CN115687979A - Identification method and device, electronic equipment, and storage medium of specified technology in threat intelligence - Google Patents

Abstract

The application provides a method and a device for identifying a specified technology in threat information, electronic equipment and a storage medium, wherein the method comprises the following steps: preprocessing the network threat information to obtain a word sequence corresponding to each paragraph in the network threat information; after adding word masks to the word sequence, inputting the trained shape-filling model to obtain predicted words which are output by the shape-filling model and correspond to the word masks; inputting the word sequence into a trained technical classification model, obtaining multiple prediction categories output by the technical classification model and a confidence coefficient corresponding to each prediction category, and selecting a plurality of prediction categories with the confidence coefficients higher than the first as target prediction categories corresponding to the paragraphs; judging whether any target prediction category corresponding to the paragraph exists or not according to each paragraph, wherein the target prediction category comprises a prediction word corresponding to the paragraph; and determining whether the paragraph comprises the specified technology according to the judgment result corresponding to each paragraph. The method and the device can accurately identify the content describing the specified technology from the network threat intelligence.

Description

Identification method and device, electronic equipment, and storage medium of specified technology in threat intelligence

technical field

The present application relates to the technical field of network security, and in particular to a method and device for identifying a specified technology in threat intelligence, electronic equipment, and a computer-readable storage medium.

Background technique

Threat intelligence is defined as "evidence-based knowledge, including context, mechanisms, indicators, implications, and recommendations for actionable, Hazardous Response". Threat intelligence in the field of cybersecurity, or cyber threat intelligence, can provide relevant information in a timely manner, such as the characteristics of an attack, and help reduce the uncertainty in identifying potential security vulnerabilities and attacks. Individuals or businesses can obtain cyber threat intelligence from social media (e.g., blogs), vendor (Microsoft, Cisco, etc.) announcements, hacker forums, and more.

However, the format of cyber threat intelligence is not fixed, and there may be standard identifications for the technologies involved, and it is impossible to only have descriptive instructions without standard identifications. For example: For the "Sudo and Sudo Caching" technique, Cyber Threat Intelligence may have the representation "T1548.003 Sudo and Sudo Caching" that directly states the name of the technique, or the representation that uses text to describe it "Adversaries may perform sudo caching and /or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges".

For users of cyber threat intelligence (individuals or enterprises), there may be some technologies that need special attention, so as to use these technologies to improve the ability to resist cyber threats. Therefore, there is an urgent need for a solution that can accurately identify specified technologies from cyber threat intelligence.

Contents of the invention

The purpose of the embodiments of the present application is to provide a method and device for identifying specified technologies in threat intelligence, electronic equipment, and a computer-readable storage medium, for accurately identifying content related to specified technologies from network threat intelligence.

In one aspect, the present application provides a method for identifying specified technologies in threat intelligence, including:

Preprocessing the cyber threat intelligence to obtain a sequence of words corresponding to each paragraph in the cyber threat intelligence;

For the word sequence corresponding to each paragraph, after adding a word mask for the word sequence, input the trained cloze model to obtain the predicted words corresponding to the word mask output by the cloze model;

For the word sequence corresponding to each paragraph, input the word sequence into the trained technology classification model, obtain the multiple prediction categories output by the technology classification model and the confidence corresponding to each prediction category, and select the highest confidence level Several prediction categories of , as the target prediction category corresponding to the paragraph; wherein, each prediction category indicates a technology name belonging to a specified technology;

For each paragraph, determine whether there is any target prediction category corresponding to the paragraph, including the prediction words corresponding to the paragraph;

According to the judgment result corresponding to each paragraph, it is determined whether the paragraph includes the specified technology.

Through the above measures, after the network threat intelligence is split into multiple paragraphs, the specified technology is identified for each paragraph with the help of the cloze model and the technology classification model, so as to accurately identify the paragraphs with content related to the specified technology.

In one embodiment, before the preprocessing of the cyber threat intelligence to obtain the word sequence corresponding to each paragraph in the cyber threat intelligence, the method further includes:

For the network threat intelligence, perform regular matching with multiple technical names under the specified technology, and determine whether any technical name can be matched;

If any technology name is matched, determining that the cyber threat intelligence includes the specified technology;

If no technical name can be matched, proceed to the steps described in Preprocessing Cyber Threat Intelligence.

