WO2021017614A1

WO2021017614A1 - Threat intelligence data collection and processing method and system, apparatus, and storage medium

Info

Publication number: WO2021017614A1
Application number: PCT/CN2020/093620
Authority: WO
Inventors: 李洋; 周亚军
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-07-31
Filing date: 2020-05-30
Publication date: 2021-02-04
Also published as: CN110460594A; CN110460594B

Abstract

The present application relates to the technical field of data security. Disclosed are a threat intelligence data collection and processing method and system, an apparatus, and a storage medium. The method comprises: S110, a threat intelligence operation platform collects intelligence production data of an enterprise; S120, the threat intelligence operation platform determines threat intelligence data to be screened according to the intelligence production data source; S130, the threat intelligence operation platform screens the threat intelligence data to be screened by using a local sandbox, and merges data confirmed as threat intelligence with existing threat intelligence in an intelligence library according to a screening result; and S140, the threat intelligence operation platform pushes the confirmed threat intelligence to the enterprise, generates alarm information according to the threat intelligence, and distributes the alarm information to the enterprise. According to the present application, the large-scale group enterprise-oriented "intelligence community" is established, so that the enterprise becomes a "producer" of intelligence, the intelligence can be provided in the intelligence community in real time, and the intelligence can be shared in the industry in time.

Description

Threat intelligence data collection and processing method, system, device and storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on July 31, 2019, the application number is CN201910700841.6, and the invention title is "Threat intelligence data collection and processing methods, devices, and storage media". The entire content is approved The reference is incorporated in this application.

Technical field

This application relates to the field of data security technology, and more specifically, to a method, system, device, and storage medium for collecting and processing threat intelligence data.

Background technique

The so-called threat intelligence is knowledge based on certain evidence, including context, mechanism, labeling, meaning, and recommendations that can be implemented. This knowledge is related to existing or brewing threats or hazards faced by the asset, and can be used by asset-related entities. Provide information support in response to threats or hazards or handling decisions. Enterprises and organizations use threat intelligence to better meet their own related security threats and conduct more effective security defenses.

The inventor realized that the existing threat intelligence systems on the market, similar to 360, NSFOCUS, Weibu, etc., are based on push and centralized intelligence provision models. Large enterprises are all intelligence "consumers" and cannot be timely Providing "self-produced" intelligence in a certain industry has certain flaws in the use of corporate threat intelligence.

At this stage, the threat intelligence introduced by various security vendors, due to the commercial and technical barriers between vendors, and the lack of unified communication standards, still has very little threat intelligence data exchange, which makes it difficult to give full play to the value of intelligence.

In the intelligence collection link, the data collection of existing security vendors is generally realized through anti-malware software. The scale and industry of the collected data depend on the deployment of anti-malware software. There are situations such as incomplete data collection coverage and inconsistent collection environments. For the collection of traffic level, security vendors often rely on cooperation with telecom operators. There is a gap in customer privacy, which leads to the inability to collect full amounts of intelligence data.

In the intelligence processing link, due to the inconsistency and incomplete coverage of the data collection environment of security vendors, a lot of manpower has to be invested from samples (raw data) to generating intelligence.

technical problem

In view of the above-mentioned problems, the purpose of this application is to provide a method for collecting and processing threat intelligence data, which can be used to establish an "intelligence community" for large group companies, so that enterprises and users can become intelligence "producers". "Intelligence community" provides information in real time, shares information in the industry in a timely manner, and uses cloud intelligence capabilities and evaluation screening to screen and merge this information to form effective industry intelligence.

Technical solutions

According to one aspect of this application, a threat intelligence data collection and processing method is provided, which includes the following steps:

S110: The threat intelligence operation platform collects the intelligence production data of the enterprise, and the intelligence production data includes at least the enterprise's event analysis report, the enterprise IDC export security equipment log data, the samples submitted by the enterprise and the intelligence data;

S120: The threat intelligence operation platform determines threat intelligence data to be screened according to the source of the intelligence production data;

S130: The threat intelligence operation platform uses a local sandbox to screen the threat intelligence data to be screened, and merges the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening result;

S140: The threat intelligence operation platform pushes the threat intelligence confirmed in S130 to the enterprise, generates alarm information based on the threat intelligence, and distributes the alarm information to the enterprise.

