Method and system for fusing network threat intelligence metadata

Abstract

The invention designs a method and system for fusing network threat intelligence metadata, which are used for solving multi-source heterogeneous network threat intelligence conflicts. The method comprises the following steps: converting unstructured network threat intelligence data into structured network threat intelligence; mapping the structured network threat intelligence data and metadata; splitting the network threat intelligence metadata; fusing the network threat intelligence metadata; and providing the fused metadata for network security threat intelligence analysts in an interface form through a customized output template. According to the invention, the network threat intelligence data can be fused in a finer-grained manner, and the fused result is automatically configured.

Description

technical field [0001] The invention relates to the field of computer network security and can be used in the field of fusion or conflict resolution of network threat intelligence metadata. Background technique [0002] Threat intelligence is evidence-based knowledge that mainly includes scenarios, mechanisms, indicators, meanings, and actionable recommendations. Based on high-quality threat intelligence information, it can provide decision support for the subject to respond to existing or emerging threats. Metadata is defined as data describing data, descriptive information about data and information resources. Cyber ​​threat intelligence metadata refers to data that describes cyber threat intelligence data. For cyber threat intelligence data, it is also necessary to perform a standardized representation or description, so that it can be used for processing, analysis, and docking with other vendors or platforms. The corresponding entities are defined with reference to in...

AI Technical Summary

Problems solved by technology

[0005] At present, in the field of network threat intelligence fusion, the mainstream method is to fuse intelligence data based on rules, field mapping, templates, manual and other forms. The fusion granularity of these fusion methods is rougher, and the output of the fusion results is not flexible.

Images