Through the above measures, the specified technology in the network threat intelligence can be quickly identified when the network threat intelligence contains the technical name under the specified technology, thereby reducing the workload of the identification task.

In one embodiment, the preprocessing of the cyber threat intelligence to obtain the word sequence corresponding to each paragraph in the cyber threat intelligence includes:

Divide said cyber threat intelligence into paragraphs;

Perform word segmentation for each paragraph, and filter out stop words and invalid words from word segmentation results;

For each paragraph, stem extraction is performed on the filtered word segmentation result to obtain a word sequence corresponding to the paragraph.

Through the above measures, the network threat intelligence can be processed into word sequences corresponding to several paragraphs.

In one embodiment, the cloze model is trained as follows:

For the sample corpus in the sample data set, replace at least one word in the sample corpus with a word mask to obtain a specified sample corpus;

Inputting the specified sample corpus into the pre-training model to obtain a sample prediction result corresponding to the word mask in the specified sample corpus;

According to the sample prediction results corresponding to the word masks in the specified sample corpus and the replaced words, the model parameters of the pre-trained model are adjusted to obtain a cloze model.

Through the above measures, the cloze model can be trained.

In one embodiment, the sample corpus includes technical names and technical descriptions;

The replacing at least one word in the sample corpus with a word mask includes:

select a word from the technical names contained in the sample corpus, and replace it with a word mask; and/or,

Select a relevant word of the specified technology from the technical description contained in the sample corpus, and replace it with a word mask; and/or,

Randomly select at least one word in the sample corpus and replace it with a word mask.

Through the above measures, the sample corpus can be processed into a specified sample corpus.

In one embodiment, the technology classification model is trained as follows:

Inputting the technical description included in the sample corpus in the sample data set to the classification model, and obtaining the sample prediction category output by the classification model;

According to the difference between the sample prediction category of the sample corpus and the technology names contained in the sample corpus, adjust the model parameters of the classification model to obtain a technology classification model.

Through the above measures, a technology classification model can be trained.

In an embodiment, the determining whether the paragraph includes the specified technology according to the judgment result corresponding to each paragraph includes:

If the judgment result corresponding to any paragraph indicates that there is a target prediction category including the predicted word, it is determined that the paragraph includes the specified technology;

If the judgment result corresponding to any paragraph indicates that there is no target prediction category including the predicted word, it is determined that the paragraph does not include the specified technology.

Through the measures described above, several passages containing specified techniques can be identified from cyber threat intelligence.

On the other hand, this application also includes a device for identifying technologies specified in threat intelligence, including:

A preprocessing module, configured to preprocess the cyber threat intelligence to obtain a word sequence corresponding to each paragraph in the cyber threat intelligence;

The first prediction module is used for the word sequence corresponding to each paragraph, after adding a word mask for the word sequence, input the trained cloze model, and obtain the output corresponding to the word mask of the cloze model predicted words of the code;

The second prediction module is used to input the word sequence corresponding to each paragraph into the trained technology classification model, and obtain various prediction categories output by the technology classification model and the confidence corresponding to each prediction category , and select several prediction categories with higher confidence levels as the target prediction category corresponding to the paragraph; wherein, each prediction category indicates a technical name belonging to a specified technology;

A judging module, for each paragraph, judging whether there is any target prediction category corresponding to the paragraph, including the prediction words corresponding to the paragraph;

The determining module is configured to determine whether the paragraph includes the specified technology according to the judgment result corresponding to each paragraph.

In addition, the present application also includes an electronic device, which includes:

processor;

memory for storing processor-executable instructions;

Wherein, the processor is configured to execute the identification method of the technology specified in the above threat intelligence.

Further, the present application also includes a computer-readable storage medium, the storage medium stores a computer program, and the computer program can be executed by a processor to complete the identification method of the technology specified in the above threat intelligence.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present application more clearly, the following briefly introduces the drawings that are used in the embodiments of the present application.

