WO2023124166A1 - 威胁情报内生方法及装置 - Google Patents

威胁情报内生方法及装置 Download PDF

Info

Publication number
WO2023124166A1
WO2023124166A1 PCT/CN2022/115680 CN2022115680W WO2023124166A1 WO 2023124166 A1 WO2023124166 A1 WO 2023124166A1 CN 2022115680 W CN2022115680 W CN 2022115680W WO 2023124166 A1 WO2023124166 A1 WO 2023124166A1
Authority
WO
WIPO (PCT)
Prior art keywords
identified
threat intelligence
threat
identification
file
Prior art date
Application number
PCT/CN2022/115680
Other languages
English (en)
French (fr)
Inventor
白敏�
齐向东
吴云坤
汪列军
王胜利
李敏
Original Assignee
奇安信科技集团股份有限公司
奇安信网神信息技术(北京)股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 奇安信科技集团股份有限公司, 奇安信网神信息技术(北京)股份有限公司 filed Critical 奇安信科技集团股份有限公司
Publication of WO2023124166A1 publication Critical patent/WO2023124166A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/23—Updating
    • G06F16/2365—Ensuring data consistency and integrity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2457—Query processing with adaptation to user needs
    • G06F16/24573—Query processing with adaptation to user needs using data annotations, e.g. user-defined metadata
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
    • G06F18/2413—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on distances to training or reference patterns
    • G06F18/24133—Distances to prototypes
    • G06F18/24143—Distances to neighbourhood prototypes, e.g. restricted Coulomb energy networks [RCEN]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/243—Classification techniques relating to the number of classes
    • G06F18/24323—Tree-organised classifiers
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Definitions

  • the present application relates to the technical field of network security, and in particular to a threat intelligence endogenous method and device.
  • Threat intelligence is knowledge information that describes threats based on evidence.
  • the threat identification platform conducts threat identification on a large number of objects to be identified based on threat intelligence
  • the threat intelligence used is fixed, that is, no new threat information will be added.
  • the attack methods of cyber attackers will continue to change. Therefore, when the threat identification platform conducts threat identification based on fixed threat intelligence, the possibility of false positives or false negatives is high.
  • the embodiment of the present application provides a threat information endogenous method and device, the main purpose of which is to generate new threat information during the threat identification process of the threat identification platform for the object to be identified, thereby improving the threat identification platform for the threat identification of the object to be identified. Accuracy.
  • the present application provides a threat intelligence endogenous method, which is applied to a threat identification platform, including:
  • the threat intelligence library includes original threat information and historical endogenous threat information, and the historical content
  • Raw threat intelligence is threat intelligence determined based on historical identification objects
  • the object to be identified and the metadata corresponding to the object to be identified are sent to a threat intelligence operation platform, so that the threat intelligence operation platform will
  • the object to be identified and the metadata corresponding to the object to be identified are distributed to the target terminal device, and the target terminal device performs threat intelligence on the object to be identified according to the object to be identified and the metadata corresponding to the object to be identified operation processing;
  • the endogenous threat intelligence corresponding to the object to be identified fed back by the threat intelligence operation platform is received, the endogenous threat intelligence corresponding to the object to be identified is added to the threat intelligence library.
  • the object to be identified is specifically a file object; after the first identification result corresponding to the object to be identified is determined according to the metadata corresponding to the object to be identified and the threat intelligence library, the method further includes :
  • the first identification result is determined as the final identification result corresponding to the file object.
  • the method also includes:
  • the target historical identification object is a historical identification object whose identification result is a threat object
  • a threat intelligence hit tag corresponding to the file object is generated according to the target threat intelligence, where the target threat intelligence is threat intelligence that successfully matches metadata corresponding to the file object in the threat intelligence library.
  • sending the object to be identified and metadata corresponding to the object to be identified to a threat intelligence operation platform includes:
  • the target terminal device is configured by the target terminal device according to the file object, metadata corresponding to the file object, static analysis results, dynamic analysis results, family gang tags, static behavior feature tags, dynamic behavior feature tags, and threats
  • the intelligence hit tag performs threat intelligence operation processing on the file object
  • adding the endogenous threat intelligence corresponding to the object to be identified to the threat intelligence library includes:
  • modifying the family gang tag When receiving the endogenous threat intelligence and intelligence context information corresponding to the file object fed back by the threat intelligence operation platform, modifying the family gang tag, modifying the static behavior characteristic tag, modifying the dynamic behavior characteristic tag, and modifying the threat intelligence hit tag Adding the intelligence context information corresponding to the file object, the modified family gang tag, the modified static behavior feature tag, the modified dynamic behavior feature tag, and the modified threat intelligence hit tag to the endogenous threat intelligence corresponding to the file object;
  • the endogenous threat intelligence corresponding to the file object is added to the threat intelligence library.
  • the object to be identified is specifically a mail object, a network traffic packet object, a log object, or an open source data object; After the first identification result, the method also includes:
  • the target historical identification object is a historical identification object whose identification result is a threat object
  • a threat intelligence hit tag corresponding to the object to be identified is generated according to the target threat intelligence, where the target threat intelligence is threat intelligence in the threat intelligence database that successfully matches metadata corresponding to the object to be identified.
