111 results about "Cyber threat intelligence" patented technology

The invention belongs to the technical field of network security, and particularly discloses a network security knowledge graph construction and attack path prediction method, which comprises the following steps: acquiring an attack mode of network threat intelligence; constructing a network security knowledge graph based on the security vulnerability and attack pattern classification standard data and the attack pattern of the network threat intelligence; according to the method, an entity relationship in a network security knowledge graph is predicted based on a graph attention network GAT of text enhancement, an attack path is constructed based on the predicted entity relationship, and text enhancement is to introduce text information corresponding to entity nodes into a multi-head attention mechanism layer of the GAT. According to the method, the network security knowledge graph is constructed and the entity relationships are predicted based on the GAT, so that the entity relationships can be quickly integrated, the attack paths are constructed, the paths reveal security holes and attack modes which may be utilized by attackers, and accurate and efficient attack path prediction can be realized.

The invention discloses a network threat deduction system and method based on Transform and a graph attention network model. The system mainly comprises four modules including a threat intelligence extraction module, a network threat entity construction module, a network threat deduction module and a deduction result application module. The method comprises the following steps: preprocessing and mining network security threat intelligence data by utilizing a graph attention network (GAT) model, constructing a complete network threat intelligence knowledge graph based on a data association relationship, and determining a vulnerability utilization weight in the graph; modeling is carried out on a reasoned path sequence based on a Transform model, a next reasoning sequence is predicted in a generative mode, and rapid and efficient network threat intelligence reasoning is achieved. According to the method, the complexity of attack deduction calculation is reduced, the deduction efficiency is improved, and security risk investigation and early warning can be carried out for a large-scale network environment.

The invention discloses a network threat knowledge graph construction method based on SecBABC. The method can be applied to construction of a network threat knowledge graph. The method comprises the following steps: collecting existing network information, and constructing a network threat domain ontology CTDOM according to an STIX network threat information standard; the method comprises the following steps: constructing a SecBABC knowledge extraction model, capturing a complex semantic relationship between network threat intelligence through a pre-training model SecBert, constructing an adversarial training sample by using PGD, optimizing semantic understanding errors and inaccuracy conditions, updating model parameters through BiLSTM, and finally decoding entities and relationships of the network threat intelligence through CRF; constructing an entity alignment algorithm EAABNA, and performing knowledge fusion from two aspects of entity names and entity attributes; and constructing a network threat knowledge graph by using the fused network threat knowledge. By applying the knowledge extraction model constructed by the method, network threat intelligence can be effectively identified and extracted, and the efficiency and accuracy of knowledge graph construction are improved.

Aspects described herein may relate to cyber threat detection based on threat context and / or threat changes. Cyber threat intelligence (CTI) data may be received from a CTI provider. Endpoint data that indicates evidence that endpoints are cyber threats may be determined based on the CTI data. The endpoint data may be analyzed and / or compared to stored data associated with the endpoint. The analysis and / or comparison may be performed to determine whether evidence that the endpoint is a cyber threat has changed. Based on any changes, dispositions for the endpoint may be determined and sent. The dispositions may change how devices filter network traffic associated with the endpoint. Alternatives to default dispositions may be determined based on a impact of blocking potentially legitimate network traffic to and / or from the endpoints. Machine-learning models may assist in processing and analyzing CTI data, performing threat monitoring, and / or determining feeds that include the dispositions.

Techniques are described herein for providing artificial intelligence mediated curation of access and content within a cyber threat intelligence platform. An example system includes: one or more memories, and one or more processors. The example system may receive, from a node, an input indicating a cyber threat type; identify, by a trained AI model, cyber threat intelligence content objects, each of the objects being (a) contributed by one or more nodes having access to the distributed ledger or (b) generated by the trained AI model; evaluate, by the trained AI model, each object to: determine relevance values corresponding to each of object, and generate (i) a curated set of cyber threat intelligence content objects based on the relevance values and (ii) a recommended cyber threat practice; and transmit the recommended cyber threat practice and an indication of the curated set of cyber threat intelligence content objects to the node.

The invention discloses a network threat knowledge automatic extraction method, electronic equipment and a storage medium, and the method comprises the following steps executed by a computer hardware system: collecting threat intelligence data related to an APT organization from a multi-source network security text, and processing the threat intelligence data to generate a standardized corpus; using the pre-training sentence vector model to generate semantic embedding for a corpus input text and a manual annotation example library text, and retrieving similar examples to construct an ICL prompt template; inputting a large language model subjected to LoRA fine tuning, and extracting structured triples of multiple types of entities and semantic relationships; generating standardized entity nodes and updated relation information by adopting semantic aggregation; and constructing an APT organization network threat intelligence knowledge graph and outputting a structured file. The method provides key technical support for APT attack tracing, threat situation awareness and automatic security policy generation.