FIG. 1 is a schematic diagram of an application scenario of an identification method for a specified technology in threat intelligence provided by an embodiment of the present application;

FIG. 2 is a schematic structural diagram of an electronic device provided by an embodiment of the present application;

FIG. 3 is a schematic flowchart of a method for identifying a specified technology in threat intelligence provided by an embodiment of the present application;

FIG. 4 is a schematic flowchart of a preliminary identification method for a specified technology in threat intelligence provided by an embodiment of the present application;

FIG. 5 is a schematic flowchart of the details of step 310 in FIG. 3 provided by an embodiment of the present application;

Fig. 6 is a schematic flow chart of a training method for a cloze model provided by an embodiment of the present application;

FIG. 7 is a schematic flowchart of a training method for a technology classification model provided by an embodiment of the present application;

FIG. 8 is an overall schematic diagram of an identification method for a specified technology in threat intelligence provided by an embodiment of the present application;

FIG. 9 is a schematic flowchart of a method for identifying a specified technology in threat intelligence provided by another embodiment of the present application;

FIG. 10 is a block diagram of an identification device for a specified technology in threat intelligence provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

Like numbers and letters denote similar items in the following figures, so that once an item is defined in one figure, it does not require further definition and explanation in subsequent figures. Meanwhile, in the description of the present application, the terms "first", "second" and the like are only used to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

FIG. 1 is a schematic diagram of an application scenario of a method for identifying a specified technology in threat intelligence provided by an embodiment of the present application. As shown in Figure 1, the application scenario includes a client 20 and a server 30; the client 20 can be a user terminal such as a host, a mobile phone, a tablet computer, etc., and is used to send a manually constructed sample data set to the server 30; the server 30 It can be a server, a server cluster, or a cloud computing center. Based on the sample corpus in the sample data set, a cloze model and a technology classification model can be trained to identify information containing specified technical characteristics from cyber threat intelligence with the help of the cloze model and technology classification model. Content.

As shown in FIG. 2 , this embodiment provides an electronic device 1 , including: at least one processor 11 and a memory 12 , and one processor 11 is taken as an example in FIG. 2 . The processor 11 and the memory 12 are connected through the bus 10, and the memory 12 stores instructions that can be executed by the processor 11, and the instructions are executed by the processor 11, so that the electronic device 1 can execute all or part of the processes of the methods in the following embodiments . In an embodiment, the electronic device 1 may be the above-mentioned server 30, configured to implement a method for identifying technologies specified in threat intelligence.

Memory 12 can be realized by any type of volatile or non-volatile storage device or their combination, such as Static Random Access Memory (Static Random Access Memory, referred to as SRAM), Electrically Erasable Programmable Read-Only Memory (Electrically Erasable Programmable Read Only Memory) Erasable Programmable Read-Only Memory, referred to as EEPROM), Erasable Programmable Read-Only Memory (Erasable Programmable Read Only Memory, referred to as EPROM), Programmable Read-Only Memory (Programmable Red-Only Memory, referred to as PROM), read-only memory ( Read-Only Memory, referred to as ROM), magnetic memory, flash memory, magnetic disk or optical disk.

The present application also provides a computer-readable storage medium, the storage medium stores a computer program, and the computer program can be executed by the processor 11 to complete the identification method of the specified technology in the threat intelligence provided by the present application.

Referring to FIG. 3 , it is a schematic flowchart of a method for identifying a specified technology in threat intelligence provided by an embodiment of the present application. As shown in FIG. 3 , the method may include the following steps 310 - 350 .

Step 310: Preprocessing the cyber threat intelligence to obtain the word sequence corresponding to each paragraph in the cyber threat intelligence.

The solution of this application is used to identify content containing specified technologies from network threat intelligence. Here, the specified technology is the technology that users of network threat intelligence are more concerned about, and can be configured according to user needs. The specified technology can be one or more. Exemplarily, the specified technique may be a technique in the MITER ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) knowledge base, or the specified technique may be a technique in the CAPEC (Common Attack Pattern Enumeration and Classification) data set. Multiple subdivision techniques can be included under a given technique.

After the server obtains the network threat intelligence that needs to be identified from the Internet or local storage space, it can preprocess the network threat intelligence, thereby splitting the network threat intelligence into multiple paragraphs, and obtaining the word sequence corresponding to each paragraph. Wherein, the word sequence includes multiple words in the paragraph.

Step 320: After adding a word mask to the word sequence corresponding to each paragraph, input the trained cloze model to obtain the predicted word corresponding to the word mask output by the cloze model.