  • sending the object to be identified and metadata corresponding to the object to be identified to a threat intelligence operation platform includes:
  • the metadata corresponding to the object to be identified, the family group tag and the threat intelligence hit tag are distributed to the target terminal device, and the target terminal device uses the object to be identified, the metadata corresponding to the object to be identified, the family group tag and threat intelligence hit tags to perform threat intelligence operation processing on the object to be identified;
  • adding the endogenous threat intelligence corresponding to the object to be identified to the threat intelligence library includes:
  • the endogenous threat intelligence corresponding to the object to be identified, the corrected family group tag, and the corrected threat intelligence hit tag, the corrected family group tag and the modified The threat intelligence hit tag is added to the endogenous threat intelligence corresponding to the object to be identified;
  • the endogenous threat intelligence corresponding to the object to be identified is added to the threat intelligence library.
  • the present application also provides a threat intelligence endogenous device, which is applied to a threat identification platform, including:
  • the first analysis unit is configured to receive the object to be identified sent by the query terminal device, and analyze and process the object to be identified, so as to obtain metadata corresponding to the object to be identified;
  • the first determining unit is configured to determine a first identification result corresponding to the object to be identified according to metadata corresponding to the object to be identified and a threat intelligence library, wherein the threat intelligence library includes original threat intelligence and historical endogenous Threat intelligence, the historical endogenous threat intelligence is threat intelligence determined according to historical identification objects;
  • a sending unit configured to send the object to be identified and the metadata corresponding to the object to be identified to a threat intelligence operation platform when the first identification result corresponding to the object to be identified is a threat object, so that the threat intelligence
  • the operation platform distributes the object to be identified and the metadata corresponding to the object to be identified to the target terminal device, and the target terminal device treats the object to be identified according to the object to be identified and the metadata corresponding to the object to be identified Identify objects for threat intelligence operations processing;
  • the adding unit is configured to add the endogenous threat intelligence corresponding to the object to be identified to the threat intelligence library when receiving the endogenous threat intelligence corresponding to the object to be identified fed back by the threat intelligence operation platform .
  • the object to be identified is specifically a file object; the device further includes:
  • the second analyzing unit is configured to perform static analysis on the file object after the first determining unit determines the first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence database. Processing, to obtain the static analysis result corresponding to the file object;
  • a third analysis unit configured to perform dynamic analysis processing on the file object, so as to obtain a dynamic analysis result corresponding to the file object
  • a second determining unit configured to determine a second identification result corresponding to the file object according to the static analysis result and the dynamic analysis result
  • a third determination unit configured to determine the second identification result as the final identification result corresponding to the file object when the first identification result is different from the second identification result
  • the third determination unit is further configured to determine the first identification result as the final identification result corresponding to the file object when the first identification result is the same as the second identification result.
  • the device also includes:
  • a first acquiring unit configured to acquire a plurality of target historical identification objects when the final identification result corresponding to the file object is a threat object, wherein the target historical identification object is a historical identification object whose identification result is a threat object;
  • the first classification unit is configured to classify the file object and the plurality of target historical identification objects according to a preset classification algorithm and a plurality of preset family gang tags, so as to obtain a classification result;
  • the first clustering unit is configured to cluster the file object and multiple target historical identification objects according to a preset clustering algorithm to obtain a clustering result;
  • a fourth determining unit configured to determine the family group label corresponding to the file object according to the classification result and the clustering result
  • a first generating unit configured to generate a static behavior feature label corresponding to the file object according to a static analysis result corresponding to the file object;
  • the first generating unit is further configured to generate a dynamic behavior feature tag corresponding to the file object according to a dynamic analysis result corresponding to the file object;
  • the first generating unit is further configured to generate a threat intelligence hit tag corresponding to the file object according to the target threat intelligence, wherein the target threat intelligence is a metadata match corresponding to the file object in the threat intelligence library Successful threat intelligence.
  • the sending unit is specifically configured to send the file object, metadata corresponding to the file object, static analysis results, dynamic analysis results, family group tags, static behavior feature tags, dynamic behavior feature tags, and threat
  • the intelligence hit tag is sent to the threat intelligence operation platform, so that the threat intelligence operation platform can put the file object, the metadata corresponding to the file object, static analysis results, dynamic analysis results, family group tags, static behavior feature tags , dynamic behavior feature tags, and threat intelligence hit tags are assigned to the target terminal device, and the target terminal device assigns the file object, metadata corresponding to the file object, static analysis results, dynamic analysis results, and family gang tags , the static behavior signature tag, the dynamic behavior signature tag, and the threat intelligence hit tag perform threat intelligence operation processing on the file object;
  • the adding unit is specifically configured to, when receiving feedback from the threat intelligence operation platform, endogenous threat intelligence and intelligence context information corresponding to the file object, modify family gang tags, modify static behavior characteristic tags, and modify dynamic behavior characteristics
  • the tag and the modified threat intelligence hit the tag the intelligence context information corresponding to the file object, the modified family group tag, the modified static behavior characteristic tag, the modified dynamic behavior characteristic tag and the modified threat intelligence hit tag are added to the corresponding file object.
  • the endogenous threat intelligence add the endogenous threat intelligence corresponding to the file object to the threat intelligence library.
  • the object to be identified is specifically a mail object, a network traffic packet object, a log object or an open source data object; the device also includes:
  • the second acquiring unit is configured to, after the first determining unit determines the first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence library, when the object corresponding to the object to be identified When the first identification result is a threat object, obtain a plurality of target historical identification objects, wherein the target historical identification object is a historical identification object whose identification result is a threat object;
  • the second classification unit is configured to classify the object to be identified and the plurality of target historical identification objects according to a preset classification algorithm and a plurality of preset family gang labels, so as to obtain a classification result;
  • the second clustering unit is configured to perform clustering processing on the object to be identified and the plurality of target historical identification objects according to a preset clustering algorithm, so as to obtain a clustering result;
  • a fifth determining unit configured to determine the family group label corresponding to the object to be identified according to the classification result and the clustering result
  • the second generation unit is configured to generate a threat intelligence hit tag corresponding to the object to be identified according to the target threat intelligence, wherein the target threat intelligence is that the metadata corresponding to the object to be identified in the threat intelligence library is successfully matched. threat intelligence.
