structured record containing 5 fields, represented as follows:

[0030] in, This indicates confirmed threat data; Indicate the type of threat; The attacker is indicated by: source IP (Internet Protocol) address, domain name, etc. This refers to assets, including: target IP address, hostname, service name, etc. The associated CVE vulnerability information includes: CVE number, CVSS (Common Vulnerability Scoring System) score, and affected products; This indicates a TTP, which includes the TTP number, tactical category, and technical description.

[0031] The construction of a unified threat knowledge graph includes the following steps: S1011, The first intelligent agent collects multi-source data.

[0032] The first intelligent agent aggregates internal security data, external threat intelligence, and open-source intelligence to obtain raw data. Among them, assets and dependencies in the asset management system are included in internal security data; CVE vulnerabilities are included in external threat intelligence sources.

[0033] S1012, The first intelligent agent preprocesses the collected multi-source data.

[0034] The original data is preprocessed to obtain the preprocessed data:

[0035] in, This is the preprocessed data; Data cleaning operations include regular expression-based error filtering, missing value imputation, and outlier removal. This is a deduplication operation based on the content fingerprint of the similar hash SimHash; This is a standardized operation to convert data into a standard format.

[0036] S1013, The first intelligent agent constructs a node set based on the preprocessed data.

[0037] From preprocessed data Entities are extracted from the data, with each entity representing a real-world object, such as an IP address, an attacker, a CVE vulnerability, or a malicious sample. These entities are then used as nodes to construct a unified threat knowledge graph. ,in Represents a set of nodes The first in 1 node This indicates the total number of nodes. Each node is described by a set of attributes, which are specific information items used to describe that node. Nodes are divided into 8 types, as follows:

[0038] Furthermore, when the node type is an asset node, the business importance attribute value is defined according to the asset's business functions and business dependencies, and is preset in the threat analysis system, as shown in the following example:

[0039] S1014, The first intelligent agent constructs a node attribute mapping function for each node in the node set.

[0040] The mapping function for assigning attribute values ​​to each node is expressed as:

[0041] in, Represents a set of nodes The first in One node; Represents the set of node attribute value ranges. Return node The attribute value is taken from the attribute value corresponding to the node type. Specifically, when a node... When the type is an asset node, this node is recorded as , This indicates that the business importance attribute value of the asset node is returned; when the node When the node is a CVE vulnerability, record this node as... , This indicates that the CVSS score of the CVE node is returned, denoted as . .

[0042] S1015, The first intelligent agent constructs the edge set.

[0043] Define the set of all relation edges in a knowledge graph as:

[0044] in, Represents the set of edges; This represents the total number of edges; Represents the set of edges The first in Edges. Each edge Each carries a relation type, represented as:

[0045] in, Indicates the starting node of the edge; Indicates the terminating node of the edge; ; , Indicates the first The relationship type of the edge; This represents a set of relation types. There are 8 relation types in total, as follows:

[0046] Furthermore, each edge carries a relation weight attribute, denoted as... The value is the relation weight corresponding to the relation type.

[0047] S1016, First agent mapping edge attribute function.

[0048] The mapping function that assigns attribute values ​​to each edge is expressed as:

[0049] in, Represents the set of edges The first in Edge; express The attribute values ​​corresponding to the edges; This represents the set of edge attribute value ranges. In this application, the attribute value corresponding to the edge is the relation weight, i.e. .

[0050] The confirmed threat data is output by security devices (such as firewalls, IDS / IPS, WAF, EDR, etc.) after analysis and confirmation, and is received by the threat analysis system and input into the first intelligent agent.

[0051] S102. The first intelligent agent matches the fields in the confirmed threat data with the unified threat knowledge graph, generates a set of anchor nodes based on the matching nodes, takes each anchor node in the set as the center, selects a neighborhood with a preset number of hops in the unified threat knowledge graph, merges them to generate a seed subgraph, and sends the seed subgraph to the second and third intelligent agents respectively.

[0052] A matching node is a node located in the unified threat knowledge graph by the first agent after matching field values ​​in the confirmed threat data with node attribute values ​​in the unified threat knowledge graph. Matching nodes include nodes obtained after successful matching and nodes newly created after failed matching. Anchor nodes are matching nodes selected as the starting point for subgraph expansion.

[0053] The process of generating the anchor node set can be represented as follows:

[0054] in, The set of anchor nodes is specifically represented as follows: ,in express The first in Anchor nodes, Indicates the number of anchor nodes, and ; Data on confirmed threats; To anchor the data, the confirmed threat data is then... Mapped to a unified threat knowledge graph This yields the set of anchor nodes. The anchoring operator extracts all fields from the confirmed threat data and compares them with the attribute values ​​of the corresponding type nodes in the unified threat knowledge graph. If a match is found, the field is added to the anchor node set. If a match fails, the field that failed to match is defined as a new node and written to the unified threat knowledge graph through the write interface of the unified threat knowledge graph's shared memory. Then, it is added to the anchor node set. When writing to the unified threat knowledge graph, three source markers are attached: creator, creation time, and initial confidence level.

[0055] The seed subgraph is generated by the first agent. After completing the anchor point mapping, the first agent takes each anchor node in the anchor node set as the center, and takes the 3-hop neighborhood of that anchor node (i.e., the set of all nodes and edges that can be reached by expanding outwards in 3 steps from that anchor node along the relationship). Then, the neighborhoods of all anchor nodes are merged through a union operation to form a unified subgraph range. The first agent reads all nodes and edges within this unified subgraph range through the read interface of the unified threat knowledge graph to generate the seed subgraph. The preset hop count of 3 is intended to ensure that the analysis range sufficiently covers the relevant threat intelligence context while controlling the size of the subgraph to avoid it becoming too large.