According to another aspect of this application, a threat intelligence data collection and processing system is provided, including:

Intelligence production data collection module, used to collect enterprise intelligence production data;

The threat intelligence data generating module to be screened is used to determine the threat intelligence data to be screened according to the source of the intelligence production data;

The threat intelligence screening and merging module is used to screen the threat intelligence data to be screened by using a local sandbox, and merge the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening results;

Threat intelligence and alarm information issuing module, used to push the confirmed threat information to the enterprise, generate alarm information based on the threat information, and distribute the alarm information to the enterprise;

The intelligence production data includes at least the company’s event analysis report, the company’s IDC export security equipment log data, and the company’s submitted samples and intelligence data.

The present application also provides an electronic device, including a memory and a processor, and a computer program is stored in the memory. When the computer program is executed by the processor, the following steps are implemented:

Collect the enterprise’s intelligence production data, which includes at least the enterprise’s event analysis report, the enterprise IDC export security equipment log data, and the samples and intelligence data submitted by the enterprise;

Determine the threat intelligence data to be screened according to the source of the intelligence production data;

Use a local sandbox to filter the threat intelligence data to be screened, and merge the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening results;

Push the confirmed threat information to the enterprise, generate alarm information based on the threat information, and distribute the alarm information to the enterprise.

This application also provides a computer-readable storage medium that includes a threat intelligence data collection and processing program, and when the threat intelligence data collection and processing program is executed by a processor, the following steps are implemented:

Beneficial effect

Compared with the prior art, the threat intelligence data collection and processing method and system provided in this application have the following beneficial effects:

1. Able to collect enterprise's intelligence production data in a comprehensive way, and enterprises and users become intelligence "producers" and can provide intelligence in real time;

2. Through the "intelligence community", intelligence can be shared in the industry in a timely manner; a certain scale of threat intelligence sharing in the industry is formed within the industry to which the company belongs, and the overall threats faced by the industry can be shared together without harming the respective business interests of the participants. , Share intelligence and conduct joint attacks against common threats in the industry.

3. With the help of cloud intelligence capabilities and evaluation and screening, these intelligence can be merged and screened to form effective industry intelligence.

In order to achieve the above and related objects, one or more aspects of the present application include features that will be described in detail later and specifically pointed out in the claims. The following description and drawings illustrate certain exemplary aspects of the present application in detail. However, these aspects indicate only some of the various ways in which the principles of this application can be used. Furthermore, this application is intended to include all these aspects and their equivalents.

Description of the drawings

By referring to the following description in conjunction with the accompanying drawings and the content of the claims, and with a more comprehensive understanding of the application, other purposes and results of the application will be more clear and easy to understand. In the attached picture:

Figure 1 is a flowchart of a threat intelligence data collection and processing method according to Embodiment 1 of the present application;

2 is a schematic diagram of the logical structure of a threat intelligence data collection and processing system according to Embodiment 2 of the present application;

FIG. 3 is a schematic diagram of a logical structure of an electronic device according to Embodiment 3 of the present application.

Figure 2 has the following tags: 501 intelligence production data collection module; 502 threat intelligence data generation module to be screened; 503 threat intelligence screening and merging module; 504 threat intelligence and alarm information issuing module.

Figure 3 has the following marks: 1 electronic device; 2 processor; 3 memory; 4 computer program.

The same reference numerals in all drawings indicate similar or corresponding features or functions. To

Embodiments of the invention

In the following description, for illustrative purposes, in order to provide a comprehensive understanding of one or more embodiments, many specific details are set forth. However, it is obvious that these embodiments can also be implemented without these specific details. In other examples, for the convenience of describing one or more embodiments, well-known structures and devices are shown in the form of block diagrams.

The specific embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

Example 1

Fig. 1 shows the flow of the threat intelligence data collection and processing method according to Embodiment 1 of the present application.

As shown in Figure 1, the threat intelligence data collection and processing method provided by this embodiment includes the following steps:

S110: The threat intelligence operation platform collects the intelligence production data of the enterprise. The intelligence production data includes at least the enterprise's event analysis report, the enterprise IDC (Interner Data Center, Internet Data Center) export security equipment log data, and the samples and intelligence data submitted by the enterprise ；

An enterprise can be a large group of customers, the number is at least two, and all enterprises form an intelligence community. The threat intelligence operation platform can at least collect intelligence data from three sources: event analysis reports of each company in the intelligence community, corporate IDC export security equipment log data, samples submitted by the company, and intelligence data, forming a comprehensive collection of intelligence.