  • the sending unit is specifically configured to send the object to be identified, the metadata corresponding to the object to be identified, the family group tag, and the threat intelligence hit tag to the threat intelligence operation platform, so that the threat The intelligence operation platform distributes the object to be identified, the metadata corresponding to the object to be identified, the family group tag and the threat intelligence hit tag to the target terminal device, and the target terminal device assigns the object to be identified according to the object to be identified, the The metadata, family group tag and threat intelligence hit tag corresponding to the object to be identified perform threat intelligence operation processing on the object to be identified;
  • the adding unit is specifically configured to, when receiving the endogenous threat intelligence corresponding to the object to be identified from the threat intelligence operation platform, correcting the family group tag and correcting the threat intelligence hit tag, adding the object to be identified
  • the corresponding modified family group tag and modified threat intelligence hit tag are added to the endogenous threat intelligence corresponding to the object to be identified; the endogenous threat intelligence corresponding to the object to be identified is added to the threat intelligence library.
  • the embodiments of the present application provide a storage medium, the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the threat intelligence content described in the first aspect raw method.
  • an embodiment of the present application provides a threat intelligence endogenous device, the device includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is controlled by It is configured to execute the program instructions stored in the storage medium; when the program instructions run, execute the threat intelligence endogenous method described in the first aspect.
  • the technical solution provided by the present application has at least the following advantages:
  • This application provides a threat information endogenous method and device.
  • This application can analyze and process the object to be identified by the threat identification platform after receiving the object to be identified sent by the query terminal device, so as to obtain the corresponding information of the object to be identified. Metadata, and then determine the first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence library.
  • the threat identification platform When the first identification result corresponding to the object to be identified is determined to be a threat object, the threat identification platform will The metadata corresponding to the object to be identified is sent to the threat intelligence operation platform, so that the threat intelligence operation platform can distribute the object to be identified and the metadata corresponding to the object to be identified to the target terminal device, and the threat intelligence analyst corresponding to the target terminal device.
  • the metadata corresponding to the object to be identified and the object to be identified are subjected to threat intelligence operation processing to determine the endogenous threat intelligence corresponding to the object to be identified, and the endogenous threat intelligence corresponding to the object to be identified is sent to the threat intelligence through the target terminal device operation platform, and then the threat intelligence operation platform forwards the endogenous threat intelligence corresponding to the object to be identified to the threat identification platform;
  • the endogenous threat intelligence corresponding to the object to be identified may be added to the threat intelligence library, thereby updating the threat intelligence library.
  • the threat identification platform will generate new threat intelligence in the process of threat identification for the object to be identified, and add the newly generated threat intelligence to the threat intelligence library, so as to update the threat intelligence library and improve the threat identification platform.
  • the accuracy rate of threat identification for the object to be identified is the accuracy rate of threat identification for the object to be identified.
  • Fig. 1 shows a flow chart of a threat intelligence endogenous method provided by an embodiment of the present application
  • FIG. 2 shows a flow chart of another threat intelligence endogenous method provided by the embodiment of the present application
  • FIG. 3 shows a block diagram of a threat intelligence endogenous device provided by an embodiment of the present application
  • FIG. 4 shows a block diagram of another threat intelligence endogenous device provided by an embodiment of the present application.
  • An embodiment of the present application provides a threat intelligence endogenous method, which is applied to a threat identification platform, as shown in Figure 1.
  • the method includes:
  • the query terminal device is a terminal device within the enterprise (government or other organization) that needs to identify the threat of the object to be identified; wherein, the object to be identified can be but not limited to: file object, mail object, network traffic packet object, log object or For open source data objects, etc., the metadata corresponding to the object to be identified is the data used to describe the characteristics of the object to be identified.
  • the querying terminal device when the querying terminal device expects to perform threat identification on the object to be identified, the querying terminal device will send the object to be identified to the threat identification platform.
  • Identification object After receiving the object to be identified sent by the query terminal device, the threat identification platform needs to analyze and process the object to be identified, so as to obtain the metadata corresponding to the object to be identified.
  • the threat identification platform can analyze and process the object to be identified through the email detection engine, thereby obtaining metadata corresponding to the object to be identified; when the object to be identified is specifically a file object
  • the threat identification platform can use the RAS (RedDrip APT Scanner, Red Raindrop APT detection engine) engine to analyze and process the object to be identified, so as to obtain the metadata corresponding to the object to be identified, but not limited to this.
  • RAS RedDrip APT Scanner, Red Raindrop APT detection engine
  • the threat intelligence database contains original threat intelligence and historical endogenous threat intelligence.
  • the original threat intelligence is the threat intelligence configured for the threat identification platform by the staff before the threat identification platform is put into use
  • the historical endogenous threat intelligence is the threat intelligence after the threat identification platform is put into use. , which is based on the threat intelligence determined by the historical identification object, where the historical identification object is an object that was subjected to threat identification before this threat identification.