[0056] Generated seed graph It involves combining and aggregating the neighborhoods of all anchor nodes into a single context, including:

[0057] in, It is the set of all neighborhood nodes of the anchor node; This is the set of neighborhood edges of all anchor nodes; To restrict the node attribute functions on the seed subgraph; To restrict edge attribute functions on the seed subgraph.

[0058] S103. The second agent starts with the seed subgraph and expands along the first relation set to generate a threat perspective subgraph. The third agent starts with the seed subgraph and expands along the second relation set to generate an asset perspective subgraph.

[0059] The first set of relations is a threat-perspective set, mainly involving nodes such as IOC intrusion indicators, attackers, tactics and techniques, malicious samples, attack tools, and CVE vulnerabilities. The first set of relations can be represented as:

[0060] in, Represents the first set of relations; This indicates the use of a relation in a relation type; Indicates the implementation relation in the relation type; This indicates a "belongs" relation in a relation type; This indicates an attribution relation in the relation type.

[0061] The threat perspective subgraph refers to a subgraph generated by the second agent starting from the seed subgraph and extending along the first set of relations used to trace the attacker's identity. It is used to analyze threats from the perspectives of attacker attribution and tactical harm.

[0062] The second set of relations is an asset-centric set, primarily involving assets and CVE vulnerabilities. This second set of relations can be represented as follows:

[0063] in, Represents the second set of relations; This indicates an influence relationship within a relation type; This indicates a relation within a relation type; This indicates a utilization relation in the relation type; This indicates a deployment relationship within a relation type.

[0064] The asset perspective subgraph refers to a subgraph generated by a third-party agent starting from a seed subgraph and extending along the second set of relations used to trace asset losses. It is used to analyze threats from the perspective of asset impact.

[0065] The second agent expands outward according to the relation types of the first relation set, and the third agent expands outward according to the relation types of the second relation set, with the expansion depth limited to two hops. Hop count is defined as follows: the first hop is from the anchor node to an adjacent node, and the second hop is from the adjacent node to the next level node. Each agent can jump a maximum of two steps. Both agents start from the anchor node of the seed subgraph, first jumping one step along the corresponding relation set to obtain a neighbor node; then, starting from that neighbor node, they continue jumping one step to obtain the next level node. Finally, the seed subgraph is merged with all nodes and edges obtained through traversal to generate the threat perspective subgraph and the asset perspective subgraph, respectively.

[0066] S104. The second agent calculates the threat perspective confidence on the threat perspective subgraph, and the third agent calculates the asset perspective confidence on the asset perspective subgraph.

[0067] Perspective confidence is used to measure the reliability of the analytical conclusions for each perspective subgraph. For a threat perspective subgraph generated by the second agent, the threat perspective confidence reflects the credibility of its attacker attribution and tactical harm analysis conclusions; for an asset perspective subgraph generated by the third agent, the asset perspective confidence reflects the credibility of its asset impact analysis conclusions.

[0068] The threat perspective confidence score is obtained based on the coverage of high-value evidence and the support of relationships in the threat perspective subgraph; the asset perspective confidence score is obtained based on the coverage of high-value evidence and the support of relationships in the asset perspective subgraph. The calculation expressions are as follows:

[0069] in, Indicates the viewpoint number. Indicating a threat perspective, Indicates the confidence level from a threat perspective. This represents an asset perspective; Indicates confidence level from an asset perspective; This indicates the coverage of high-value evidence; Indicates the first The support degree of the relationship between the subgraphs at each perspective; The weight representing the coverage of high-value evidence. The weights represent the support of the relationship, where , .

[0070] High-value evidence coverage measures the proportion of nodes in a given subgraph whose importance score is higher than the average importance score of all nodes in that subgraph, reflecting the richness of evidence clues within that subgraph. Relationship support measures the scale of structural evidence in a subgraph, reflecting the richness of relationships and the completeness of the evidence chain. Relationship support is positively correlated with the number of edges; that is, the more edges, the higher the relationship support.

[0071] The high-value evidence coverage rate is calculated by comparing the importance score of each node in the current viewpoint subgraph with the average importance score of all nodes in that subgraph, counting the number of nodes whose importance score is higher than the average importance score of all nodes in the subgraph, and then dividing that number of nodes by the total number of nodes in the subgraph. The calculation expression is as follows:

[0072] in, This indicates the coverage of high-value evidence; Indicates the first The total number of nodes in a viewpoint subgraph; This represents the number of nodes whose importance score is higher than the average importance score of all nodes within the subgraph at that viewpoint, and is defined as:

[0073] in, Indicates the first Subgraph from a perspective The first in 1 node ; Indicates the first The total number of nodes in each viewpoint subgraph, i.e. ; Represents a node In the Importance scores in each perspective subplot; This represents the average importance score of the nodes in the subgraph from this perspective.

[0074] Node importance score The calculation was performed iteratively, initially setting the importance of each node in the viewpoint subgraph to the reciprocal of the total number of nodes in that viewpoint subgraph. In each iteration, based on the importance score obtained in the previous iteration, the importance score of each node is updated according to the above expression; this iteration is repeated until the importance scores of each node converge or the preset number of iterations is reached, yielding the final importance score of each node. The iteration convergence condition is that the change in the importance score of all nodes in two adjacent iterations is less than a preset threshold (e.g., the preset threshold is set to...). The change in importance score is the absolute value of the difference between the importance scores of the same node in two adjacent iterations. The expression for calculating the node importance score is:

[0075] in, Represents a node Importance score; Indicates the first Subgraph from a perspective The first in 1 node ; Indicates the damping coefficient, for example, ; Indicates the first The total number of nodes in a viewpoint subgraph; Indicates the first Pointing to nodes in the subgraph of each perspective Let the set of in-neighbor nodes be denoted as . ; Indicates the first Pointing to nodes in the subgraph of each perspective The set of outgoing neighbor nodes, where the nodes are denoted as . ; Representing an edge Relationship weights, edge attribute functions The weight value; Representing an edge Relationship weights; Indicates the node in the previous iteration Importance score.

