Threat Intelligence Exploitation and Reproduction Method Based on Statistical Learning

Abstract

The present invention proposes a threat intelligence utilization and propagation method based on statistical learning, which is applied in the field of network security. Based on limited known threat intelligence, through statistical learning, a large number of unknown threat intelligence is discovered to realize the propagation of threat intelligence. To evade security detection, cyberattacks are changing at an ever-increasing rate, resulting in an increase in the volume and shortening of the timeliness of threat intelligence. A security detection model that only uses known threat intelligence will be affected by the model degradation problem and its accuracy will decrease. Based on the statistical learning algorithm, the present invention introduces credibility, replaces the static threshold, and improves the ability of the model to identify unknown threats; the method supports multiple heterogeneous detection models, and realizes multi-model collaborative defense based on the comparison of credibility; the method introduces The sliding time window concept enables the detection model to quickly absorb emerging threat intelligence and effectively forget outdated intelligence.

Description

technical field [0001] The invention belongs to the field of computer network security. Background technique [0002] In order to evade security detection, network attackers continue to improve the attack methods used, such as Domain Generate Algorithm (DGA), which can generate a large number of malicious domain names, allowing network attacks to bypass security firewalls and threaten user computer security. Constantly updated attack methods have led to a surge in the number of threat intelligence and shortened timeliness. Traditional security detection models that only use known threat intelligence will be affected by model degradation and cannot accurately detect many new threat intelligence. Therefore, threat intelligence detection methods are required to build a more comprehensive detection model based on known limited intelligence to deal with undiscovered threats. Contents of the invention [0003] The purpose of the present invention is to alleviate the problem th...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to alleviate the problem that the traditional security monitoring model faces massive and time-sensitive threat intelligence, which leads to the degradation of the model, which leads to the decline of prediction accuracy, and provides a threat intelligence utilization and propagation method based on statistical learning

Images