S120: The threat intelligence operation platform determines the threat intelligence data to be screened according to the source of the intelligence production data;

S130: The threat intelligence operation platform uses a local sandbox to screen the threat intelligence data to be screened, and merges the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening results;

In step S110, the threat intelligence operation platform collects the intelligence production data of the enterprise, and selects different collection methods according to different sources of the collected intelligence production data.

In the process of collecting enterprise event analysis reports, the threat intelligence operation platform can connect the API (Application Program Interface) of the threat intelligence operation platform with the event recording system that stores the event analysis report, which can be used as an enterprise emergency response When personnel submit an event analysis report to the event recording system, the threat intelligence operation platform obtains the event analysis report in real time. At least two companies’ event recording systems connect with the API of the threat intelligence operation platform.

The incident analysis report is that in the past incident processing, the security personnel will form an incident analysis report after completing the incident analysis and processing, and the incident analysis report itself already contains the intelligence context and ioc (intrusion threat indicator) information. This application starts with the information contained in the incident analysis report itself, and sets the format of the incident analysis report submitted by each enterprise from the group enterprise level (the format is shown in the table below). The threat intelligence operation platform can comprehensively carry out each enterprise terminal Intelligence data collection.

The following is an event analysis report of a specific embodiment of this application. The event analysis report uses a table format:

Incident Analysis Report

Event name* Minerd mining Trojan activity event

Event number EYDM20180001

Event source: XX alarm

Time of incident* 2018-03-15 11:39:11

Event discovery time 2018.5.30 16:34

Incident resolution time 2018.6.7 16:57

Incident discoverer XXX

Event type* Malicious code, mining virus, C2

Event rating Low risk

Event overview* A case of Minerd mining virus was detected in XX, which was spread through the ms17-010 vulnerability

Detailed description of the cause of the event: description of the cause of the event

▫ Affected businesses/services: affected businesses and services

▫ ▫ Event process: description of the event process

▫ ▫ Event result: description of processing result

Affected company Affected party: multiple companies Impact level: None (business is not affected) Loss: None

Affect industries* Banking, finance

Emergency mitigation measures Mitigation measures

Corrective and preventive measures

Long-term disposal plan

Summary of event experience:

Ioc* Rer.njaavfxcgk3.club:4433

▫ ▫ 2cc80b81edb2133206d29ec44ed8aaa1

, 018dcbf3d26eafaad1b2cca3608af9faf38fa8281b2e3c8d5ad4c89bc2d7e1b8

Related Links* https://www.xxxx.com/articles/network/164869.html

Filling time: 2018.6.8 10:34

Filler: XXX

2. In the process of the threat intelligence operation platform collecting the log data of the enterprise IDC export security equipment, the threat intelligence operation platform docks with the security equipment deployed by the enterprise at the IDC exit, and collects log data based on the full flow analysis capabilities and results of the security equipment.

The log data of enterprise IDC export security equipment mainly includes NTA (network traffic analysis), NGFW (Next generation firewall, the next generation firewall), WAF (Web Application Firewall, Web application protection system), IPS (Intrusion Prevention System, intrusion prevention system), anti-virus and other equipment security alarm log and event log, etc.

Enterprise terminal intelligence data collection and IDC exit for full flow intelligence data collection process can be combined with NTA, local sandbox, traditional security equipment, terminal applications and other technologies. Traditional security devices include NGFW, WAF, IPS, anti-software, etc., and terminal applications include mailboxes, IM (instant messaging tools), etc.

3. In the process of the threat intelligence operation platform collecting samples and intelligence data submitted by companies: The samples and intelligence data submitted by companies include certain or suspicious IP, domain name information, and malicious sample information. Each company can assign certain or suspicious IP, domain names Information is submitted to the threat intelligence operation platform, and malicious sample information can also be submitted to the threat intelligence operation platform. The threat intelligence operation platform stores information such as certain or suspicious IP, domain name information, and malicious sample information.

In step S120, the threat intelligence operation platform determines the threat intelligence data to be screened according to the source of the intelligence production data.

1. Use natural language analysis (NLP) to extract the ioc (intrusion threat indicator) and TTP (Tactics, Techniques & Procedures, means, technology, process intelligence) information in the incident analysis report, that is, the incident analysis report in the table above has * Field information, and identify the intelligence type, save the ioc and TTP information in the intelligence database according to the intelligence type, and generate threat intelligence data to be screened.