[0076] Relationship support is calculated based on the number of edges in the current viewpoint subgraph. Relationship support is positively correlated with the number of edges; that is, the more edges there are, the higher the relationship support, and it does not exceed a preset upper limit of 1. The calculation expression is:

[0077] in, Indicates the first The support degree of the relationship between the subgraphs at each perspective; Indicates the first The number of edges in a viewpoint subgraph; This represents a reference value for the size of the relation; the default value is [value]. .

[0078] S105, the second agent calculates the attack tactical harm level on the threat perspective subgraph.

[0079] Attack tactical harm refers to the weighted average of all tactical and technical nodes used by the target attacker at different stages in the kill chain, used to quantify the degree of damage caused to the target system by the attacker's attack behavior.

[0080] Nodes of type attacker are selected from the threat perspective subgraph to form a candidate attacker set. Based on the threat perspective subgraph, the importance score of each attacker node in the candidate attacker set is determined. Based on the importance scores of each attacker node in the candidate attacker set, the total evidence score for each candidate attacker is calculated. The total evidence score is the sum of the importance scores of all nodes in the attacker's evidence node set. The total evidence score of each candidate attacker is divided by the sum of the total evidence scores of all candidate attackers to obtain the attribution probability of each candidate attacker. The attacker with the highest attribution probability is selected as the target attacker, and the attribution probability of the target attacker is obtained. Tactical and technical nodes used by the target attacker are extracted and sorted in descending order of importance score to obtain a tactical and technical sequence. The attack tactical harm level is calculated based on the stage number and importance score of each tactical and technical node in the kill chain within the tactical and technical sequence.

[0081] The candidate attacker set refers to the set of nodes selected from the threat perspective subgraph that are of the attacker type. An attacker node is a node in the threat perspective subgraph that is of the attacker type. Importance score is a numerical value calculated on the perspective subgraph using a ranking algorithm with relational weights, used to measure the centrality of a node in that subgraph. The attribution evidence node set is the set of all nodes that have attribution evidence edges with a given attacker node; the relation type of these edges belongs to the attribution evidence key set. The total evidence score is the sum of the importance scores of all nodes in the evidence node set of a given attacker node. The attribution probability is the proportion of a given attacker node's total evidence score to the sum of the total evidence scores of all candidate attacker nodes. The target attacker is the attacker node with the highest attribution probability. The attribution probability difference is the difference between the attribution probability of the target attacker and the attribution probability of the attacker node with the second highest attribution probability. The tactical technique sequence is an ordered list of all tactical technique nodes used by the target attacker, sorted in descending order of importance score. The threat perspective conclusion vector is a vector composed of the target attacker, the target attacker's attribution probability, the tactical technique sequence, and the attack tactical harm level.

[0082] The candidate attacker set is obtained by the second agent filtering the node types in the threat perspective subgraph, using the following filtering expression:

[0083] in, Represents the set of candidate attackers; The set of nodes representing the threat perspective subgraph; The first subgraph representing the threat perspective One node; This indicates that the selected node type is attacker; for ease of description, the candidate attacker set is... The first in The number of attacker nodes is denoted as It corresponds to the threat perspective subgraph. The type is a node belonging to the attacker.

[0084] The importance score of the attacker node is iteratively calculated by the second agent using a ranking algorithm with relational weights on the threat perspective subgraph, and the score corresponding to each attacker node in the candidate attacker set is obtained from this algorithm. The importance score of the attacker node is denoted as... This can be obtained from the node importance score calculation expression mentioned above.

[0085] The total evidence score for each candidate attacker in the candidate attacker set is calculated as follows: First, define the attribution evidence node set. This set is obtained by the second agent traversing the nodes in the threat perspective subgraph, collecting the nodes that have usage, affiliation, or attribution relationships with a certain attacker node, and then taking the union of these nodes. For each attacker node in the candidate attacker set... Define its set of evidence nodes:

[0086] in, Indicates the attacker node The evidence node set contains all nodes in the threat perspective subgraph that are related to the attacker. There are nodes with attribution evidence edges; Represents the first in the set of evidence nodes One evidence node; This represents the key set of attribution evidence. These are usage relationships, attribution relationships, and causal relationships.

[0087] The total evidence score is obtained by summing the importance scores of each node in the evidence node set of the attacker's node by the second agent. The calculation expression is as follows:

[0088] in, Indicates the attacker node Total score for evidence; This indicates that the second agent has a view of the evidence nodes. The importance score is calculated.

[0089] The attribution probability is obtained by the second agent dividing the total evidence score of the attacker node by the sum of the total evidence scores of all candidate attacker nodes. The calculation expression is as follows:

[0090] in, Indicates the attacker node Attribution probability; This represents any attacker node in the set of candidate attackers. To iterate through the indices, traverse the entire set of candidate attackers. Used to distinguish .

[0091] The attribution probability difference is obtained by subtracting the attribution probability of the attacker node with the second highest attribution probability from the attribution probability of the target attacker by the second agent. Its calculation expression is as follows:

[0092] in, This indicates the difference in attribution probabilities; This represents the attribution probability of the target attacker; Indicates the target attacker; This represents the set of attacker nodes remaining after removing the target attacker from the candidate attacker set; This represents the maximum attribution probability among the remaining attacker nodes, i.e., the attribution probability of the attacker with the second highest attribution probability.

