Quality assessment method and device for multi-source threat intelligence

Abstract

The invention discloses a method and device for evaluating the quality of multi-source threat intelligence. The method includes: step 1, obtaining threat information from multiple sources that needs to be evaluated; Threat intelligence is normalized; step 3, based on a plurality of preset features, the quality of the threat intelligence is evaluated respectively, and an intelligence source sequence is generated according to the evaluation results. This method can accurately evaluate different intelligence sources. On the one hand, it can help enterprises make better investment decisions, purchase and use higher-quality intelligence sources; For intelligence sources with low evaluation accuracy, the overall credibility score of the threat intelligence sent by the intelligence source can be adjusted.

Description

technical field [0001] The invention relates to the technical field of Internet security, in particular to a method and device for evaluating the quality of multi-source threat intelligence. Background technique [0002] With the rapid development of the Internet, especially the mobile Internet, the network environment is becoming more and more complex, different attacks are more industrialized, gang-based, and intrusion methods are becoming more diverse and complex, which makes traditional security solutions continue to be challenged. Threat intelligence based on big data association analysis can promote enterprises and organizations to quickly understand internal threat information, thereby helping enterprises to take security precautions in advance, detect and respond to attacks faster, and trace the source of attacks more efficiently after the event. In this context, threat intelligence has attracted more and more attention from enterprises, and more and more enterprises...

AI Technical Summary

Problems solved by technology

[0005] However, the existing method has the following disadvantages: 1. It is impossible to judge the timeliness of intelligence products through past samples, and only timely threat intelligence has its value

2. The quantity of intelligence products cannot fully reflect the value of intelligence products, and it is impossible to judge the quality of intelligence that misses

3. There is no evaluation of intelligence richness, which can evaluate the comprehensive strength of intelligence vendors

4. There is no assessment of the differences between intelligence sources. The timeliness and differential performance of intelligence reflect whether intelligence vendors obtain intelligence through open source intelligence, and the intelligence produced by themselves

Images