The invention belongs to the field of electric
digital data processing, and particularly relates to a multi-source cross-
modal threat intelligence
processing method, device and equipment and a medium. Innovation of a
threat intelligence
processing normal form is realized through a technical
route of'double-layer progressive fusion ': a cross-
modal fusion layer focuses on heterogeneous feature deep
coupling of
natural language CTI and picture CTI, and mapping of
natural language semantics and visual information is realized by adopting a three-stage processing mechanism of'intra-
modal self-attention, cross-modal cross attention and LSTM
time sequence fusion'; and the multi-source alignment layer is used for carrying out joint modeling on CTI feature vectors subjected to cross-modal fusion, malicious codes and
log data, constructing a three-dimensional association network of a CTI
knowledge graph, a malicious code graph and a log
time sequence graph, and realizing cross-source
semantic space unification through a heterogeneous graph
attention network. The problems that when a traditional
threat intelligence processing method faces multi-source cross-
modal data, collection and integration are difficult, preprocessing is insufficient, cross-modal
feature fusion is difficult, and
knowledge graph construction is imperfect are solved.