Threat intelligence classification and evolution relationship analysis method

Abstract

A threat intelligence classification and evolution relationship analysis method is realized through a method in the field of network security. The method comprises: classifying threat types of the threat intelligence through a threat intelligence classification technology, and analyzing a time sequence evolution relationship among the threat intelligence through an evolution analysis technology of the threat intelligence; threat types being classified through four steps of information security element extraction, information security element relation construction, feature engineering and a classification model based on graph convolution attention; according to the threat intelligence evolution analysis technology, calculating whether a time sequence evolution relation exists between threat intelligence or not through two steps of calculating the evolution relation strength between the threat intelligence and constructing a threat intelligence evolution relation graph. According to the method provided by the invention, the information amount reflected by the intelligence is richer, and the application is convenient. And deeper analysis can be given in the aspect of information analysis.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for categorizing threat intelligence and analyzing evolutionary relationships. Background technique [0002] With the rapid development of the Internet and communication technology, it has also brought hidden dangers to network security. Most of the security problems are spread through the Internet. The scope of cyber attacks has spread from individuals to transportation, industry, energy, finance, aerospace, medical and other fields, seriously threatening the information security of the country and society. Especially in recent years, with the rapid development of emerging business forms such as "Internet +" and "smart manufacturing" and the introduction and realization of the concept of the Internet of Things, network and informatization have penetrated into all aspects of national production and life with an irresistible trend. The borders of safety, persona...

AI Technical Summary

Problems solved by technology

Not friendly to information security analysts who focus on a certain type of threat intelligence

The low quality of information mainly refers to the insufficient amount of information in the threat intelligence response.

Unanalyzed threat intelligence cannot reflect the whole picture of security incidents, and information security personnel

[0007] At present, the network security platform mainly provides some simple tactical threat intelligence, such as domain name, IP, file HASH, etc. These intelligences have a "short shelf life" and reflect a poor amount of information, making it difficult to apply

In terms of information analysis, only a simple correlation is given, and a deeper analysis is lacking

Images