After obtaining the word sequence of each paragraph in the network threat intelligence, the server can add a word mask to the word sequence corresponding to each paragraph, and the word mask is used to indicate the position where the new word is predicted in the word sequence. Exemplarily, the word mask can be added at the front of the word sequence, that is, the word sequence is connected to the word mask; or, the word mask can be added at the end of the word sequence, that is, the word mask is connected to after the sequence of words. The form of the word mask can be configured in advance, for example, the word mask can be [MASK].

After adding a word mask to a word sequence, the word sequence can be fed into a cloze model. Among them, the cloze model can be trained by a natural language model and used to predict new vocabulary based on text context information. The natural language model can be, but not limited to, BERT (Bidirectional Encoder Representations from Transformer), T5 (Text-To-Text Transfer Transformer), mT5 (AMassively Multilingual Pre-trained Text-to-Text Transformer) and other models. The server can use the cloze model to generate predicted words at the position of the word mask based on other words in the word sequence. The predicted word is the most likely word at the position of the word mask when other words exist in the word sequence.

For each paragraph, the predicted word corresponding to the word sequence of the paragraph can be output through the cloze model respectively.

Step 330: For the word sequence corresponding to each paragraph, input the word sequence into the trained technology classification model, obtain multiple prediction categories output by the technology classification model and the confidence corresponding to each prediction category, and select the one with the highest confidence Several prediction categories are used as the target prediction category corresponding to the paragraph; where each prediction category indicates a technology name belonging to a specified technology.

For the word sequence corresponding to each paragraph, the server can input the word sequence into the technical classification model. The technical classification model is used to classify text and can be trained by the classification model. Wherein, the classification model may be, but not limited to, FastText, SVM (Support Vector Machine, support vector machine), GBDT (Gradient Boosting Decision Tree, gradient boosting decision tree) and the like.

The forecast categories that the technology classification model can output can be configured according to requirements. Exemplarily, the specified technology includes technology names of n subdivision technologies. At this time, a technology classification model may be trained to classify the n subdivision technologies.

The server processes the word sequence through the technical classification model, thereby outputting multiple prediction categories and the confidence corresponding to each prediction category. The server can arrange the confidence levels of multiple prediction categories in descending order, and select several prediction categories with higher confidence levels as the target prediction category corresponding to the paragraph. Here, the number of prediction categories selected by the server can be configured as required. For example, the server can select the two prediction categories with the highest confidence as target prediction categories.

For each paragraph, the server can generate and select several target prediction categories for the paragraph through the technology classification model, and each target prediction category indicates the technical name of the subdivided technology that the content of the paragraph may contain.

Step 340: For each paragraph, determine whether there is any target prediction category corresponding to the paragraph, including the predicted words corresponding to the paragraph.

For any paragraph, the server can check whether each target prediction category of the paragraph contains the predicted word corresponding to the paragraph, so as to determine whether at least one target prediction category contains the predicted word.

Step 350: According to the judgment result corresponding to each paragraph, determine whether the paragraph includes the specified technology.

The server can determine whether the paragraph includes the content corresponding to the specified technology according to the judgment results corresponding to each paragraph. If there is a specified technology in any paragraph of cyber threat intelligence, the server can extract the paragraph so that the content related to the specified technology can be used later.

Through the above measures, after the network threat intelligence is split into multiple paragraphs, the specified technology is identified for each paragraph with the help of the cloze model and the technology classification model, so as to accurately identify the paragraphs with content related to the specified technology.

In an embodiment, prior to identifying the specified technology in the cyber threat intelligence through the above step 310 to step 350, a preliminary identification of the cyber threat intelligence may be performed first. Referring to FIG. 4 , it is a schematic flowchart of a method for preliminary identification of a specified technology in threat intelligence provided by an embodiment of the present application. As shown in FIG. 4 , the method may include steps 410 to 430 as follows.

Step 410: For the network threat intelligence, perform regular matching with multiple technical names under the specified technology, and determine whether any technical name can be matched.

After obtaining the network threat intelligence, the server can use the technical names of all subdivided technologies under the specified technology to perform regular matching on the network threat intelligence, and check whether the network threat intelligence matches any technical name.

Step 420: If any technology name is matched, determine that the cyber threat intelligence includes the specified technology.

