Method and device for discriminating threat information credibility based on multi-dimensional trusted feature

Abstract

The embodiment of the present invention provides a method and a device for discriminating threat information credibility based on a multi-dimensional trusted feature. The method comprises the following steps: acquiring threat information to be detected; obtaining a verification threat information set corresponding thereto according to a category of the threat information to be detected; accordingto a content verification consistency recognition algorithm, calculating a similarity value between the threat information to be detected and the verification threat information; comparing the similarity value with a preset threshold value, and determining the threat information to be detected with the similarity value greater than the threshold as initial credibility threat information; extracting the multi-dimensional trusted feature of the initial trusted threat information, and constructing a multi-dimensional trusted feature vector; inputting the multi-dimensional trusted feature vector into a deep belief network DBN discriminant model, and outputting a credibility discrimination result of the initial trusted threat information. The embodiment of the present invention judges the threat information to be detected twice by using the content verification consistency method and the DBN discriminant model, thereby improving the accuracy of judging the threat information to be detected.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for judging the credibility of threat intelligence based on multi-dimensional credible features. Background technique [0002] Threat intelligence is a kind of knowledge information that describes threats based on evidence, including threat-related context information, methods and mechanisms used by threats, threat-related indicators, attack impacts, and countermeasures. The role of threat intelligence is to provide all clues to restore and predict attacks that have not occurred, to learn as much as possible about attackers’ motives, tactics, tools, resources, and behavioral processes, and to establish an effective security defense system. Due to the characteristics of large amount of information, high repetition rate and wide sources of threat intelligence, in practical applications, there may be misleading or confusing false information in the proce...

AI Technical Summary

Problems solved by technology

Due to the strong subjectivity of this discrimination method, and the unreliable threat intelligence stored in the blacklist database is not comprehensive, there are cases of misjudgment and missed judgment, which reduces the accuracy of judging the threat intelligence to be detected

Images