When natural language analysis (NLP) is used to extract the information in the incident analysis report, the "event summary" field will be analyzed at the same time, and the intelligence type will be automatically identified based on the content of the "event summary" field, such as lost information, file reputation information, IP reputation information, etc. The threat intelligence operation platform saves intelligence information in the intelligence database according to its type.

2. Using the platform ELK (Elasticsearch, Logstash, Kibana, popular log collection and analysis platform) The system analyzes and processes the log data of the company's IDC export security equipment to form threat intelligence to be screened.

The ELK system mainly uses SPL (Splunk Search Language, a log search syntax) language, for example, to retrieve NGFW alarm logs, count IPs whose attack parameters have reached a preset threshold in the past preset time, and save them in the intelligence database to form threat intelligence data to be filtered. This embodiment uses statistics of attack source IPs with attack types greater than 20 types and attack target IPs greater than 10 in the past week. It can be preliminarily considered that this IP is performing a scanning attack, and an IP reputation information can be output.

3. After storing the suspicious IP, domain name information, and malicious sample information submitted by the enterprise, the threat intelligence operation platform calculates the information based on the suspicious IP, domain name information and information obtained from the user’s comments in the intelligence community. Credit value, at the same time, calculate the company’s credit rating based on the company’s positive review ratio, audit pass rate, audit rejection rate, and complaints. The credit value and credit rating are combined to determine the threat intelligence information to be screened. And stored in the information database. The malicious samples will be pushed to the local sandbox to analyze the identifiable files in these samples. After the analysis is completed, the threat intelligence information to be screened will be output, including file hash value, file network behavior, local behavior and other intelligence data, and stored in the intelligence database . The files that can be recognized by the sandbox are generally binary executable files, emails, etc., and unrecognizable samples need to be manually analyzed before being submitted. The positive and negative comment ratio of user reviews can be described as the like/dislike ratio.

The IP and domain name reporting functions enable users to provide community information in real time.

In step S130, the threat intelligence operation platform screens the threat intelligence data to be screened, and merges the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening result.

The process of the threat intelligence operation platform screening the threat intelligence data to be screened provided by each enterprise includes the use of local sandboxes to identify the threat intelligence data to be screened.

Among them, the threat intelligence data to be screened that can be identified by the local sandbox is confirmed as threat intelligence; for the threat intelligence data to be screened that cannot be identified by the local sandbox, the threat intelligence operation platform will automatically distribute the unidentified threat intelligence data to be screened , Go to the security enterprise intelligence analysis platform, and rewrite the event analysis report in accordance with the unified setting format (as in the above table), in case it is collected again on the threat intelligence operation platform.

The security enterprise intelligence analysis platform is used to provide intelligence analysis and sharing for cooperative enterprises. It is composed of several cooperative enterprises in the intelligence community. Several cooperative enterprises are enterprises that connect the enterprise's event recording system with the API of the threat intelligence operation platform. The threat intelligence operation platform has established communication channels with several cooperative companies. The threat intelligence operation platform automatically distributes the threat data to be screened that cannot be identified by the local sandbox to the cooperative companies through the channels.

The distribution principle is intra-industry distribution, that is, the unidentified threat intelligence data to be screened provided by a certain industry company is distributed to all other cooperative companies in the same industry, and all other cooperative companies in the same industry will analyze and return them in strict accordance with the above table. The event analysis report written in the set format; the returned event analysis report will go to step S120.

When the threat intelligence operation platform automatically distributes unidentified threat intelligence data to be screened to various cooperative enterprises through channels, it will filter sensitive information involving enterprises and attack targets.

Data confirmed as threat intelligence is written into the threat intelligence operation platform. The written data includes threat intelligence hash (algorithm), host characteristics, event characteristics, and TTP information.

When the threat intelligence operation platform merges the data identified as threat intelligence with the existing threat intelligence in the intelligence database, the threat intelligence operation platform compares the host characteristics identified as threat intelligence with the existing threat intelligence in the intelligence database. Automatically compare the characteristics of the host, and automatically associate and classify threat intelligence with similar host characteristics and enter it into the intelligence database.

After step 130, it may also include the following steps: establishing a machine learning model, and outputting the TTP information of the malicious sample family to be updated according to the machine learning model and the threat intelligence confirmed in step 130, and the TTP information of the malicious sample family to be updated including the activity status , Activity time, goals, etc.