In one case, if any technical name is matched, it means that the cyber threat intelligence contains relevant content of the specified technology indicated by the technical name. In this case, it may not be necessary to perform the above identification process of steps 310 to 350 on the network threat intelligence.

Step 430: If no technical name can be matched, proceed to the step of preprocessing the network threat intelligence.

In another case, if any technical name under the specified technology cannot be matched, it means that the network threat intelligence does not directly contain the technology name. In order to identify relevant content that contains the specified technology from cases where the description of the technology is included in cyber threat intelligence.

Through the above preliminary identification process, the specified technology in the network threat intelligence can be quickly identified when the network threat intelligence contains the technology name under the specified technology, thereby reducing the workload of the identification task.

In an embodiment, refer to FIG. 5 , which is a schematic flow chart showing details of step 310 in FIG. 3 according to an embodiment of the present application. As shown in FIG. 5 , the preprocessing process may include steps 311 to 313 as follows.

Step 311: Divide the cyber threat intelligence into several paragraphs.

The server can divide the cyber threat intelligence into several paragraphs. The server can directly split each natural segment of the network threat intelligence to obtain multiple segments. Alternatively, the server may split each natural segment of the network threat intelligence and merge adjacent natural segments (for example: every two adjacent natural segments are merged into one paragraph), thereby obtaining multiple paragraphs. Alternatively, the server may select multiple consecutive sentences as a paragraph, thereby dividing multiple paragraphs. Exemplarily, 10 consecutive sentences are divided into a paragraph.

Step 312: perform word segmentation for each paragraph, and filter out stop words and invalid words from word segmentation results.

For each paragraph, the server can perform word segmentation processing on the paragraph to obtain multiple word segmentation results, and each word segmentation result is a word. The server can filter out stop words and invalid words from multiple word segmentation results with the help of the stop word vocabulary and invalid word vocabulary, so as to obtain the word segmentation result of the paragraph after filtering.

Step 313: For each paragraph, perform word stem extraction on the word segmentation result after filtering to obtain the word sequence corresponding to the paragraph.

For the word segmentation results of any paragraph that has been filtered out, the server can check whether there is a word that can be extracted from the word, and if it exists, it can remove the end of the word and extract the stem. Exemplarily, common word endings in English texts include "ing", "s" and so on. No processing is required for words without endings in word segmentation results. After extracting the word stems from the words containing the endings, the extracted word stems and other words without endings can be used to form a word sequence corresponding to the paragraph.

Through the above measures, the network threat intelligence can be processed into word sequences corresponding to several paragraphs.

In an embodiment, refer to FIG. 6 , which is a schematic flowchart of a method for training a cloze model provided in an embodiment of the present application. As shown in FIG. 6 , the method may include steps 610 to 630 as follows.

Step 610: For the sample corpus in the sample data set, replace at least one word in the sample corpus with a word mask to obtain a specified sample corpus.

The sample data set may include multiple sample corpora, each sample corpus includes the technical name of a subdivided technology under a specified technology, and the technical description of the subdivided technology.

For any sample corpus, the server can select at least one word from the sample corpus, and replace the position of the word in the sample corpus with a word mask, so as to obtain the specified sample corpus. Exemplarily, the sample corpus includes 10 words, and the second word is selected to be replaced with a word mask, so as to obtain a specified sample corpus of 9 words plus 1 word mask.

In an embodiment, when replacing at least one word in the sample corpus with a word mask, the server may complete the replacement in one or more of the following ways.

The first replacement method: the server can select a word from the technical names contained in the sample corpus and replace it with a word mask. Since technical names usually consist of multiple words, for a sample corpus, after selecting different words in the technical name and replacing them with word masks, multiple specified sample corpora can be obtained.

The second replacement method: the server can select a related word of the specified technology from the technical description contained in the sample corpus and replace it with a word mask. Here, the related words may be words related to the specified technology, and the related words may be preconfigured manually. Exemplarily, the related words may be protocol and command. The server can search the technical description contained in the sample corpus according to the pre-configured related words, so as to replace any related word in the found technical description with a word mask. Since the technical description may include multiple related words, for a sample corpus, after selecting different words in the technical description and replacing them with word masks, multiple specified sample corpus can be obtained.

