A multi-source threat intelligence confidence value evaluation method based on machine learning

Hansheng LIU; Hongyu TANG; Mingxia BO; Jianfeng NIU; Tianbo LI; Lingxiao LI

doi:10.11959/j.issn.1000-0801.2020010

您当前的位置：

首页 >

文章列表页 >

A multi-source threat intelligence confidence value evaluation method based on machine learning

Research and Development | 更新时间：2024-06-05

- A multi-source threat intelligence confidence value evaluation method based on machine learning
- Telecommunications Science Vol. 36, Issue 1, Pages: 119-126(2020)
- 作者机构：
  
  1. 中国电信股份有限公司上海研究院，上海 200122
  2. 中国电信股份有限公司北京研究院，北京 102209
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.1000-0801.2020010
  CLC： TP393
- Published Online：2020-01，
  
  Published：20 January 2020
- 稿件说明：
移动端阅览
Hansheng LIU, Hongyu TANG, Mingxia BO, et al. A multi-source threat intelligence confidence value evaluation method based on machine learning[J]. Telecommunications science, 2020, 36(1): 119-126.
DOI：

Hansheng LIU, Hongyu TANG, Mingxia BO, et al. A multi-source threat intelligence confidence value evaluation method based on machine learning[J]. Telecommunications science, 2020, 36(1): 119-126. DOI： 10.11959/j.issn.1000-0801.2020010.

摘要

在多源威胁情报收集过程中，由于存在数据价值密度低、情报重复度高、失效时间快等问题，情报中心难以对海量情报数据做出科学决策。针对上述问题，提出一种基于机器学习的多源威胁情报质量评价方法。首先基于标准情报格式，设计了一套多源情报数据标准化流程；其次，针对情报数据的特点，分别从情报来源、情报内容、活跃周期、黑名单库匹配程度4个维度提取特征作为评估情报质量的依据；然后针对提取的特征编码，设计了一套基于深度神经网络算法和 Softmax 分类器的情报质量评价模型，并利用反向误差传播算法最小化重构误差；最后根据2 000条开源已标注样本数据，利用K折交叉验证法对模型进行验证，得到了平均91.37%的宏查准率和84.89%的宏查全率，为多源威胁情报质量评估提供借鉴和参考。

Abstract

During the collection process of multi-source threat intelligence

it is very hard for the intelligence center to make a scientific decision to massive intelligence because the data value density is low

the intelligence repeatabil-ity is high

and the ineffective time is very short

etc.Based on those problems

a new multi-source threat intelligence confidence value evaluation method was put forward based on machine learning.First of all

according to the STIX intelligence standard format

a multi-source intelligence data standardization process was designed.Secondly

ac-cording to the characteristic of data

14 characteristics were extracted from four dimensions of publishing time

source

intelligence content and blacklist matching degree to be the basis of determining the intelligence reliability.After getting the feature encoding

an intelligence confidence value evaluation model was designed based on deep neural network algorithm and Softmax classifier.Backward propagation algorithm was also used to minimize recon-struction error.Last but not least

according to the 2 000 open source marked sample data

k-ford cross-validation method was used to evaluate the model and get an average of 91.37% macro-P rate and 84.89% macro-R rate.It was a good reference for multi-source threat intelligence confidence evaluation.

关键词

Keywords

references

DANDURAND L , SERRANO O S . Towards improved cyber security information sharing [Z ] . 2013 .

刘春年 , 张凌宇 . 应急信息可信度研究范式的三维阐释与构建——基于工程化思维与 WSR 方法论 [J ] . 现代情报 , 2017 , 37 ( 6 ): 24 - 30 .

LIU C N , ZHANG L Y . Three dimensional interpretation and construction of emergency information credibility research paradigm_based on engineering thinking and WSR methodology [J ] . Journal of Modern Information , 2017 , 37 ( 6 ): 24 - 30 .

贺雅琪 . 多源异构数据融合关键技术研究及其应用 [D ] . 成都:电子科技大学 , 2018 .

HE Y Q . Research and applications on the key technology of multi-source heterogeneous data fusion [D ] . Chengdu:University of Electronic Science and Technology of China , 2018 .

徐留杰 , 翟江涛 , 杨康 , 等 . 一种多源网络安全威胁情报采集与封装技术 [J ] . 网络安全技术与应用 , 2018 ( 10 ): 23 - 26 .

XU L J , ZHAI J T , YANG K , et al . A multi-source network security threat information collection and packaging technology [J ] . Network Security Technology ＆ Application , 2018 ( 10 ): 23 - 26 .

MOHAISEN A,AL-IBRAHIM O , KAMHOUA C , et al . Re-thinking information sharing for threat intelligence [Z ] . 2017 .

STHONNARD O , DACIER M . Actionable knowledge discov-ery for threats intelligence support using a multi-dimensional data mining methodology [Z ] . 2008 .

QAMAR S , ANWAR Z , RAHMAN M A , et al . Data-driven analytics for cyber-threat intelligence and information shar-ing [J ] . Computers ＆ Security , 2017 ( 67 ): 35 - 58 .

侯艳芳 , 王锦华 . 基于自更新威胁情报库的大数据安全分析方法 [J ] . 电信科学 , 2018 , 34 ( 3 ): 56 - 64 .

HOU Y F , WANG J H . Big data security analysis method based on self-update threat intelligence database [J ] . Telecommunications Science , 2018 , 34 ( 3 ): 56 - 64 .

李蕾 . 网络空间中威胁情报可信度多维度分析模型研究 [D ] . 北京:北京邮电大学 , 2018 .

LI L . Study on the multi-dimensional analysis model of threat intelligence credibility in cyberspace [D ] . Beijing:Beijing University of Posts and Telecommunications , 2018 .

BOU-HARB E , LUCIA W , FORTI N , et al . Cyber meets control:a novel federated approach for resilient cps leveraging real cyber threat intelligence [J ] . IEEE Communications Magazine , 2017 : 2 - 8 .

SERKETZIS N , KATOS V , ILIOUDIS C , et al . Actionable threat intelligence for digital forensics readiness [J ] . Information＆ Computer Security , 2019 , 27 ( 2 ).

方滨兴 . 定义网络空间安全 [J ] . 网络与信息安全学报 , 2018 , 4 ( 1 ): 1 - 5 .

FANG B X . Define cyberspace security [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 1 ): 1 - 5 .

Views

1095

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

1D-Concatenate based channel estimation DNN model optimization method

Research and application exploration of threat intelligence system of telecom operators

Research and practice of network security threat intelligence management system for power enterprise

Research progress and trends of deep learning based wireless communication receiving method

A survey of deep learning based modulation recognition

Related Author

Zehao QIN

Zhihui CHEN

Min ZHANG

Guangxue YUE

Min LU

Haitao ZHANG

Yi JIANG

Shijie ZHU

Related Institution

College of Science, Jiangxi University of Technology

College of Information Science and Engineering, Jiaxing University

Zhejiang Key Laboratory of Medical Electronics and Digital Health

CGN Intellgent Technology Co., Ltd.

Shanghai Engineering Science ＆Technology Co., Ltd.

⁰