[0093] The target attacker and their attribution probability are determined by the second agent selecting the attacker with the highest attribution probability from the candidate attacker set. The expression for this is:

[0094]

[0095] in, Indicates the target attacker node; This represents the attribution probability of the target attacker.

[0096] In identifying the target attacker and its attribution probability Then, attribution decisions are made based on the attribution probability and the difference between attribution probabilities, which can be divided into the following three cases: (1) Confirming Attribution when and At that time, the threat was determined to be attributable to the target attacker. .in, The attribution probability threshold is set to a value of [value to be filled in]. ; The threshold for the difference in attribution probability is set to a value of [value to be filled in]. The attribution conclusion confirms the attribution and retains the set of evidence nodes for the target attacker. At this point, the tactical sequence and tactical harm of the target attacker are calculated normally.

[0097] (2) Suspected attribution when and At that time, the target attacker was identified. For suspected attackers, a set of candidate attackers is retained. The attribution conclusion is a suspected attribution, and the set of evidence nodes of the target attacker is retained. At this time, the tactical and technical sequence of the target attacker and the severity of the attack tactics are still calculated, but the attribution conclusion is marked as a suspected attribution in the final output for manual review and reference.

[0098] (3) Unattributable when At that time, the target attacker is directly identified. If the cause cannot be attributed, it is marked as an unknown attacker and stored in the unknown attacker database. The attribution conclusion is "cannot be attributed," but the evidence node set of the target attacker is retained. At this point, the target attacker's tactical sequence and attack tactical harm are no longer calculated; both are defaulted to zero.

[0099] The tactical technology sequence is obtained by the second agent extracting all nodes of type tactical technology that have a usage relationship with the target attacker from the threat perspective subgraph (hereinafter referred to as tactical technology nodes), sorted from high to low according to their importance score in the threat perspective subgraph. Its expression is:

[0100] in, Indicates the target attacker Tactical and technical TTPs node sequence; Indicates the first in the tactical technology sequence One node; This represents the set of nodes in the threat perspective subgraph whose node type is tactical technology. This represents the set of edges in the threat perspective subgraph whose relation type is usage relation; Indicates the target attacker Pointer to node type The directed edges; Represents the sorting function; Indicates descending order; Indicates according to Sort by size.

[0101] The attack tactical harm level is obtained by the second agent through a weighted summation based on the stage number and importance score of each node in the tactical technique sequence within the kill chain. The calculation expression is as follows:

[0102] in, Indicates the target attacker The degree of harm caused by the attack tactics; Indicates the first The ATT&CK tactical category to which each node belongs; A mapping function representing the tactical category to the kill chain stage number; the mapping relationship is shown in the KCidx mapping table. Indicates the total number of stages in the kill chain; Represents a node Importance score in the threat perspective subplot; This represents the sum of importance scores for all nodes in the tactical technique sequence, used to normalize the importance of each tactical technique into a weight.

[0103] The KCidx mapping table maps 14 tactics of ATT&CK to 7 stages of the kill chain, with the mapping relationships as follows:

[0104] Based on the target attacker, the attribution probability of the target attacker, the tactical and technical sequence, and the severity of the attack tactics, a threat perspective conclusion vector is obtained, the expression of which is:

[0105] in, The conclusion vector is from the perspective of threats; The target attacker's node; The attribution probability of the target attacker; For the tactical and technical sequence of the target attacker; The degree of harm caused by the attacker's attack tactics.

[0106] S106. The third agent calculates the overall asset impact on the asset perspective subgraph.

[0107] Overall asset impact refers to a comprehensive indicator calculated by a third-party agent on the asset perspective subgraph based on the aggregated asset impact of all affected assets. It is used to quantify the overall damage caused by this threat to all affected assets.

[0108] Nodes of type "asset" in the asset perspective subgraph are selected to form a set of affected assets; the set of CVE vulnerability nodes associated with each asset in the set of affected assets is extracted; the asset impact of each asset is calculated based on the business importance attribute value of each asset in the set of affected assets and the highest general vulnerability scoring system CVE score of the associated CVE vulnerability.

[0109] The victim asset set refers to the set of asset nodes selected from the asset perspective subgraph, that is, the set of nodes of type asset, representing all asset objects affected by this threat. Importance score is a numerical value used to measure the coreness of each node in this perspective subgraph; a higher score indicates that the asset node is more critical in the asset relationship network. Business importance attribute value refers to the attribute value inherent in the asset node itself, used to measure the asset's importance to the business. Asset importance factor is a comprehensive index obtained by weighting the importance scores and business importance attribute values ​​of each asset node in the victim asset set; it is used to measure the overall importance of the assets involved in this threat. CVE vulnerability node set refers to the set of all CVE vulnerability nodes associated with each asset in the victim asset set through influence relationships, after deduplication. The highest general vulnerability scoring system (CVE) score refers to the maximum CVSS score among the CVE vulnerabilities associated with a particular asset, used to measure the most severe CVE vulnerability risk faced by that asset.

[0110] The process of selecting the victim asset pool is denoted as:

[0111] in, This represents the collection of victimized assets. This represents the set of nodes in the asset-view subgraph. The first subgraph in the asset perspective subgraph represents the... One asset node; This indicates that the filter node type is asset; for ease of description, the collection of victim assets is included. The first in Each asset node is denoted as It corresponds to the asset perspective subgraph. A node of type asset.