  • the threat identification platform after the threat identification platform obtains the metadata corresponding to the object to be identified, it can determine the identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence database (that is, the first identification result ), matching the metadata corresponding to the object to be identified with the original threat intelligence and historical endogenous threat intelligence contained in the threat intelligence library, when the metadata corresponding to the object to be identified fails to match all the threat intelligence in the threat database, Determine that the first identification result corresponding to the object to be identified is a non-threat object (that is, the object to be identified does not have a threat), and when the metadata corresponding to the object to be identified matches successfully with a threat intelligence in the threat database, determine that the object to be identified corresponds to The first identification result of is a threat object (that is, the object to be identified has a threat).
  • the identification result that the object to be identified is a non-threat object needs to be fed back to the query terminal device.
  • the first identification result corresponding to the object to be identified is a threat object
  • the threat identification platform when it is determined that the first identification result corresponding to the object to be identified is a threat object, the threat identification platform can send the object to be identified and the metadata corresponding to the object to be identified to the threat intelligence operation platform, so that the threat intelligence
  • the operation platform assigns the object to be identified and the metadata corresponding to the object to be identified to the target terminal device, wherein the target terminal device is a terminal device corresponding to a threat intelligence analyst; After identifying the object and the metadata corresponding to the object to be identified, the threat intelligence analyst corresponding to the target terminal device can perform threat intelligence operation processing on the object to be identified based on the metadata corresponding to the object to be identified and the object to be identified.
  • the metadata corresponding to the object to be identified determines whether the first identification result corresponding to the object to be identified is correct, and when it is determined that the first identification result corresponding to the object to be identified is correct, it will determine Threat intelligence corresponding to the object to be identified (that is, endogenous threat intelligence), and send the endogenous threat intelligence corresponding to the object to be identified to the threat intelligence operation platform through the target terminal device, and then the threat intelligence operation platform will send the internal threat intelligence corresponding to the object to be identified
  • Threat intelligence corresponding to the object to be identified that is, endogenous threat intelligence
  • the threat intelligence operation platform will send the internal threat intelligence corresponding to the object to be identified
  • the generated threat intelligence is forwarded to the threat identification platform; when it is determined that the first identification result corresponding to the object to be identified is wrong, it will send an error message to the threat intelligence operation platform through the target terminal device, and then the threat intelligence operation platform will forward the error information to the threat identification platform.
  • the threat identification platform when receiving the endogenous threat intelligence corresponding to the object to be identified fed back by the threat intelligence operation platform, the threat identification platform can add the endogenous threat information corresponding to the object to be identified to the threat intelligence library, This updates the threat intelligence library.
  • the threat identification platform adds the endogenous threat intelligence corresponding to the object to be identified to the threat intelligence database, it needs to feed back the identification result that the object to be identified is a threat object to the query terminal device, and can also The endogenous threat intelligence corresponding to the object is fed back to the query terminal device together with the identification result.
  • the threat identification platform needs to feed back the identification result that the object to be identified is a non-threat object to the query terminal device.
  • the embodiment of the present application provides a threat intelligence endogenous method.
  • the embodiment of the present application can analyze and process the object to be authenticated by the threat identification platform after receiving the object to be authenticated sent by the query terminal device, so as to obtain the object to be authenticated The corresponding metadata, and then determine the first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence library.
  • the threat identification platform When it is determined that the first identification result corresponding to the object to be identified is a threat object, the threat identification platform will wait for The metadata corresponding to the identified object and the object to be identified is sent to the threat intelligence operation platform, so that the threat intelligence operation platform can distribute the metadata corresponding to the object to be identified and the object to be identified to the target terminal device, and the threat intelligence analyst corresponding to the target terminal device According to the object to be identified and the metadata corresponding to the object to be identified, perform threat intelligence operation processing on the object to be identified, so as to determine the endogenous threat intelligence corresponding to the object to be identified, and send the endogenous threat intelligence corresponding to the object to be identified to Threat intelligence operation platform, and then the threat intelligence operation platform forwards the endogenous threat intelligence corresponding to the object to be identified to the threat identification platform; after receiving the endogenous threat intelligence corresponding to the object to be identified fed back by the threat intelligence operation platform, the threat identification platform , the endogenous threat intelligence corresponding to the object to be identified can be added to the threat intelligence library
  • the threat identification platform will generate new threat intelligence in the process of threat identification for the object to be identified, and add the newly generated threat intelligence to the threat intelligence library, so as to update the threat intelligence library and improve the threat identification platform.
  • the accuracy rate of threat identification for the object to be identified is the accuracy rate of threat identification for the object to be identified.
  • the embodiment of the present application provides another threat intelligence endogenous method, which is applied to the rendering server, as shown in Figure 2 specifically, the method includes:
  • step 201 receiving the object to be authenticated sent by the query terminal device, and analyzing and processing the object to be authenticated to obtain the metadata corresponding to the object to be authenticated, you can refer to the description of the corresponding part in FIG. 1 , the embodiment of the present application here will No longer.
  • step 202 determining the first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence database, reference may be made to the description of the corresponding part in FIG.
  • the threat identification platform determines the first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence library, it also needs to determine the family group label corresponding to the object to be identified.
  • the threat identification platform can determine the family group label corresponding to the object to be identified in the following manner:
  • the threat identification platform needs to perform static analysis on the file object first to obtain the corresponding static analysis results of the file object; then perform dynamic analysis on the file object to obtain the file object corresponding Then, according to the static analysis result and the dynamic analysis result corresponding to the file object, determine the second identification result corresponding to the file object; when the first identification result corresponding to the file object is different from the second identification result, the file object corresponds to The second identification result corresponding to the file object is determined as the final identification result corresponding to the file object; when the first identification result corresponding to the file object is the same as the second identification result, the first identification result corresponding to the file object is determined as the final identification result corresponding to the file object , so that the dynamic analysis result and the static analysis result based on the file object can be corrected based on the identification result determined by the threat intelligence library, thereby improving the accuracy of the threat identification platform for the file object.