The third replacement method: the server can randomly select at least one word in the sample corpus and replace it with a word mask. Here, each randomly selected word is replaced with a word mask.

Step 620: Input the specified sample corpus into the pre-training model, and obtain the sample prediction result corresponding to the word mask in the specified sample corpus.

The server can input the specified sample corpus into the pre-training model. Here, the pre-training model can be a model trained by natural language models such as BERT, T5, and mT5. The server can use the pre-trained model to predict the words most likely to appear at the position of the word mask in the specified sample corpus, and obtain the sample prediction results. The sample prediction result may include multiple sample prediction words, and each sample prediction word corresponds to a matching degree. The matching degree is between 0 and 1.

Step 630: Adjust the model parameters of the pre-trained model according to the sample prediction results corresponding to the word masks in the specified sample corpus and the replaced words to obtain a cloze model.

For the sample prediction result corresponding to the word mask in each specified sample corpus, the server can search the sample prediction result for the replaced word at the position of the word mask, so as to obtain the matching degree of the replaced word in the sample prediction result. After finding the matching degree of the replaced word, the server can evaluate the difference between the matching degree of the replaced word and the target matching degree of the replaced word according to the loss function, thereby adjusting the model parameters of the pre-trained model. Here, the target matching degree is 1.

After adjusting the model parameters, it is possible to return to step 620 and re-input the specified sample corpus into the adjusted pre-training model. After multiple rounds of iterative training, a trained cloze model can be obtained.

Through the above measures, a cloze model capable of outputting predicted vocabulary for the position of the word mask in the text can be trained.

In an embodiment, refer to FIG. 7 , which is a schematic flowchart of a method for training a technology classification model provided in an embodiment of the present application. As shown in FIG. 7 , the method may include steps 710 to 720 as follows.

Step 710: Input the technical description included in the sample corpus in the sample data set to the classification model, and obtain the predicted category of the sample output by the classification model.

Here, the classification model may be one of models such as FastText, SVM, and GBDT.

The server can input the technical description in the sample corpus into the classification model, so as to obtain the sample prediction category output by the classification model. For a classification model that can directly process natural language, the technical description can be directly input into the classification model; for a classification model that cannot directly process natural language, the technical description can be converted into a multidimensional vector corresponding to the technical description by means of word vector conversion, and then the A multidimensional vector input to a classification model.

Step 720: According to the difference between the sample predicted categories of the sample corpus and the technology names contained in the sample corpus, adjust the model parameters of the classification model to obtain a technology classification model.

The server can evaluate the difference between the sample prediction category of the sample corpus and the technical name of the sample corpus itself through the loss function, so as to adjust the model parameters of the classification model. After the adjustment, return to step 710, and re-input the technical description in the sample corpus into the classification model, so as to further adjust the model parameters of the classification model. After multiple rounds of iterative training, a trained technology classification model can be obtained.

Through the above measures, a technology classification model for technology classification based on corpus can be trained.

In an embodiment, before training the cloze model or technology classification model, a sample data set may be constructed. In response to user operations, the server can extract the relevant content of the specified technology from the network threat intelligence, and construct a piece of corpus in the form of the technical name and technical description in the form of the relevant content. After filtering out stop words and invalid words in the corpus, stem extraction is performed from the filtered words, so as to construct a sample corpus with the extracted word stems and other words without endings. The server can construct a sample corpus based on multiple pieces of sample corpus.

Referring to FIG. 8 , it is an overall schematic diagram of a method for identifying specified technologies in threat intelligence provided by an embodiment of the present application. As shown in FIG. 8 , firstly, a large amount of network threat intelligence can be obtained from the server, and the specified technologies can be extracted manually. For related content, the designated technology in Figure 8 is the ATT&CK technology. Construct a sample corpus based on the extracted content, construct a sample database with multiple sample corpora, and use it to train the cloze model and technology classification model. After the two models are trained, the cloze model and technology classification model are used to extract the content related to ATT&CK technology from the threat intelligence to be tested.

In one embodiment, when the server determines whether the paragraph includes the specified technology according to the judgment result corresponding to each paragraph, in one case, if the judgment result corresponding to any paragraph indicates that there is a target prediction category of the predicted word, it is determined that the paragraph includes Specify technology. When the target prediction category includes prediction words, it may be determined that the paragraph contains relevant content of the segmentation technology indicated by the target prediction category. If there are at least two target prediction categories, and both of the at least two target prediction categories contain predicted words, then it is determined that the paragraph includes relevant content of the subdivision technology indicated by the target prediction category with the highest confidence.