[0112] The expression for extracting the CVE vulnerability node set is:

[0113] in, Represents a set of CVE vulnerability nodes. The first subgraph in the asset perspective diagram represents the... One CVE node, Indicates CVE vulnerability node Pointing to asset nodes through influence relationships .

[0114] For each asset in the affected asset set, the asset's business importance attribute value is multiplied by the CVE severity value obtained by mapping the highest CVE score from the general vulnerability scoring system among its associated CVE vulnerabilities using the Logistic function. The asset impact score is calculated as follows:

[0115] in, Represents asset nodes The degree of asset impact; Represents asset nodes The business importance attribute value; Represents the Rogersstick Logistic function; This represents the kurtosis of the Logistic regression and has a value of 0.5. Represents asset nodes The highest CVSS score associated with a CVE vulnerability is the value among all CVE nodes associated with that asset node through influence relationships. The maximum value, that is:

[0116] in, Represents asset nodes The set of associated CVE nodes; CVE vulnerability nodes in the asset perspective subgraph The CVSS score.

[0117] The overall asset impact is obtained by denoising or aggregating the asset impact of each asset, and its calculation expression is as follows:

[0118] in, This indicates the overall asset impact of the asset-view subplot.

[0119] Based on the asset perspective subgraph, determine the importance score of each node in the victim asset set; calculate the asset importance factor based on the importance score and business importance attribute value of each asset in the victim asset set; and obtain the asset perspective conclusion vector based on the victim asset set, asset importance factor, CVE vulnerability node set, and overall asset impact.

[0120] The importance score of each node in the victim asset set is denoted as: This is obtained from the expression for calculating the importance score of the nodes mentioned earlier.

[0121] The asset importance factor is obtained by weighting the importance scores of each asset in the asset perspective subplot, and its calculation formula is as follows:

[0122] in, Indicates asset importance factor; Asset nodes in the asset-view subgraph The business importance attribute value.

[0123] The asset-perspective conclusion vector is represented as follows:

[0124] in, This is the conclusion vector from an asset perspective; For the collection of victimized assets; As an asset importance factor; This is a set of CVE vulnerability nodes.

[0125] S107, the fourth intelligent agent calculates the target's comprehensive threat risk score based on the threat perspective confidence, asset perspective confidence, attack tactical harm, and overall asset impact.

[0126] The target integrated threat risk score refers to the final risk score obtained by the fourth agent based on the integrated threat risk score and after correction according to the degree of divergence between the threat perspective and the asset perspective. It is used to quantify the overall severity of the threat and reflect the inherent consistency of the analysis conclusions from the two perspectives.

[0127] Based on the attack tactical harm level and threat perspective confidence level, a threat perspective risk score is obtained; based on the overall asset impact level and asset perspective confidence level, an asset perspective risk score is obtained; based on the threat perspective risk score and asset perspective risk score, a comprehensive threat risk score is obtained; based on the absolute value of the difference between the attack tactical harm level and the overall asset impact level, and the absolute value of the difference between the threat perspective confidence level and the asset perspective confidence level, a perspective divergence level is obtained; based on the comprehensive threat risk score and perspective divergence level, a target comprehensive threat risk score is obtained.

[0128] Threat-perspective risk score is a quantitative indicator reflecting the severity of a threat from the attacker's perspective, calculated based on the severity of attack tactics and the confidence level of the threat perspective. Asset-perspective risk score is a quantitative indicator reflecting the severity of a threat from the perspective of asset loss, calculated based on the overall asset impact and the confidence level of the asset perspective. Comprehensive threat risk score is a preliminary comprehensive score obtained by weighted summation of the threat-perspective and asset-perspective risk scores. Perspective discrepancy is a quantitative indicator used to measure the degree of contradiction between the analysis conclusions of the threat perspective and the asset perspective; it is calculated from the support gap and confidence gap between the two perspectives.

[0129] The threat perspective risk score is obtained by the fourth agent multiplying the attack tactical harm level by the threat perspective confidence level. The calculation expression is as follows:

[0130] in, Indicates risk score from a threat perspective; Indicates the confidence level from a threat perspective. This indicates the severity of the attacker's attack tactics.

[0131] The asset-perspective risk score is obtained by the fourth agent multiplying the overall asset impact by the asset-perspective confidence score. The calculation formula is as follows:

[0132] in, This indicates a risk score from an asset perspective. Indicates confidence level from an asset perspective; This indicates the overall impact on assets.

[0133] The comprehensive threat risk score is obtained by multiplying the weighted sum of the threat perspective risk score and the asset perspective risk score calculated by the fourth agent by 10. The calculation expression is as follows:

[0134] in, This indicates the overall threat risk score; This indicates the weighting value of the risk score from a threat perspective; This represents the weighting value of the risk score from an asset perspective, and and ; Indicates risk score from a threat perspective; This indicates a risk score from an asset perspective.

[0135] The perspective divergence level is obtained by the fourth agent multiplying the absolute value of the difference between the attack tactical harm level and the overall asset impact level by the absolute value of the difference between the threat perspective confidence level and the asset perspective confidence level, and then multiplying by one-half. The calculation expression is as follows: The expression for calculating the degree of visual divergence is:

[0136] in, Indicates the degree of divergence in perspective. This represents the difference in support between the two perspectives. This represents the difference in confidence levels between the two perspectives.

[0137] The target's comprehensive threat risk score is obtained by the fourth agent by multiplying the comprehensive threat risk score by a correction factor. The calculation expression is as follows:

[0138] in, This indicates the target's overall threat risk score. Let represent the disagreement penalty coefficient, and .

[0139] S108 and the fourth agent obtain the structured threat analysis results based on the target's comprehensive threat risk score.