The invention discloses a broadcast television network security operation method and system based on a large model, and the method comprises the steps: collecting log, network flow and terminal behavior data in real time, storing the data in a Kafka message queue, receiving the data through an AI intelligent noise reduction module, extracting alarm text semantic features through an XLM-ROBERTa model, and carrying out the noise filtering through combining with a multi-classification model, thereby obtaining high-value data; inputting the high-value data and security document knowledge corresponding to the network threat intelligence into an RAG knowledge base module, generating enhanced context information data through knowledge extraction, vectorization storage and similarity retrieval, inputting the enhanced context information data into a cue word of a reply model, and outputting a first threat analysis reply; inputting the high-value data and the first threat analysis reply into a multi-model MOE architecture, distributing tasks through a gating network, integrating expert network output results, and generating a second threat analysis reply and a corresponding attack thermodynamic diagram; and executing feedback optimization operation of the corresponding module based on the second threat analysis reply, thereby improving the safety operation efficiency of the broadcast television network.

Techniques are described herein for providing leveraging proof-of-contribution on a distributed cyber threat intelligence platform. An example system includes one or more memories, and one or more processors. The system may receive, from a node, an input associated with cyber threat intelligence; store, by a smart contract of the smart contracts engine, the input in a distributed ledger as part of a set of cyber threat intelligence content, the distributed ledger being accessible by one or more nodes; evaluate, by a trained AI model of the AI engine, a proof-of-contribution protocol for the node by: validating the input as received from the node, and determining a valuation of the input to the set of cyber threat intelligence content; and adjust a level of voting power allocated to the node, in accordance with the valuation.

A method can include determining, by one or more processing circuits, a cybersecurity resilience posture of an entity. The method can include identifying or generating, by the one or more processing circuits, at least one token comprising a proof or a posture state corresponding with the cybersecurity resilience posture of the entity. The method can include determining, by the one or more processing circuits using a cyber threat intelligence (CTI) model, at least one of a quantitative value or a qualitative value corresponding to the at least one token. The method can include updating, by the one or more processing circuits, a cybersecurity profile of the entity corresponding to at least one protection product.

The invention discloses a network threat intelligence analysis attack scene graph (ASG) generation method based on deep learning and natural language processing. The method combines a deep learning model and a natural language processing technology, and improves the efficiency and accuracy of attack scene graph generation. The method comprises the steps that network threat intelligence is collected, an improved BERT-BiLSTM-CRF model is used for entity recognition, and threat attack entities are recognized in combination with a regular expression; carrying out core anaphora analysis by adopting a CR-M-SpanBERT model, and capturing a semantic context dependency relationship between entities; extracting a bidirectional context semantic dependency relationship of the text by using a dependency analysis technology, and generating an embedded representation in combination with RoBERTa-BiGRU; and finally, triple information is extracted based on a BERT-RE model, and an attack scene graph is generated. According to the method, the processing capability of the complex network threat intelligence data is improved, the robustness and adaptability are high, and the method is particularly suitable for multi-mode threat intelligence.

In one example method metadata about one or more entities of a ransomware threat and one or more relationships between the one or more entities of the ransomware threat is extracted from received cyber threat intelligence data by a threat decipher engine. The metadata about the one or more entities of the ransomware threat and the one or more relationships between the one or more entities of the ransomware threat is stored in a repository. A ransomware attack type included in received security sensor data is predicted by a threat prediction engine based on the metadata about the one or more entities of the ransomware threat and the one or more relationships between the one or more entities of the ransomware threat.

The invention discloses a threat intelligence triple combined extraction method based on data enhancement, comprising a data enhancement method which is responsible for performing multi-granularity high-quality expansion on a small amount of data in the field of threat intelligence through a data enhancement method based on a large model. And the syntactic information fusion method is responsible for analyzing an input sentence into a component tree and a dependency tree, extracting information in the component tree and the dependency tree by combining a Tree-GRU syntactic fusion algorithm to obtain a syntactic dependency matrix, and fusing the syntactic dependency matrix into an extraction model to enhance the understanding of the syntactic dependency matrix on an explicit text structure and semantics. And the form filling extraction method is responsible for simultaneously representing and extracting entities and relationships in sentences in the same form through a joint extraction algorithm based on a form filling method so as to enhance interaction between the entities and the relationships, and introducing an adversarial training mechanism based on an MDA method in training so as to enhance robustness and generalization ability of the model. The invention provides a new design thought for solving the problem of insufficient labels in the network threat intelligence triple extraction field and extracting complex, long and difficult sentences.