  • the specific process of dynamic analysis and processing of file objects by the threat identification platform is as follows: dynamic analysis and processing of file objects through the preset file dynamic high-resistance analyzer, so as to obtain the dynamic analysis results corresponding to the file objects, and preset file dynamic high-resistance
  • the analyzer can be, but not limited to: a sandbox, a RAS engine, or other file identifiers; wherein, the specific process for the threat identification platform to determine the second identification result corresponding to the file object according to the static analysis results and dynamic analysis results corresponding to the file object is: When the static analysis result and the dynamic analysis result corresponding to the file object are both threat objects, it is determined that the second identification result corresponding to the file object is a threat object; when the static analysis results and the dynamic analysis results corresponding to the file object are both non-threat objects, determining that the second identification result corresponding to the file object is a non-threat object; when the static analysis result corresponding to the file object is a threat object and the dynamic analysis result
  • the threat identification platform can perform the operation of determining the family group label corresponding to the file object.
  • the object is a historical identification object whose identification result is a threat object; secondly, according to the preset classification algorithm and multiple preset family gang labels, the file object and multiple target historical identification objects are classified, so as to obtain the classification result, wherein, the classification result Contains multiple categories, each category contains multiple identification objects, each category corresponds to a preset family group label, the preset classification algorithm can be but not limited to: random forest classification algorithm; again, according to the preset clustering algorithm Perform clustering processing on file objects and multiple target historical identification objects to obtain clustering results.
  • the clustering results contain multiple clusters, and each cluster contains multiple identification objects.
  • the preset clustering algorithm can be Not limited to: K-proximity clustering algorithm; then, determine the family group label corresponding to the file object according to the classification result and the clustering result, that is, when the multiple categories contained in the classification result correspond to the multiple clusters contained in the clustering result , determine the preset family gang label corresponding to the category of the file object as the family gang label corresponding to the file object, when there are differences between the multiple categories contained in the classification result and the multiple clusters contained in the clustering result, the classification result and The clustering result is temporarily determined as the family gang label corresponding to the file object, so that subsequent threat intelligence analysts can determine the family gang label corresponding to the file object according to the classification result and the clustering result; wherein, the file object can be identified according to the family gang label corresponding to the file object. Perform threat source tracing to determine the threat source corresponding to the file object.
  • the threat identification platform needs to feed back the identification result that the file object is a non-threat object to the query terminal device.
  • the threat identification platform after the threat identification platform determines the family group label corresponding to the file object, it can first generate the static behavior characteristic label corresponding to the file object according to the static analysis result corresponding to the file object, that is, according to the preset rules Extract the static behavior characteristics corresponding to the file object from the static analysis results corresponding to the file object, and generate the static behavior characteristic label corresponding to the file object according to the static behavior characteristic corresponding to the file object; then generate the file object correspondence according to the dynamic analysis result corresponding to the file object
  • the dynamic behavior feature label of the file object that is, extract the dynamic behavior feature corresponding to the file object from the dynamic analysis result corresponding to the file object according to the preset rules, and generate the dynamic behavior feature label corresponding to the file object according to the dynamic behavior feature corresponding to the file object; finally, Generate a threat intelligence hit tag corresponding to a file object based on the target threat intelligence, where the target threat intelligence is the threat intelligence that successfully matches the metadata corresponding to the file object in the threat intelligence library, and the threat intelligence
  • the threat identification platform can directly perform the operation of determining the family gang label corresponding to the object to be identified.
  • the specific process is as follows: first , to obtain multiple target historical identification objects; secondly, according to the preset classification algorithm and multiple preset family gang labels, the object to be identified and the multiple target historical identification objects are classified, so as to obtain the classification result, wherein the classification result contains multiple Each category contains multiple identification objects, and each category corresponds to a preset family gang label; again, according to the preset clustering algorithm, the objects to be identified and multiple target historical identification objects are clustered to obtain the cluster Class results, wherein the clustering results contain multiple clusters, and each cluster contains multiple identification objects; then, according to the classification results and clustering results, determine the family group label corresponding to the object to be identified, that is, when the classification results contain When multiple categories correspond to multiple clusters contained in the clustering result, the preset family group label
  • the classification results and clustering results are temporarily determined as the family gang labels corresponding to the objects to be identified, so that subsequent threat intelligence analysts can determine the objects to be identified based on the classification results and clustering results
  • the corresponding family group label wherein, according to the family group label corresponding to the object to be identified, the threat source of the object to be identified can be traced to determine the source of the threat corresponding to the object to be identified.
  • the threat identification platform after the threat identification platform determines the family group tag corresponding to the object to be identified, it can also generate a threat intelligence hit tag corresponding to the object to be identified according to the target threat intelligence, wherein the target threat intelligence is threat intelligence
  • the target threat intelligence is threat intelligence
  • the metadata corresponding to the object to be identified is successfully matched with the threat intelligence in the library, and the threat intelligence hit tag corresponding to the object to be identified is used to indicate which threat intelligence in the threat intelligence library the object to be identified hits.