In step S140: the threat intelligence operation platform pushes the threat intelligence confirmed in S130 to the enterprise, generates warning information based on the threat intelligence, and distributes the warning information to the enterprise.

The process of pushing threat intelligence includes: the threat intelligence operation platform pushes the confirmed threat intelligence to the enterprises that have subscribed to the threat intelligence according to the category of the confirmed threat intelligence, so as to ensure that users can obtain the intelligence in time.

The process of generating alarm information based on threat intelligence and distributing the alarm information to the enterprise includes: connecting the threat intelligence operation platform with the enterprise’s NGSOC (security operation platform) and/or SIEM (security information and event management) system, and connecting the confirmed threat intelligence with Assets and events are correlated to form more abundant and easy-to-understand event alarm information. According to the confirmed threat intelligence category, the alarm information is distributed to the enterprises that have subscribed to the category intelligence, and the corresponding emergency response personnel will handle it.

In addition, in order to facilitate enterprise inquiries, a query API function can be set on the threat intelligence operation platform.

The threat intelligence data collection and processing method provided in this application also includes: updating the credit rating of each company, and the update basis includes the positive comment ratio of the company being reviewed, the review pass rate, the review rejection rate, the situation of complaints, etc. to determine the user's credit value .

The intelligence community should be an information sharing platform for the industry to jointly fight the same threats. In order to maintain this ultimate goal, there are mainly the following constraint rules for each enterprise:

a) All enterprises are prohibited from submitting false information;

b) It is forbidden for all enterprises to use the threat intelligence operation platform to conduct commercial propaganda and competition;

c) All enterprises are prohibited from using threat intelligence operation platforms to mislead (users, platforms);

d) The platform encourages the sharing of detailed threat intelligence without disclosing confidential corporate information;

The threat intelligence operation platform will detect corporate violations by monitoring whether the comment content is positive (relying on NLP natural language analysis technology) and whether it contains sensitive vocabulary, etc., and will provide complaints against companies, such as companies that do not comply with the rules. , Downgrade the credit rating of the enterprise.

Example 2

As shown in FIG. 2, a threat intelligence data collection and processing system includes: an intelligence production data collection module 501, a threat intelligence data generation module 502 to be screened, a threat intelligence screening and merging module 503, and a threat intelligence and alarm information issuing module 504.

The intelligence production data collection module 501 is used to collect the intelligence production data of the enterprise; the threat intelligence data generation module to be screened is used to determine the threat intelligence data to be screened according to the source of the intelligence production data; the threat intelligence screening and merge module 503 is used to The threat intelligence data to be screened is filtered using a local sandbox, and the data confirmed as threat intelligence is combined with the existing threat intelligence in the intelligence database according to the screening results; the threat intelligence and alarm information issuing module 504 is used to confirm Pushes the threat information of to the enterprise, generates alarm information based on the threat information, and distributes the alarm information to the enterprise.

The intelligence production data includes at least the company’s event analysis report, the company’s IDC export security equipment log data, and the samples submitted by the company and intelligence data; the number of said companies is more than two.

The intelligence production data collection module 501 may include a corporate event analysis report collection module, a corporate IDC export security equipment log data collection module, samples submitted by the company, and an intelligence data collection module.

The threat intelligence data generating module 502 to be screened may include an event analysis report processing module, an IDC export security device log data processing module, and a sample and intelligence data processing module submitted by the enterprise.

The threat intelligence screening and merging module 503 may include a screening and identifying module of threat intelligence data to be screened and a threat intelligence merging module.

The threat intelligence and alarm information distribution module 504 may include a threat information push module and an alarm information distribution module.

The threat intelligence data collection and processing system may also include a module for generating family information of malicious samples to be updated and a module for establishing corporate credit ratings.

Example 3

As shown in FIG. 3, an electronic device 1 includes a memory 3 and a processor 2. The memory 3 stores a computer program 4, and the computer program 4 is executed by the processor 2 to implement the threat intelligence data collection and processing method in Embodiment 1. .

Example 4

A computer-readable storage medium, the computer-readable storage medium may be non-volatile or volatile, and the computer-readable storage medium includes a threat intelligence data collection and processing program, and a threat intelligence data collection and processing program When executed by the processor, the steps of the threat intelligence data collection and processing method in Embodiment 1 are realized.

Regarding the embodiment of the threat intelligence data collection and processing system provided in this application, since it is basically similar to the embodiment of the threat intelligence data collection and processing method, for related parts, please refer to the part of the description of the method embodiment, which will not be repeated here.