The present invention relates to a method for generating network threat rules based on threat intelligence, and relates to the field of network security. This application crawls open-source network threat intelligence; uses image analysis prompts to guide a multi-modal language model to convert image-based open-source network threat intelligence into text-based; unifies the content format to obtain initial network threat intelligence; uses a language model to assist in filtering the initial network threat intelligence; an agent uses a voting method to identify the first type of entity and the second type of entity from the filtered network threat intelligence and establish a connection; uses Sigma rules to create prompts to control the agent to create Sigma rules based on the associated first type of entity and the second type of entity extracted from the network threat intelligence block in the filtered network threat intelligence block; uses Sigma rules to optimize prompts, and Sigma rule verification prompts control the language model used by the agent to optimize and verify the generated Sigma rules.

A threat intelligence gateway (TIG) may protect TCP / IP networks from network (e.g., Internet) threats by enforcing certain policies on in-transit packets that are crossing network boundaries. The policies may be composed of packet filtering rules with packet-matching criteria derived from cyber threat intelligence (CTI) associated with Internet threats. These CTI-derived packet-filtering rules may be created offline by policy creation and management servers, which may distribute the policies to subscribing TIGs that subsequently enforce the policies on in-transit packets. Each packet filtering rule may specify a disposition that may be applied to a matching in-transit packet, such as deny / block / drop the in-transit packet or pass / allow / forward the in-transit packet, and also may specify directives that may be applied to a matching in-transit packet, such as log, capture, spoof-tcp-rst, etc. Often, however, the selection of a rule's disposition and directives that best protect the associated network may not be optimally determined before a matching in-transit packet is observed by the associated TIG. In such cases, threat context information that may only be available (e.g., computable) at in-transit packet observation and / or filtering time, such as current time-of-day, current TIG / network location, current TIG / network administrator, the in-transit packet being determined to be part of an active attack on the network, etc., may be helpful to determine the disposition and directives that may best protect the network from the threat associated with the in-transit packet. The present disclosure describes examples of methods, systems, and apparatuses that may be used for efficiently determining (e.g., accessing and / or computing), in response to the in-transit packet, threat context information associated with an in-transit packet. The threat context information may be used to efficiently determine the disposition and / or one or more directives to apply to the in-transit packet. This may result in dispositions and / or directives being applied to in-transit packets that better protect the network as compared with solely using dispositions and directives that were predetermined prior to receiving the in-transit packet.

Disclosed is a cyber threat intelligence platform configured to: a) designate a virtual machine as an attacker machine; b) designate a virtual machine as a victim machine; c) receive cyberattack data representative of a cyberattack executed by the attacker machine against the victim machine; e) receive defense action data representative of a defense action executed by the victim machine against the cyberattack; f) mark a first point in time when the cyberattack is executed, and mark a second point in time when the defense action is initiated; g) compare the first point in time with the second point in time to ascertain an attack-defense time lapse as a performance measure for computer system threat management of cyberattacks or defense actions, and h) view or analyze cyberattack and defense actions for effectiveness, including perspectives derived from the relative timing of the actions as indicated on the time lapse.

Techniques are described herein for providing a distributed cyber threat intelligence platform. An example system includes a set of cyber threat intelligence content stored on a distributed ledger accessible by one or more nodes. The example system further includes an artificial intelligence (AI) engine configured to: receive a node input from a new device indicating a node type to be established for the new device, generate one or more responses to the node input, and establish a new node for the new device on the distributed ledger that corresponds to the node type. The example system further includes a smart contracts engine configured to: receive, from the new node, a second input associated with cyber threat intelligence, store the second input in the distributed ledger as part of the set of cyber threat intelligence content, and transmit the second input to the one or more nodes.

The invention relates to the technical field of power information network threat intelligence analysis, and provides a power information network multi-source threat intelligence analysis method, system and device and a medium, and the method comprises the steps: obtaining to-be-analyzed multi-source threat intelligence data of a power information network; performing attack entity relationship extraction analysis on the text intelligence data according to a preset attack entity data model and a preset entity association mode table to generate an attack reconstruction main graph; carrying out attack entity relationship extraction analysis on the attack vulnerability codes based on a preset code large model and an attack entity retrieval database to generate a plurality of attack reconstruction sub-graphs; and combining the attack reconstruction main graph and the attack reconstruction sub-graphs to generate a target attack reconstruction graph. According to the method, an attack entity relationship extraction mechanism based on a unified attack entity data model is combined with a multi-source attack graph reconstruction mechanism, so that the accuracy and comprehensiveness of attack entity recognition are improved, the reliability of threat detection and attack tracing is ensured, and the security defense capability of the electric power information network is improved.