  • the first identification result corresponding to the object to be identified is a threat object
  • the object to be identified is a file object, and it is determined that the final identification result corresponding to the file object is a threat object
  • the file object, metadata corresponding to the file object, static analysis results, and dynamic analysis results need to be
  • family group tags, static behavior signature tags, dynamic behavior signature tags, and threat intelligence hit tags are sent to the threat intelligence operation platform, so that the threat intelligence operation platform can collect file objects, metadata corresponding to file objects, static analysis results, dynamic analysis results, Family gang tags, static behavior signature tags, dynamic behavior signature tags, and threat intelligence hit tags are assigned to the target terminal device; the target terminal device receives the file object assigned by the threat intelligence operation platform, the metadata corresponding to the file object, static analysis results, After the dynamic analysis results, family gang tags, static behavior signature tags, dynamic behavior signature tags, and threat intelligence hit tags, the threat intelligence analysts corresponding to the target terminal device can use the file object, metadata corresponding to the file object, static analysis results, Dynamic analysis results, family gang tags, static behavior signature tags, dynamic behavior signature tags, and
  • the endogenous threat intelligence corresponding to the file object will be determined according to the file object and the metadata corresponding to the file object, and based on the file object
  • the corresponding static analysis results and dynamic analysis results determine the intelligence context information corresponding to the file object, and correct the family gang tags, static behavior feature tags, dynamic behavior feature tags, and threat intelligence hit tags corresponding to the file object to obtain the file object
  • Corresponding modified family group tags, modified static behavior feature tags, modified dynamic behavior feature tags, and modified threat intelligence hit tags, and finally through the target terminal device, the endogenous threat intelligence, intelligence context information, modified family group tags, and modified Static behavior feature tags, corrected dynamic behavior feature tags, and corrected threat intelligence hit tags are sent to the threat intelligence operation platform, and then the threat intelligence operation platform sends the endogenous threat intelligence corresponding to the file object, intelligence context information, corrected family gang tags, and corrected static Behavior feature tags, corrected dynamic behavior feature tags, and corrected threat intelligence hit tags are forwarded to the threat identification platform; when it is determined
  • the object to be identified is specifically an email object, a network traffic packet object, a log object, or an open source data object, and it is determined that the first identification result corresponding to the object to be identified is a threat object
  • the object to be identified needs to be , the metadata corresponding to the object to be identified, the family group tag, and the threat intelligence hit tag are sent to the threat intelligence operation platform, so that the threat intelligence operation platform can send the object to be identified, the metadata corresponding to the object to be identified, the family group tag, and the threat intelligence hit tag Assigned to the target terminal device; after the target terminal device receives the object to be identified, the metadata corresponding to the object to be identified, the family gang tag, and the threat intelligence hit tag assigned by the threat intelligence operation platform, the threat intelligence analyst corresponding to the target terminal device will According to the object to be identified, the metadata corresponding to the object to be identified, the family group tag and the threat intelligence hit tag, the threat intelligence operation process can be performed on the object to be identified, that is, the corresponding object
  • the endogenous threat intelligence corresponding to the object to be identified will be determined according to the object to be identified and the metadata corresponding to the object to be identified, and the The family gang tag and threat intelligence hit tag corresponding to the object are corrected to obtain the corrected family gang tag and the corrected threat intelligence hit tag corresponding to the object to be identified, and finally the endogenous threat intelligence, corrected
  • the family gang tag and the corrected threat intelligence hit tag are sent to the threat intelligence operation platform, and then the threat intelligence operation platform forwards the endogenous threat intelligence corresponding to the object to be identified, the corrected family gang tag, and the corrected threat intelligence hit tag to the threat identification platform;
  • an error message will be sent to the threat intelligence operation platform through the target terminal device, and then the threat intelligence operation platform will forward the error message to the threat identification platform.
  • the threat intelligence operation platform will put the endogenous threat intelligence corresponding to the file object, intelligence context information, modified family gang tags, modified static behavior feature tags, and modified dynamic Behavioral feature tags and corrected threat intelligence hit tags are sent to the threat identification platform.
  • the threat identification platform needs to first add the intelligence context information corresponding to the file object, the modified family group tag, the modified static behavior signature tag, the modified dynamic behavior signature tag, and the modified threat intelligence hit tag to the In the endogenous threat intelligence corresponding to the file object; then add the endogenous threat intelligence corresponding to the file object to the threat intelligence library, thereby enriching the content contained in the endogenous threat intelligence corresponding to the file object.
  • the threat intelligence operation platform will use the endogenous threat intelligence corresponding to the object to be identified, and modify the family group label and corrected threat intelligence hit tags are forwarded to the threat identification platform.
  • the threat identification platform When receiving the feedback from the threat intelligence operation platform, the endogenous threat intelligence corresponding to the object to be identified, the corrected family group tag, and the corrected threat intelligence hit tag, the threat identification platform needs to first The corrected family gang tag and the corrected threat intelligence hit tag corresponding to the object to be identified are added to the endogenous threat intelligence corresponding to the object to be identified, and then the endogenous threat intelligence corresponding to the object to be identified is added to the threat intelligence library, thereby enriching the file object The content contained in the corresponding endogenous threat intelligence.
  • the threat identification platform adds the endogenous threat intelligence corresponding to the object to be identified to the threat intelligence database, it needs to feed back the identification result that the object to be identified is a threat object to the query terminal device, and can also The endogenous threat intelligence corresponding to the object is fed back to the query terminal device together with the identification result.
  • the threat identification platform when receiving the error message fed back by the target terminal device, the threat identification platform needs to feed back the identification result that the object to be identified is a non-threat object to the query terminal device.
  • the embodiment of the present application further provides a storage medium, the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute The threat intelligence endogenous approach described above.
  • an embodiment of the present application also provides a threat intelligence endogenous device, the device includes a storage medium; and one or more processors, the storage medium and the Coupled with a processor, the processor is configured to execute program instructions stored in the storage medium; when the program instructions run, execute the above-mentioned threat intelligence endogenous method.
