Threat Intelligence Confidence Calculation via Belief Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to accurately determine the authenticity of threat intelligence with uncertain level of confidence, particularly in network behavior detection, where only the relation between IP addresses and domain names is obtained, making it difficult to ascertain the maliciousness of IP addresses and domain names.
Innovation Solution
A level-of-confidence calculation apparatus that collects relevant information using OSINT and network observation, generates a graph with threat intelligence and relevant information as nodes, and applies a belief propagation method to calculate the confidence level based on the confidence of accumulated threat intelligence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If machine-learning-type attack detection apparatuses are used to detect unknown attacks, then detection capability is improved, but the authenticity of extracted threat intelligence becomes ambiguous
Solution Approach 1:
The system segments the threat intelligence verification process into multiple independent components: OSINT collection module, network observation module, graph generation module, and belief propagation module. Each component handles a specific aspect of verification, allowing the system to maintain high detection capability while improving authenticity assessment through distributed analysis.
Solution Approach 2:
The patent introduces an intermediary verification system that acts as a mediator between machine-learning detection and threat intelligence authenticity. This intermediary collects relevant information from multiple sources, constructs relationship graphs, and applies belief propagation to calculate confidence levels, thereby resolving the ambiguity in authenticity assessment while preserving the detection capabilities of machine-learning methods.
2Speed
If only the relation between IP addresses and domain names is obtained from network behavior detection, then detection speed is improved, but the ability to ascertain maliciousness deteriorates
Solution Approach 1:
The system performs preliminary actions by pre-collecting and storing relevant information from OSINT sources and network observations before threat intelligence verification is needed. This pre-prepared information is then quickly retrieved and used in graph construction and belief propagation, maintaining fast detection speed while enabling comprehensive maliciousness assessment through pre-gathered contextual data.
Solution Approach 2:
The patent transitions from one-dimensional IP-address-to-domain-name relationships to multi-dimensional verification by incorporating additional information dimensions from OSINT sources, network observations, and contextual data. This dimensional expansion allows the system to maintain detection speed while significantly improving the ability to ascertain maliciousness through richer contextual analysis.
3Measurement precision
If analysts and operators manually verify threat intelligence through data analysis and information collection, then authenticity determination is improved, but time consumption increases
Solution Approach 1:
The system implements self-service by automatically collecting relevant information from OSINT sources and network observations, constructing relationship graphs, and performing belief propagation calculations without requiring manual analyst intervention. This automation maintains high authenticity determination capability while eliminating the time consumption associated with manual verification processes.
Solution Approach 2:
The patent implements feedback mechanisms where the system continuously collects verification results and confidence level calculations, using this feedback to improve future threat intelligence assessments. This automated feedback loop maintains high authenticity determination accuracy while reducing time consumption by eliminating repetitive manual analysis and enabling rapid iterative verification.
Data Source
AI summary
A level-of-confidence calculation apparatus includes a first collecting unit that collects relevant information related to first threat intelligence that is input; a second collecting unit that collects, from a memory unit storing threat intelligence to which a level of confidence is appended, second threat intelligence related to the relevant information; a generation unit that generates a graph in which the first threat intelligence, the relevant information, and the second threat intelligence are set as nodes and the nodes relating to related information are connected; and a calculating unit that calculates, by applying a belief propagation method to the graph, a level of confidence of the first threat intelligence based on a level of confidence of the second threat intelligence, and therefore a level of confidence of threat intelligence with uncertain level of confidence can be calculated.