A system includes a processing device, operatively coupled to memory, to receive a prompt that is associated with a potential security threat on a computer network. The system applies a first large language model (LLM) to the prompt to generate a first instruction that is associated with a first agent that is to handle the first instruction, and routes the first instruction to the first agent. The first agent applies a second LLM in association with a first data source to obtain a first data that is associated with the potential security threat. The system applies a third LLM at least to the first data, to generate a data output that is associated with the potential security threat on the computer network.

Techniques are disclosed relate to systems, methods, and non-transitory computer readable media for implementing a browser extension for cyber threat intelligence and response. One system to perform operations comprising: scanning, in a sandbox of a browser by a browser extension, at least part of a web page to produce a set of items of interests; transmitting the set of items of interests to a cloud-based enrichment and analysis of cybersecurity threat intelligence system to request information on the set of items; receiving a response from the cloud-based enrichment and analysis of cybersecurity threat intelligence system, the response including a scan result based on the transmitted set of items of interests, and the scan result including at least one of an indicator of compromise of the at least scanned part of the web page; and displaying the scan results including the at least one of an indicator of compromise.

Aspects described herein may relate to cyber threat detection based on threat context and / or threat changes. Cyber threat intelligence (CTI) data may be received from a CTI provider. Endpoint data that indicates evidence that endpoints are cyber threats may be determined based on the CTI data. The endpoint data may be analyzed and / or compared to stored data associated with the endpoint. The analysis and / or comparison may be performed to determine whether evidence that the endpoint is a cyber threat has changed. Based on any changes, dispositions for the endpoint may be determined and sent. The dispositions may change how devices filter network traffic associated with the endpoint. Alternatives to default dispositions may be determined based on a impact of blocking potentially legitimate network traffic to and / or from the endpoints. Machine-learning models may assist in processing and analyzing CTI data, performing threat monitoring, and / or determining feeds that include the dispositions.

The present disclosure provides a system for generating cyber threat intelligence. The system includes a plurality of honeynets configured to emulate one or more services; a plurality of sensors, each sensor associated with a honeynet, each sensor configured to detect cyberattacks on the associated honeynet; a data collector configured to receive data relating to the cyberattacks on the plurality of honeynets; and a computing device configured to detect, from the sensors, one or more cyberattacks on the honeynets based on analysis of network traffic through the honeynets; extract, from detected cyberattacks on the honeynets, a detailed forensic data log based on analysis of content of the data packets pertaining to the cyberattacks on the honeynets; and transmit the detailed forensic data log to the data collector. The data collector stores the detailed forensic data log for further analysis in order to generate cyber threat intelligence.

The invention provides a quantitative evaluation method for network threat intelligence quality, and relates to the technical field of network security, and the method comprises the steps: determining the quality evaluation field of network threat intelligence, the quality evaluation field having a plurality of evaluation samples; obtaining M quality factors corresponding to the quality evaluation field, randomly selecting N quality factors as target quality factors, and based on the target quality factors, carrying out weight sorting on the evaluation sample to obtain a sorting sequence, and then establishing a network threat intelligence quality evaluation model; and applying the network threat intelligence quality evaluation model to a preset field, and performing quantitative evaluation on the network threat intelligence quality evaluation model to obtain a quality evaluation score of the preset field. By clearly defining and quantifying the assessment indexes of the threat intelligence, the influence of subjective judgment of experts on the network threat intelligence quality assessment result is reduced, and the accuracy and comprehensiveness of the network threat intelligence quality assessment result are improved.

In an embodiment, the present invention provides a computer-implemented, machine learning method for guided programming of autonomous agents. A large language model (LLM) prompt is intercepted between an LLM autonomous agent and an LLM. A guiding prompt is selected from a plurality of guiding prompts to inject into the LLM prompt based on a context of the LLM prompt. A modified LLM prompt that includes the selected guiding prompt is sent to the LLM. The modified LLM prompt and answer generated by the LLM is forwarded to the LLM autonomous agent. The method has applications including, but not limited to, use cases in medicine / healthcare, Cyber Threat Intelligence and performance portability of computer code, to optimize processes or predictions or to support decision making.