  • another embodiment of the present application also provides a threat intelligence endogenous device, which is applied to a threat identification platform.
  • This device embodiment corresponds to the foregoing method embodiment.
  • this device embodiment does not repeat the details in the foregoing method embodiment one by one, but it should be clear that the device in this embodiment can correspond to the foregoing method implementation.
  • the device is applied to generate new threat intelligence during the process of threat identification of the object to be identified by the threat identification platform, thereby improving the accuracy of the threat identification of the object to be identified by the threat identification platform.
  • the device includes:
  • the first analysis unit 301 is configured to receive the object to be identified sent by the query terminal device, and analyze and process the object to be identified, so as to obtain metadata corresponding to the object to be identified;
  • the first determining unit 302 is configured to determine a first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence library, wherein the threat intelligence library contains original threat information and historical content Generating threat intelligence, the historical endogenous threat intelligence is threat intelligence determined according to historical identification objects;
  • the sending unit 303 is configured to send the object to be identified and the metadata corresponding to the object to be identified to a threat intelligence operation platform when the first identification result corresponding to the object to be identified is a threat object, so that the threat
  • the intelligence operation platform distributes the object to be identified and the metadata corresponding to the object to be identified to the target terminal device, and the target terminal device assigns the object to be identified according to the object to be identified and the metadata corresponding to the object to be identified Objects to be identified are processed by threat intelligence operations;
  • Adding unit 304 configured to add the endogenous threat intelligence corresponding to the object to be identified to the threat intelligence database when receiving the endogenous threat intelligence corresponding to the object to be identified fed back by the threat intelligence operation platform middle.
  • the object to be identified is specifically a file object; the device also includes:
  • the second analyzing unit 305 is configured to perform static analysis on the file object after the first determining unit 302 determines the first identification result corresponding to the object to be identified according to the metadata and the threat intelligence database corresponding to the object to be identified. Processing, to obtain the static analysis result corresponding to the file object;
  • the third analysis unit 306 is configured to perform dynamic analysis processing on the file object, so as to obtain a dynamic analysis result corresponding to the file object;
  • the second determination unit 307 is configured to determine a second identification result corresponding to the file object according to the static analysis result and the dynamic analysis result;
  • a third determination unit 308, configured to determine the second identification result as the final identification result corresponding to the file object when the first identification result is different from the second identification result;
  • the third determination unit 308 is further configured to determine the first identification result as the final identification result corresponding to the file object when the first identification result is the same as the second identification result.
  • the device also includes:
  • the first acquiring unit 309 is configured to acquire a plurality of target historical identification objects when the final identification result corresponding to the file object is a threat object, wherein the target historical identification object is a historical identification object whose identification result is a threat object;
  • the first classification unit 310 is configured to classify the file object and the plurality of target historical identification objects according to a preset classification algorithm and a plurality of preset family gang labels, so as to obtain a classification result;
  • the first clustering unit 311 is configured to cluster the file object and multiple target historical identification objects according to a preset clustering algorithm, so as to obtain a clustering result;
  • a fourth determining unit 312, configured to determine the family group label corresponding to the file object according to the classification result and the clustering result
  • the first generating unit 313 is configured to generate a static behavior feature label corresponding to the file object according to the static analysis result corresponding to the file object;
  • the first generating unit 313 is further configured to generate a dynamic behavior feature tag corresponding to the file object according to a dynamic analysis result corresponding to the file object;
  • the first generating unit 313 is further configured to generate a threat intelligence hit tag corresponding to the file object according to the target threat intelligence, wherein the target threat intelligence is that the metadata corresponding to the file object in the threat intelligence library is successfully matched. threat intelligence.
  • the sending unit 303 is specifically configured to send the file object, metadata corresponding to the file object, static analysis results, dynamic analysis results, family group tags, static behavior feature tags, dynamic behavior
  • the signature tag and the threat intelligence hit tag are sent to the threat intelligence operation platform, so that the threat intelligence operation platform will send the file object, the metadata corresponding to the file object, the static analysis result, the dynamic analysis result, the family gang tag, Static behavior signature tags, dynamic behavior signature tags, and threat intelligence hit tags are assigned to the target terminal device, and the target terminal device assigns the target terminal device according to the file object, metadata corresponding to the file object, static analysis results, and dynamic analysis results.
  • family gang tags, static behavior signature tags, dynamic behavior signature tags, and threat intelligence hit tags perform threat intelligence operation processing on the file object;
  • the adding unit 304 is specifically configured to, when receiving feedback from the threat intelligence operation platform, endogenous threat intelligence and intelligence context information corresponding to the file object, modify family gang tags, modify static behavior characteristic tags, and modify dynamic behavior characteristic tags
  • modify the threat intelligence hit tag the intelligence context information corresponding to the file object, the modified family gang tag, the modified static behavior characteristic tag, the modified dynamic behavior characteristic tag and the modified threat intelligence hit tag are added to the content corresponding to the file object. Adding the native threat intelligence corresponding to the file object to the threat intelligence library.