[0140] The structured threat analysis result refers to the final output generated by the fourth agent after it has completed the calculation of the target comprehensive threat risk score, the threat perspective conclusion vector and the asset perspective conclusion vector. It is used to provide security analysts with a complete assessment conclusion of this threat.

[0141] After calculating the target's comprehensive threat risk score based on the comprehensive threat risk score and perspective divergence, the fourth agent obtains the threat perspective conclusion vector from the second agent and the asset perspective conclusion vector from the third agent, combining the three to form the structured threat analysis result. The threat perspective conclusion vector includes the target attacker, the target attacker's attribution probability, tactical sequence, and attack tactical severity; the asset perspective conclusion vector includes the set of affected assets, asset importance factor, CVE vulnerability node set, and overall asset impact. The composition expression of the structured threat analysis result is as follows:

[0142] in, This indicates the results of the structured threat analysis; This indicates the target's overall threat risk score; Represents the conclusion vector from the threat perspective; This represents the conclusion vector from the asset perspective.

[0143] Furthermore, embodiments of this application also include the following steps: Update the unified threat knowledge graph.

[0144] The Unified Threat Knowledge Graph (UTP) serves as a shared memory for all agents. Agents interact with the UTP through read and write interfaces. The read interface allows agents to query the UTP and retrieve the viewpoint subgraphs needed for the current task. The write interface allows agents to write incremental subgraphs generated during analysis into the UTP. Incremental subgraphs refer to new nodes, edges, and updates to existing node attributes that agents add during analysis. During writing, each node is appended with a source tag, timestamp, and initial confidence level to support evidence chain tracing. The source tag represents the set of agents contributing to the node; the timestamp represents the writing time; and the initial confidence level indicates the node's credibility at the time of writing. The write interface merges the incremental subgraphs into the UTP using a graph merging operator, resulting in an updated UTP.

[0145] During anchor point mapping, if a field fails to match in the unified threat knowledge graph, the first agent creates a new node and writes it to the unified threat knowledge graph via the write interface. The write operation includes a source marker indicating the first agent, a write timestamp, and an initial confidence level of 1. The second and third agents, after generating the threat perspective subgraph and asset perspective subgraph respectively, write the nodes involved in the expansion process and the updated attributes of existing nodes to the unified threat knowledge graph via the write interface. The write operation includes a source marker indicating either the second or third agent, a write timestamp, and an initial confidence level. The read interface is called by each agent when a subgraph needs to be retrieved, returning the memory fragment required for the current task.

[0146] The expressions for the read and write interfaces are:

[0147]

[0148] in, Indicates the agent that initiates the read or write operation; Indicate the query conditions; This represents the subgraph returned by the read interface; This represents the incremental subgraph to be written; This represents the unified threat knowledge graph after the merger. In the new round of analysis, this updated graph will serve as the unified threat knowledge graph for the new round of analysis. ; This represents the unified threat knowledge graph before the update. For graph merging operators.

[0149] The property update expression for writing to a node is:

[0150] For ease of description, any node involved in the write operation will be uniformly referred to as _____. Once this node is written into the unified threat knowledge graph, it becomes part of the global knowledge graph. In the new round of analysis, this node is used as... In Participate in calculation; This indicates the updated node attributes; Indicates the original node attribute value; The set of agents representing contributing nodes; Indicates that a timestamp is written; This indicates the initial confidence level during the write operation. If the node is a newly created node, then... If the node is an existing node, then The importance scores of the nodes mentioned above are calculated using a multilayer perceptron.

[0151] Through the aforementioned read / write interfaces, each agent can share read and write access to the unified threat knowledge graph, providing a data foundation for the generation of threat-perspective conclusion vectors and asset-perspective conclusion vectors.

[0152] Based on the above description, this application has the following beneficial effects: This application generates a seed subgraph through anchor mapping by a first intelligent agent; the second and third intelligent agents, starting from the same seed subgraph, extend in parallel along the first set of relations used to trace attacker identities and the second set of relations used to trace asset losses, respectively, to generate a threat perspective subgraph and an asset perspective subgraph, and calculate the confidence level of each subgraph; on the threat perspective subgraph, the second intelligent agent identifies the target attacker based on the degree of evidence correlation by screening candidate attackers, and extracts the tactical technology nodes used by the target attacker and calculates the attack tactical harm by combining them with the kill chain stage sequence number; on the asset perspective subgraph, the third intelligent agent calculates the overall asset impact by screening the set of affected assets and combining the business importance attributes of each asset with the associated CVE vulnerability information; the fourth intelligent agent, based on the collaborative analysis architecture of the perspective divergence correction comprehensive score, and the shared memory and evidence chain tracing mechanism of the unified threat knowledge graph, realizes a multi-dimensional comprehensive judgment of confirmed threats from attacker attribution, tactical harm assessment to asset impact analysis, which can improve the accuracy of threat analysis results.

[0153] The above text combined Figure 1 This application provides a detailed description of a threat intelligence analysis method based on multi-agent collaboration. The apparatus and devices provided in this application will be described below with reference to the accompanying drawings.