The embodiment of the invention provides a multi-source information fusion processing method and device, equipment and a medium, and the method comprises the steps: carrying out the quality evaluation of each external information source under a plurality of different information source quality evaluation dimensions after obtaining first network threat information data and second network threat information data, and obtaining a plurality of quality evaluation scores; weighting to obtain a quality comprehensive score corresponding to each external intelligence source; when the first network threat intelligence data determines that the target address information is unknown address information, determining a determination result of each second network threat intelligence data on the target address information, and allocating different count values to each external intelligence source based on the determination result; and determining a weighting coefficient of the corresponding external intelligence source based on the quality comprehensive score, performing weighted fusion according to the weighting coefficient and the corresponding count value under each external intelligence source to obtain a multi-source intelligence fusion value, and determining a malicious address judgment result of the target address information based on the multi-source intelligence fusion value, so that the recognition accuracy of the malicious address can be improved.

The invention relates to the technical field of crossing of artificial intelligence and network security, in particular to a network threat intelligence structured processing method and system based on artificial intelligence. The method comprises the following steps: acquiring unstructured original threat intelligence and performing credibility evaluation on an intelligence source; based on a large language model and knowledge graph enhanced retrieval, a step-by-step analysis plan for original threat intelligence is generated; dynamically calling a tool to execute an information extraction subtask corresponding to each step in the analysis plan to obtain a preliminary extraction result; performing multi-dimensional confidence evaluation on the preliminary extraction result; and taking the preliminary extraction result with the confidence higher than or equal to a threshold as a final result, and outputting the final result in a formatting manner and updating the final result to the knowledge graph. According to the method, the problem that unstructured multi-mode threat intelligence is difficult to convert into structured data which is readable by a machine, self-consistent in logic and capable of being put into actual combat in the prior art is solved, and the improvement of attack chain understanding depth and integrity is realized.

The invention discloses a network security risk knowledge graph triple joint extraction method based on Transform. The method specifically comprises the following steps: step 1, constructing a network security knowledge graph ontology oriented to network threat intelligence; step 2, collecting network threat intelligence in the network security field, extracting text data in the network threat intelligence in the network security field, segmenting and labeling the text data according to statements to generate a data set, and dividing the text data into a training set and a data set; step 3, constructing a joint relation triple extraction model; 4, training the constructed joint relation triple extraction model by adopting a training set; 5, inputting the test set into the extraction model, and evaluating the performance of the extraction model; and step 6, performing network security risk knowledge graph triple joint extraction by using the tested model. The problem that in the prior art, the extraction precision of the triad is poor due to the fact that global association of the text data sequence and association between the entity pair and the relation sequence are ignored is solved.

Endpoint system comprising an endpoint agent configured for deployment on a computing machine, a backend server adapted to curate and update intelligence fingerprints, a communication module within said agent enabling it to request and receive the latest intelligence fingerprints from said backend server, and a mechanism within said agent to directly analyse network packet details. The system may comprise logless technology and operate independently of threat intelligence platforms (TIPs) and Security Information and Event Management (SIEM) systems. The system may identify adversary inndicators such as unusual agent strings, uncommon IP addresses, or patterns inconsistent with command-and-control servers. The system may also comprise an automated response system.

The present invention discloses an APT detection method that integrates cloud-network-end logs and threat knowledge. The cloud-network-end fusion logs of multiple platforms are collected and processed into a four-tuple sequence in process units and time order to construct an origin graph of the cloud-network-end. Attack entities and entity relationships are extracted from network threat intelligence to form an attack causal graph, which is used in cloud-network-end APT detection. The present invention collects cloud-network-end fusion logs of multiple platforms and extracts attack causal graphs from network threat intelligence. It does not rely on manual work, thereby avoiding the formulation of a large number of rules, helping security industry personnel to more accurately and efficiently identify cloud-network-end fusion APT attacks, thereby achieving effective detection of cloud-network-end fusion APTs.

Systems, methods, and apparatuses are described for detection and / or analysis of cyber threats based on updated cyber threat intelligence associated with cyber threats. Packet filtering output data such as logs of packet communications and / or copies of packets may be generated based on first cyber threat intelligence associated with a cyber threat. Updated criteria based on subsequent updated cyber threat intelligence may then be applied to the packet filtering output data.

According to the network threat analysis method and system based on the learning evolutionary game provided by the invention, the expected benefit of sharing is analyzed through modeling, quantitative analysis is carried out by adopting the learning evolutionary game, and a reasonable incentive strategy is obtained, so that the sharing and utilization efficiency of network threat intelligence is promoted; each entity enterprise inquires from the open community to obtain the required threat intelligence, analyzes the threat intelligence and deploys own network defense measures, so that the network security defense capability is improved, and the problems that in the prior art, the capability of providing a large number of resources is difficult, the data sharing and exchanging capability is weak, and a large number of continuous network attacks are difficult to defend are solved.