Threat intelligence oriented security knowledge graph construction method and system

Abstract

The invention relates to a threat intelligence oriented security knowledge graph construction method and system. The method comprises the following steps: 1) acquiring structured data and unstructureddata of threat intelligence; 2) performing knowledge extraction on the collected structured data and unstructured data to obtain a threat information entity and a relationship between entities; 3) constructing a graph-based ontology mode, in which nodes represent threat information entities and edges represent relationships among the threat information entities; and 4) storing the threat information entity extracted in the step 2) and the relationship between the entities into a graph database according to the graph-based ontology mode constructed in the step 3) to form a knowledge graph of the threat information. The graph database is further used to provide a query service and a visual display function. According to the method, the knowledge graph technology is applied to the field of threat intelligence, the security knowledge graph oriented to the threat intelligence is constructed, dispersed intelligence is fused, and meanwhile the analysis capability of the threat information isimproved.

Description

technical field [0001] The invention belongs to the field of computer network security, and relates to a method for constructing a knowledge graph, and more specifically, to a method and system for constructing a security knowledge graph oriented to threat intelligence. Background technique [0002] In recent years, the cyberspace security environment has become increasingly complex. With the advancement of technology, the cyber attacks launched by criminals have become more and more advanced and covert. In particular, advanced persistent threat (APT) attacks have shown frequent occurrences, and traditional defense measures cannot meet the requirements. current security needs. In this context, threat intelligence, an emerging technology, emerged as the times require. Threat intelligence describes security entities and associated relationships in cyberspace, provides decision-making basis for threat response, and has become the cornerstone of building a new generation of cyb...

AI Technical Summary

Problems solved by technology

[0005] The present invention proposes a threat intelligence-oriented security knowledge map construction method and system. By applying the knowledge map technology to the field of threat intelligence, it solves the current problems of multi-source heterogeneity of threat intelligence and weak information analysis capabilities.

Images