[0154] like Figure 2 As shown in the figure, this is a schematic diagram of a threat intelligence analysis device based on multi-agent collaboration provided in an embodiment of this application. The device includes: The acquisition module 201 is used to acquire the unified threat knowledge graph and receive confirmed threat data; The generation module 202 is used to enable the first intelligent agent to match fields in the confirmed threat data with the unified threat knowledge graph, generate a set of anchor nodes based on the matching nodes, and take a preset number of hops neighborhood in the unified threat knowledge graph as the center of each anchor node in the set, merge them to generate a seed subgraph, and send the seed subgraph to the second and third intelligent agents respectively; the second intelligent agent starts from the seed subgraph and expands along the first relation set to generate a threat perspective subgraph; the third intelligent agent starts from the seed subgraph and expands along the second relation set to generate an asset perspective subgraph. The calculation module 203 is used to calculate the threat perspective confidence on the threat perspective subgraph, the asset perspective confidence on the asset perspective subgraph, the attack tactical harm on the threat perspective subgraph, and the overall asset impact on the asset perspective subgraph. Analysis module 204 is used to calculate the target's comprehensive threat risk score based on the threat perspective confidence level, asset perspective confidence level, attack tactical harm level, and overall asset impact level, and to obtain the structured threat analysis results based on the target's comprehensive threat risk score.

[0155] Optionally, the calculation module 203 is specifically used to obtain the threat perspective confidence level based on the coverage of high-value evidence and the support of relationships in the threat perspective subgraph; and to obtain the asset perspective confidence level based on the coverage of high-value evidence and the support of relationships in the asset perspective subgraph.

[0156] Optionally, the calculation module 203 is specifically used to filter nodes of type attacker in the threat perspective subgraph to form a candidate attacker set; determine the importance score of each attacker node in the candidate attacker set based on the threat perspective subgraph; calculate the total evidence score of each candidate attacker based on the importance score of each attacker node in the candidate attacker set, the total evidence score being the sum of the importance scores of each node in the attacker's evidence node set; divide the total evidence score of each candidate attacker by the sum of the total evidence scores of all candidate attackers to obtain the attribution probability of each candidate attacker; select the attacker with the highest attribution probability as the target attacker and obtain the attribution probability of the target attacker; extract the tactical technology nodes used by the target attacker, sort them in descending order of importance score to obtain the tactical technology sequence; calculate the attack tactical harm degree based on the stage number and importance score of each tactical technology node in the kill chain in the tactical technology sequence.

[0157] Optionally, the calculation module 203 is also used to obtain a threat perspective conclusion vector based on the target attacker, the attribution probability of the target attacker, the tactical and technical sequence, and the attack tactical harm.

[0158] Optionally, the calculation module 203 is specifically used to filter nodes of type asset in the asset perspective subgraph to form a set of victim assets; extract the set of CVE vulnerability nodes associated with each asset in the set of victim assets; calculate the asset impact of each asset based on the business importance attribute value of each asset in the set of victim assets and the highest general vulnerability scoring system CVE score of the associated CVE vulnerability; and denoise or aggregate the asset impact of each asset to calculate the overall asset impact.

[0159] Optionally, the calculation module 203 is also used to determine the importance score of each asset node in the victim asset set based on the asset perspective subgraph; calculate the asset importance factor based on the importance score and business importance attribute value of each asset node in the victim asset set; and obtain the asset perspective conclusion vector based on the victim asset set, asset importance factor, CVE vulnerability node set, and overall asset impact.

[0160] Optionally, the analysis module 204 is specifically used to obtain a threat perspective risk score based on the attack tactical harm and threat perspective confidence; to obtain an asset perspective risk score based on the overall asset impact and asset perspective confidence; to obtain a comprehensive threat risk score based on the threat perspective risk score and the asset perspective risk score; to obtain a perspective divergence degree based on the absolute value of the difference between the attack tactical harm and the overall asset impact, and the absolute value of the difference between the threat perspective confidence and the asset perspective confidence; and to obtain a target comprehensive threat risk score based on the comprehensive threat risk score and the perspective divergence degree.

[0161] The threat intelligence analysis device based on multi-agent collaboration according to the embodiments of this application can correspond to the execution of the method described in the embodiments of this application, and the other operations and / or functions of each module / unit of the threat intelligence analysis device based on multi-agent collaboration are respectively for implementing Figure 1 For the sake of brevity, the corresponding processes of each method in the illustrated embodiments will not be described in detail here.

[0162] This application also provides a computing device. For example... Figure 3 As shown in the figure, this is a schematic diagram of a computing device provided in an embodiment of this application. The computing device 300 includes a bus 301, a processor 302, a communication interface 303, and a memory 304. The processor 302, the memory 304, and the communication interface 303 communicate with each other via the bus 301.

[0163] Bus 301 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0164] The processor 302 can be any one or more of the following processors: central processing unit (CPU), graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP).

[0165] Communication interface 303 is used for communication with external devices.

[0166] Memory 304 may include volatile memory, such as random access memory (RAM). Memory 304 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0167] The memory 304 stores executable code, and the processor 302 executes the executable code to perform the aforementioned threat intelligence analysis method based on multi-agent collaboration.

[0168] Specifically, in achieving Figure 2 In the case of the illustrated embodiment, and Figure 2 When the modules or units of the threat intelligence analysis device based on multi-agent collaboration described in the embodiments are implemented through software, the execution... Figure 2 The software or program code required for the functions of each module / unit can be partially or entirely stored in memory 304. Processor 302 executes the program code corresponding to each unit stored in memory 304, and executes the aforementioned threat intelligence analysis method based on multi-agent collaboration.

[0169] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the aforementioned threat intelligence analysis method based on multi-agent collaboration.

[0170] This application also provides a computer program product comprising one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in this application are generated.

[0171] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, microwave, etc.) means.

[0172] When the computer program product is executed by a computer, the computer performs any of the aforementioned methods of threat intelligence analysis based on multi-agent collaboration. The computer program product can be a software installation package; when any of the aforementioned methods of threat intelligence analysis based on multi-agent collaboration is required, the computer program product can be downloaded and executed on the computer.

[0173] The descriptions of the processes or structures corresponding to the above figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.