The above figures describe the threat intelligence data collection and processing method and system according to the present application by way of example. However, those skilled in the art should understand that various improvements can be made to the threat intelligence data collection and processing method and system proposed in this application without departing from the content of this application. Therefore, the protection scope of this application should be determined by the content of the appended claims.

Claims

A method for collecting and processing threat intelligence data, which includes the following steps:

S110: The threat intelligence operation platform collects the intelligence production data of the enterprise, and the intelligence production data includes at least the enterprise's event analysis report, the enterprise IDC export security equipment log data, the samples submitted by the enterprise and the intelligence data;

S120: The threat intelligence operation platform determines threat intelligence data to be screened according to the source of the intelligence production data;

S130: The threat intelligence operation platform uses a local sandbox to screen the threat intelligence data to be screened, and merges the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening result;

S140: The threat intelligence operation platform pushes the threat intelligence confirmed in S130 to the enterprise, generates alarm information based on the threat intelligence, and distributes the alarm information to the enterprise.
The threat intelligence data collection and processing method according to claim 1, wherein the process of the threat intelligence operation platform collecting enterprise intelligence production data includes:

The threat intelligence operation platform collects the event analysis report of the enterprise, including connecting the API of the threat intelligence operation platform to the event recording system storing the event analysis report, and the threat intelligence operation platform obtains the event analysis report in real time ；

The threat intelligence operation platform collects the enterprise IDC export security equipment log data, including the threat intelligence operation platform docking with the enterprise security equipment deployed at the IDC exit, and collects log data based on the full traffic analysis capabilities and results of the security equipment;

The process of the threat intelligence operation platform collecting samples and intelligence data submitted by the enterprise includes: the enterprise submits the determined or suspicious IP, domain name information and malicious sample information contained in the samples and intelligence data to the threat intelligence operation platform. The intelligence operation platform stores the IP, domain name information and malicious sample information.
The threat intelligence data collection and processing method according to claim 1, wherein the process of the threat intelligence operation platform determining the threat intelligence data to be screened according to the source of the intelligence production data comprises:

Using natural language analysis, extract the intrusion threat indicators and TTP information in the event analysis report, and identify the intelligence type, and save the intrusion threat indicators and TTP information in the intelligence database according to the intelligence type to generate threats to be screened Intelligence data

The ELK system is used to analyze and process the company’s IDC export security equipment log data. The ELK system uses the SPL language to retrieve the NGFW alarm log, and counts the IP whose attack parameters have reached the preset threshold in the past preset time as the dishonest IP, and save it Go to the intelligence database to form threat intelligence data to be screened.
The threat intelligence data collection and processing method according to claim 2, wherein the threat intelligence operation platform calculates the IP, domain name information and malicious sample information based on the forward and backward comment ratios of user comments. The credit value of the domain name information is determined according to the credit value and the credit level of the enterprise to determine the threat intelligence data to be screened and saved in the intelligence database;

Push the malicious sample to a local sandbox, analyze the identifiable files in the malicious sample to determine the threat intelligence data to be screened, and save it in the intelligence database;

Wherein, the credit rating of the enterprise is determined according to the positive comment ratio of the enterprise being commented, the audit pass rate, the audit rejection rate and the complaint situation.
The threat intelligence data collection and processing method according to claim 1, wherein the threat intelligence operation platform uses a local sandbox to screen the threat intelligence data to be screened, and according to the screening results, the data and intelligence database confirmed as threat intelligence The process of merging existing threat intelligence in, includes:

Use the local sandbox to identify the threat intelligence data to be screened, where the threat intelligence data to be screened identified by the local sandbox is confirmed as threat intelligence;

Distribute the to-be-screened threat intelligence data that cannot be identified by the local sandbox to the security enterprise intelligence analysis platform, and rewrite the event analysis report according to the set format, in case it is collected again on the threat intelligence operation platform;

Wherein, the data confirmed as threat intelligence is written into the threat intelligence operation platform, and the written data includes the algorithm, host characteristics, event characteristics, and TTP information of the threat intelligence;

The threat intelligence operation platform compares the host characteristics confirmed as threat intelligence with the host characteristics of the existing threat intelligence in the intelligence database, associates and classifies the threat intelligence with similar host characteristics, and enters the intelligence database.
The threat intelligence data collection and processing method according to claim 1, wherein the threat intelligence operation platform pushes the threat intelligence confirmed in S130 to the enterprise, generates alarm information based on the threat intelligence, and combines the The process of distributing alarm information to the enterprise includes:

The threat intelligence operation platform pushes the confirmed threat intelligence to the enterprise that has subscribed to the threat intelligence of the category according to the category of the confirmed threat intelligence;

The threat intelligence operation platform is docked with the enterprise’s security operation platform and/or security information and event management system, and the confirmed threat intelligence is associated with assets and alarm information after the event. According to the confirmed threat intelligence category, The alarm information is distributed to enterprises that have subscribed to the category information.
The threat intelligence data collection and processing method according to claim 1, wherein after step 130, it further comprises: establishing a machine learning model, and outputting the malicious information to be updated according to the machine learning model and the threat information confirmed in step 130 The TTP information of the sample family. The TTP information of the malicious sample family to be updated includes activity status, activity time, and target.
A threat intelligence data collection and processing system, which includes:

Intelligence production data collection module, used to collect enterprise intelligence production data;

The threat intelligence data generating module to be screened is used to determine the threat intelligence data to be screened according to the source of the intelligence production data;

The threat intelligence screening and merging module is used to screen the threat intelligence data to be screened by using a local sandbox, and merge the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening results;

Threat intelligence and alarm information issuing module, used to push the confirmed threat information to the enterprise, generate alarm information based on the threat information, and distribute the alarm information to the enterprise;

The intelligence production data includes at least the company’s event analysis report, the company’s IDC export security equipment log data, and the company’s submitted samples and intelligence data.
An electronic device, which includes a memory and a processor, and a computer program is stored in the memory. When the computer program is executed by the processor, the following steps are implemented:

Collect the enterprise’s intelligence production data, which includes at least the enterprise’s event analysis report, the enterprise IDC export security equipment log data, and the samples and intelligence data submitted by the enterprise;

Determine the threat intelligence data to be screened according to the source of the intelligence production data;

Use a local sandbox to filter the threat intelligence data to be screened, and merge the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening results;

Push the confirmed threat information to the enterprise, generate alarm information based on the threat information, and distribute the alarm information to the enterprise.
8. The electronic device of claim 9, wherein the process of collecting enterprise intelligence production data comprises:

Collecting the event analysis report of the enterprise, including connecting to an event recording system storing the event analysis report, and obtaining the event analysis report in real time;

Collect the log data of the security equipment at the IDC exit of the enterprise, including the security equipment deployed at the IDC exit by the docking company, and collect the log data based on the full traffic analysis capabilities and results of the security equipment;

The process of collecting samples and intelligence data submitted by the enterprise includes: receiving the confirmed or suspicious IP, domain name information, and malicious sample information contained in the samples and intelligence data submitted by the enterprise, and storing the IP, domain name information and malicious samples information.
9. The electronic device of claim 9, wherein the process of determining the threat intelligence data to be screened according to the source of the intelligence production data comprises:

Using natural language analysis, extract the intrusion threat indicators and TTP information in the event analysis report, and identify the intelligence type, and save the intrusion threat indicators and TTP information in the intelligence database according to the intelligence type to generate threats to be screened Intelligence data

The ELK system is used to analyze and process the company’s IDC export security equipment log data. The ELK system uses the SPL language to retrieve the NGFW alarm log, and counts the IP whose attack parameters have reached the preset threshold in the past preset time as the dishonest IP, and save it Go to the intelligence database to form threat intelligence data to be screened.
10. The electronic device of claim 10, wherein when the computer program is executed by the processor, after storing the IP, domain name information, and malicious sample information, the following steps are further implemented:

Calculate the credit value of the IP and domain name information based on the ratio of the forward and reverse reviews of user reviews, and determine the threat intelligence data to be screened according to the credit value and the credit level of the enterprise, and save it in the intelligence database;

Push the malicious sample to a local sandbox, analyze the identifiable files in the malicious sample to determine the threat intelligence data to be screened, and save it in the intelligence database;

Wherein, the credit rating of the enterprise is determined according to the positive comment ratio of the enterprise being commented, the audit pass rate, the audit rejection rate and the complaint situation.
The electronic device of claim 9, wherein the process of pushing the confirmed threat intelligence to the enterprise, generating alarm information based on the threat intelligence, and distributing the alarm information to the enterprise comprises :