In another case, if the judgment result corresponding to any paragraph indicates that there is no target prediction category including the predicted word, it is determined that the paragraph does not include the specified technology.

Referring to FIG. 9 , it is a schematic flow diagram of the identification method of the specified technology in threat intelligence provided by another embodiment of the present application. As shown in FIG. 9 , multiple paragraphs are divided from the network threat intelligence. For paragraph 1, the cloze model is used Generate the predicted word W1, and generate the target prediction categories R1 and R2 through the technical classification model. The confidence level corresponding to R1 is S1, and the confidence level corresponding to R2 is S2.

The server can determine whether W1 exists in R1 or R2. Since R1 and R2 are technical names indicating the target prediction category, in the case that paragraph 1 contains the specified technology, the words in the technical name can be generated according to paragraph 1 through the cloze model. However, the target prediction category obtained by the technical classification model for paragraph 1 will inevitably contain the words predicted by the cloze model.

In one case, neither the target prediction category R1 nor R2 contains the prediction word W1, indicating that paragraph 1 does not describe the relevant content of the ATT&CK technology.

In one case, the target prediction category R1 contains the prediction word W1, and the target prediction category R2 does not contain the prediction word W1. Explanatory paragraph 1 describes the subdivision technology R1 under ATT&CK.

In one case, the target prediction category R2 contains the predicted word W1, and the target prediction category R1 does not contain the predicted word W1. Explanatory paragraph 1 describes the subdivision technique R2 under ATT&CK.

In one case, the target prediction categories R1 and R2 both contain the predicted word W1, and the target prediction category with higher confidence is the subdivision technology under ATT&CK described in paragraph 1.

Through the above measures, several passages including ATT&CK related content can be identified from the cyber threat intelligence.

Fig. 10 is a block diagram of an identification device for a technology specified in threat intelligence according to an embodiment of the present invention. As shown in Fig. 10, the device may include:

A preprocessing module 1010, configured to preprocess the cyber threat intelligence to obtain a word sequence corresponding to each paragraph in the cyber threat intelligence;

The first prediction module 1020 is used to add a word mask to the word sequence corresponding to each paragraph, and then input the trained cloze model to obtain the corresponding word corresponding to the word sequence output by the cloze model. masked predicted words;

The second prediction module 1030 is configured to input the word sequence corresponding to each paragraph into the trained technology classification model, and obtain various prediction categories output by the technology classification model and the confidence corresponding to each prediction category degree, and select several prediction categories with high confidence as the target prediction category corresponding to the paragraph; wherein, each prediction category indicates a technical name belonging to a specified technology;

Judgment module 1040, for each paragraph, judge whether there is any target prediction category corresponding to the paragraph, including the prediction words corresponding to the paragraph;

The determining module 1050 is configured to determine whether the paragraph includes the specified technology according to the judgment result corresponding to each paragraph.

The implementation process of the functions and functions of each module in the above-mentioned device is detailed in the implementation process of the corresponding steps in the identification method of the specified technology in the above-mentioned threat intelligence, and will not be repeated here.

In the several embodiments provided in this application, the disclosed devices and methods may also be implemented in other ways. The device embodiments described above are only illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the architecture, functions and possible implementations of devices, methods and computer program products according to multiple embodiments of the present application. operate. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code that contains one or more executable instruction. In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified function or action , or may be implemented by a combination of dedicated hardware and computer instructions.

In addition, each functional module in each embodiment of the present application may be integrated to form an independent part, each module may exist independently, or two or more modules may be integrated to form an independent part.