[0174] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. A threat intelligence analysis method based on multi-agent cooperation, characterized in that, The method includes: Acquire a unified threat knowledge graph and receive confirmed threat data; The first agent matches the fields in the confirmed threat data with the unified threat knowledge graph, generates an anchor node set based on the matching nodes, takes each anchor node in the anchor node set as the center, selects a neighborhood with a preset number of hops in the unified threat knowledge graph, merges them to generate a seed subgraph, and sends the seed subgraph to the second agent and the third agent respectively. The second agent starts with the seed subgraph and expands along the first relation set to generate a threat perspective subgraph; the third agent starts with the seed subgraph and expands along the second relation set to generate an asset perspective subgraph. The threat perspective confidence level is calculated on the threat perspective subgraph, and the asset perspective confidence level is calculated on the asset perspective subgraph. The second agent calculates the attack tactical harm level on the threat perspective subgraph; The third agent calculates the overall asset impact on the asset perspective subgraph. The fourth agent calculates the target's comprehensive threat risk score based on the threat perspective confidence level, the asset perspective confidence level, the attack tactical harm level, and the overall asset impact level. Based on the comprehensive threat risk score of the target, the structured threat analysis results are obtained.

2. The method according to claim 1, characterized in that, The step of calculating the threat view confidence on the threat view subgraph and calculating the asset view confidence on the asset view subgraph includes: The threat perspective confidence level is obtained based on the coverage of high-value evidence and the support of relationships in the threat perspective subgraph. The confidence level of the asset perspective is obtained based on the coverage of high-value evidence and the support of relationships in the asset perspective subgraph.

3. The method according to claim 1, characterized in that, The calculation yields the attack tactical harm level, including: Nodes of type attacker are filtered from the threat perspective subgraph to form a candidate attacker set; Based on the threat perspective subgraph, determine the importance score of each attacker node in the candidate attacker set; Based on the importance score of each attacker node in the candidate attacker set, the total evidence score of each candidate attacker in the candidate attacker set is calculated. The total evidence score of each candidate attacker is divided by the sum of the total evidence scores of all candidate attackers to obtain the attribution probability of each candidate attacker. The attacker with the highest attribution probability is selected as the target attacker, and the attribution probability of the target attacker is obtained; Extract the tactical and technical nodes used by the target attacker, sort them in descending order of importance score, and obtain the tactical and technical sequence; The attack tactical harm level is calculated based on the stage number and importance score of each tactical technology node in the kill chain in the tactical technology sequence.

4. The method according to claim 3, characterized in that, The method further includes: Based on the target attacker, the attribution probability of the target attacker, the tactical technique sequence, and the hazard degree of the attack tactics, a threat perspective conclusion vector is obtained.

5. The method according to claim 1, characterized in that, The calculation yields the overall asset impact, including: Select asset nodes from the asset perspective subgraph to form a set of victim assets; Extract the set of CVE vulnerability nodes associated with each asset in the set of victim assets; The asset impact of each asset is calculated based on the business importance attribute value of each asset in the set of affected assets and the highest general vulnerability scoring system CVE score of the associated CVE vulnerability. The asset impact of each asset is denoised or aggregated to calculate the overall asset impact.

6. The method according to claim 5, characterized in that, The method further includes: Based on the asset perspective subgraph, determine the importance score of each asset node in the victim asset set; Calculate the asset importance factor based on the importance score and business importance attribute value of each asset node in the victim asset set; Based on the set of affected assets, the asset importance factor, the set of CVE vulnerability nodes, and the overall asset impact, an asset-perspective conclusion vector is obtained.

7. The method according to claim 1, characterized in that, The calculation yields a comprehensive threat risk score for the target, including: Based on the severity of the attack tactics and the confidence level of the threat perspective, a threat perspective risk score is obtained; Based on the overall asset impact and the asset perspective confidence level, an asset perspective risk score is obtained; A comprehensive threat risk score is obtained based on the threat perspective risk score and the asset perspective risk score. The perspective divergence degree is obtained based on the absolute value of the difference between the attack tactical harm degree and the overall asset impact degree, and the absolute value of the difference between the threat perspective confidence degree and the asset perspective confidence degree. The target's comprehensive threat risk score is obtained based on the comprehensive threat risk score and the perspective divergence.

8. A threat intelligent analysis device based on multi-agent collaboration, characterized in that, The device includes: The acquisition module is used to acquire the unified threat knowledge graph and receive confirmed threat data. The generation module is used to enable a first intelligent agent to match fields in the confirmed threat data with the unified threat knowledge graph, generate an anchor node set based on the matching nodes, and take a preset number of hops neighborhood in the unified threat knowledge graph as the center of each anchor node in the anchor node set, merge them to generate a seed subgraph, and send the seed subgraph to a second intelligent agent and a third intelligent agent respectively; the second intelligent agent uses the seed subgraph as the starting point and expands along a first relation set to generate a threat perspective subgraph; the third intelligent agent uses the seed subgraph as the starting point and expands along a second relation set to generate an asset perspective subgraph; The calculation module is used to calculate the threat perspective confidence level on the threat perspective subgraph, the asset perspective confidence level on the asset perspective subgraph, the attack tactical harm level on the threat perspective subgraph, and the overall asset impact level on the asset perspective subgraph. The analysis module is used to calculate the target comprehensive threat risk score based on the threat perspective confidence level, the asset perspective confidence level, the attack tactical harm level, and the overall asset impact level, and to obtain the structured threat analysis results based on the target comprehensive threat risk score.

9. A computing device, characterized in that, Including memory and processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program for performing the method as described in any one of claims 1 to 7.

Images