Push the confirmed threat information to the enterprise that has subscribed to the threat information of the type according to the type of the confirmed threat information;

Connect with the security operation platform and/or security information and event management system of the enterprise, associate the confirmed threat intelligence with the alarm information after the asset and event, and distribute the alarm information to the confirmed threat intelligence category Companies that have subscribed to the category of information.
The electronic device according to claim 9, wherein when the computer program is executed by the processor, after merging the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening result, the following steps are further implemented :

A machine learning model is established, and the TTP information of the malicious sample family to be updated is output according to the machine learning model and the confirmed threat intelligence. The TTP information of the malicious sample family to be updated includes activity status, activity time, and target.
A computer-readable storage medium, wherein the computer-readable storage medium includes a threat intelligence data collection and processing program, and when the threat intelligence data collection and processing program is executed by a processor, the following steps are implemented:

Collect the enterprise’s intelligence production data, which includes at least the enterprise’s event analysis report, the enterprise IDC export security equipment log data, and the samples and intelligence data submitted by the enterprise;

Determine the threat intelligence data to be screened according to the source of the intelligence production data;

Use a local sandbox to filter the threat intelligence data to be screened, and merge the data confirmed as threat intelligence with the existing threat intelligence in the intelligence database according to the screening results;

Push the confirmed threat information to the enterprise, generate alarm information based on the threat information, and distribute the alarm information to the enterprise.
15. The computer-readable storage medium of claim 15, wherein the process of collecting enterprise intelligence production data comprises:

Collecting the event analysis report of the enterprise, including docking with the event recording system storing the event analysis report, and obtaining the event analysis report in real time;

Collect the log data of the security equipment at the IDC exit of the enterprise, including the security equipment deployed at the IDC exit by the docking company, and collect the log data based on the full traffic analysis capabilities and results of the security equipment;

The process of collecting samples and intelligence data submitted by the enterprise includes: receiving the confirmed or suspicious IP, domain name information, and malicious sample information contained in the samples and intelligence data submitted by the enterprise, and storing the IP, domain name information and malicious samples information.
15. The computer-readable storage medium of claim 15, wherein the process of determining the threat intelligence data to be screened according to the source of the intelligence production data comprises:

Using natural language analysis, extract the intrusion threat indicators and TTP information in the event analysis report, and identify the intelligence type, and save the intrusion threat indicators and TTP information in the intelligence database according to the intelligence type to generate threats to be screened Intelligence data

The ELK system is used to analyze and process the company’s IDC export security equipment log data. The ELK system uses the SPL language to retrieve the NGFW alarm log, and counts the IP whose attack parameters have reached the preset threshold in the past preset time as the dishonest IP, and save it Go to the intelligence database to form threat intelligence data to be screened.
16. The computer-readable storage medium of claim 16, wherein when the threat intelligence data collection processing program is executed by the processor, after storing the IP, domain name information, and malicious sample information, the following steps are further implemented:

Calculate the credit value of the IP and domain name information based on the ratio of the forward and reverse reviews of user reviews, and determine the threat intelligence data to be screened according to the credit value and the credit level of the enterprise, and save it in the intelligence database;

Push the malicious sample to a local sandbox, analyze the identifiable files in the malicious sample to determine the threat intelligence data to be screened, and save it in the intelligence database;

Wherein, the credit rating of the enterprise is determined according to the positive comment ratio of the enterprise being commented, the audit pass rate, the audit rejection rate and the complaint situation.
The computer-readable storage medium of claim 15, wherein the confirmed threat intelligence is pushed to the enterprise, and warning information is generated based on the threat intelligence, and the warning information is distributed to the enterprise The process includes:

Push the confirmed threat information to the enterprise that has subscribed to the threat information of the type according to the type of the confirmed threat information;

Connect with the security operation platform and/or security information and event management system of the enterprise, associate the confirmed threat intelligence with the alarm information after the asset and event, and distribute the alarm information to the confirmed threat intelligence category Companies that have subscribed to the category of information.
The computer-readable storage medium according to claim 15, wherein, when the threat intelligence data collection processing program is executed by the processor, the data confirmed as threat intelligence is combined with the existing threat intelligence in the intelligence database according to the screening result. After the merger, the following steps are also implemented:

A machine learning model is established, and the TTP information of the malicious sample family to be updated is output according to the machine learning model and the confirmed threat intelligence. The TTP information of the malicious sample family to be updated includes activity status, activity time, and target.