If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

Claims (10)

1. A method for identifying a specified technology in threat intelligence, comprising: Preprocessing the cyber threat intelligence to obtain a sequence of words corresponding to each paragraph in the cyber threat intelligence; For the word sequence corresponding to each paragraph, after adding a word mask for the word sequence, input the trained cloze model to obtain the predicted words corresponding to the word mask output by the cloze model; For the word sequence corresponding to each paragraph, input the word sequence into the trained technology classification model, obtain the multiple prediction categories output by the technology classification model and the confidence corresponding to each prediction category, and select the highest confidence level Several prediction categories of , as the target prediction category corresponding to the paragraph; wherein, each prediction category indicates a technology name belonging to a specified technology; For each paragraph, determine whether there is any target prediction category corresponding to the paragraph, including the prediction words corresponding to the paragraph; According to the judgment result corresponding to each paragraph, it is determined whether the paragraph includes the specified technology. 2. The method according to claim 1, wherein, before the preprocessing of the cyber threat intelligence to obtain the word sequence corresponding to each paragraph in the cyber threat intelligence, the method further comprises: For the network threat intelligence, perform regular matching with multiple technical names under the specified technology, and determine whether any technical name can be matched; If any technology name is matched, determining that the cyber threat intelligence includes the specified technology; If no technical name can be matched, proceed to the steps described in Preprocessing Cyber Threat Intelligence. 3. The method according to claim 1, wherein the preprocessing of the cyber threat intelligence to obtain a word sequence corresponding to each paragraph in the cyber threat intelligence includes: Divide said cyber threat intelligence into paragraphs; Perform word segmentation for each paragraph, and filter out stop words and invalid words from word segmentation results; For each paragraph, stem extraction is performed on the filtered word segmentation result to obtain a word sequence corresponding to the paragraph. 4. method according to claim 1, is characterized in that, described cloze model obtains by following training: For the sample corpus in the sample data set, replace at least one word in the sample corpus with a word mask to obtain a specified sample corpus; Inputting the specified sample corpus into the pre-training model to obtain a sample prediction result corresponding to the word mask in the specified sample corpus; According to the sample prediction results corresponding to the word masks in the specified sample corpus and the replaced words, the model parameters of the pre-trained model are adjusted to obtain a cloze model. 5. The method according to claim 4, wherein the sample corpus includes technical names and technical descriptions; The replacing at least one word in the sample corpus with a word mask includes: select a word from the technical names contained in the sample corpus, and replace it with a word mask; and/or, Select a relevant word of the specified technology from the technical description contained in the sample corpus, and replace it with a word mask; and/or, Randomly select at least one word in the sample corpus and replace it with a word mask. 6. The method according to claim 1, wherein the technology classification model is obtained through training in the following manner: Inputting the technical description included in the sample corpus in the sample data set to the classification model, and obtaining the sample prediction category output by the classification model; According to the difference between the sample prediction category of the sample corpus and the technology names contained in the sample corpus, adjust the model parameters of the classification model to obtain a technology classification model. 7. The method according to claim 1, wherein, according to the judgment result corresponding to each paragraph, determining whether the paragraph includes a specified technology comprises: If the judgment result corresponding to any paragraph indicates that there is a target prediction category including the predicted word, it is determined that the paragraph includes the specified technology; If the judgment result corresponding to any paragraph indicates that there is no target prediction category including the predicted word, it is determined that the paragraph does not include the specified technology. 8. An identification device for a specified technology in threat intelligence, characterized in that it includes: A preprocessing module, configured to preprocess the cyber threat intelligence to obtain a word sequence corresponding to each paragraph in the cyber threat intelligence; The first prediction module is used for the word sequence corresponding to each paragraph, after adding a word mask for the word sequence, input the trained cloze model, and obtain the output corresponding to the word mask of the cloze model predicted words of the code; The second prediction module is used to input the word sequence corresponding to each paragraph into the trained technology classification model, and obtain various prediction categories output by the technology classification model and the confidence corresponding to each prediction category , and select several prediction categories with higher confidence levels as the target prediction category corresponding to the paragraph; wherein, each prediction category indicates a technical name belonging to a specified technology; A judging module, for each paragraph, judging whether there is any target prediction category corresponding to the paragraph, including the prediction words corresponding to the paragraph; The determining module is configured to determine whether the paragraph includes the specified technology according to the judgment result corresponding to each paragraph. 9. An electronic device, characterized in that the electronic device comprises: processor; memory for storing processor-executable instructions; Wherein, the processor is configured to execute the method for identifying the technology specified in the threat intelligence according to any one of claims 1-7. 10. A computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program can be executed by a processor to complete the technology specified in the threat intelligence according to any one of claims 1-7. recognition methods.

Images