  • the object to be identified is specifically a mail object, a network traffic packet object, a log object or an open source data object; the device also includes:
  • the second acquiring unit 314 is configured to, after the first determining unit 302 determines the first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence library, when the object corresponding to the object to be identified When the first identification result is a threat object, obtain a plurality of target historical identification objects, wherein the target historical identification object is a historical identification object whose identification result is a threat object;
  • the second classification unit 315 is configured to classify the object to be identified and the plurality of target historical identification objects according to a preset classification algorithm and a plurality of preset family gang labels, so as to obtain a classification result;
  • the second clustering unit 316 is configured to perform clustering processing on the object to be identified and a plurality of target historical identification objects according to a preset clustering algorithm, so as to obtain a clustering result;
  • the fifth determining unit 317 is configured to determine the family group label corresponding to the object to be identified according to the classification result and the clustering result;
  • the second generating unit 318 is configured to generate a threat intelligence hit tag corresponding to the object to be identified according to the target threat intelligence, wherein the target threat intelligence is a metadata match in the threat intelligence database corresponding to the object to be identified Successful threat intelligence.
  • the sending unit 303 is specifically configured to send the object to be identified, the metadata corresponding to the object to be identified, the family group tag, and the threat intelligence hit tag to the threat intelligence operation platform, In order for the threat intelligence operation platform to assign the object to be identified, the metadata corresponding to the object to be identified, the family group tag, and the threat intelligence hit tag to the target terminal device, the target terminal device.
  • the identification object, the metadata corresponding to the object to be identified, the family gang tag and the threat intelligence hit tag perform threat intelligence operation processing on the object to be identified;
  • the adding unit 304 is specifically configured to, when receiving the endogenous threat intelligence corresponding to the object to be identified fed back by the threat intelligence operation platform, modifying the family group tag and modifying the threat intelligence hit tag, corresponding to the object to be identified.
  • the modified family gang tag and the modified threat intelligence hit tag are added to the endogenous threat intelligence corresponding to the object to be identified; the endogenous threat intelligence corresponding to the object to be identified is added to the threat intelligence library.
  • the embodiment of the present application provides a threat information endogenous method and device.
  • the embodiment of the present application can analyze and process the object to be identified by the threat identification platform after the threat identification platform receives the object to be identified sent by the query terminal device, so as to obtain the object to be identified. Identify the metadata corresponding to the object, and then determine the first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence database.
  • the threat identification platform Send the object to be identified and the metadata corresponding to the object to be identified to the threat intelligence operation platform, so that the threat intelligence operation platform can distribute the object to be identified and the metadata corresponding to the object to be identified to the target terminal device, and the threat intelligence corresponding to the target terminal device
  • the analyst performs threat intelligence operation processing on the object to be identified, so as to determine the endogenous threat intelligence corresponding to the object to be identified, and through the target terminal device, the endogenous threat intelligence corresponding to the object to be identified Send it to the threat intelligence operation platform, and then the threat intelligence operation platform forwards the endogenous threat intelligence corresponding to the object to be identified to the threat identification platform; after receiving the feedback from the threat intelligence operation platform, the threat identification platform After the information is obtained, the endogenous threat intelligence corresponding to the object to be identified can be added to the threat intelligence library, thereby updating the threat intelligence
  • the threat identification platform will generate new threat intelligence in the process of threat identification for the object to be identified, and add the newly generated threat intelligence to the threat intelligence library, so as to update the threat intelligence library and improve the threat identification platform.
  • the accuracy rate of threat identification for the object to be identified is the accuracy rate of threat identification for the object to be identified.
  • the threat intelligence endogenous device includes a processor and a memory, the above-mentioned first analyzing unit, first determining unit, sending unit and adding unit are all stored in the memory as program units, and the processor executes the above-mentioned program stored in the memory unit to achieve the corresponding function.
  • the processor includes a kernel, and the kernel fetches corresponding program units from the memory.
  • One or more kernels can be set, and by adjusting the kernel parameters, new threat intelligence can be generated during the threat identification process of the object to be identified by the threat identification platform, thereby improving the accuracy of the threat identification of the object to be identified by the threat identification platform.
  • An embodiment of the present application provides a storage medium, the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned threat intelligence endogenous method.
  • Storage media may include non-permanent memory in computer-readable media, in the form of random access memory (RAM) and/or nonvolatile memory, such as read-only memory (ROM) or flash memory (flash RAM), and the memory includes at least a memory chip.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash memory
  • An embodiment of the present application also provides a threat intelligence endogenous device, the device includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute the The program instructions stored in the storage medium; when the program instructions are run, execute the above-mentioned threat intelligence endogenous method.
  • An embodiment of the present application provides a device, which includes a processor, a memory, and a program stored on the memory and that can run on the processor.
  • the processor executes the program, the following steps are implemented:
  • the threat intelligence library includes original threat information and historical endogenous threat information, and the historical content
  • Raw threat intelligence is threat intelligence determined based on historical identification objects
  • the object to be identified and the metadata corresponding to the object to be identified are sent to a threat intelligence operation platform, so that the threat intelligence operation platform will
  • the object to be identified and the metadata corresponding to the object to be identified are distributed to the target terminal device, and the target terminal device performs threat intelligence on the object to be identified according to the object to be identified and the metadata corresponding to the object to be identified operation processing;
  • the endogenous threat intelligence corresponding to the object to be identified fed back by the threat intelligence operation platform is received, the endogenous threat intelligence corresponding to the object to be identified is added to the threat intelligence library.
  • the object to be identified is specifically a file object; after the first identification result corresponding to the object to be identified is determined according to the metadata corresponding to the object to be identified and the threat intelligence library, the method further includes :
  • the first identification result is determined as the final identification result corresponding to the file object.
  • the method also includes:
  • the target historical identification object is a historical identification object whose identification result is a threat object
  • a threat intelligence hit tag corresponding to the file object is generated according to the target threat intelligence, where the target threat intelligence is threat intelligence that successfully matches metadata corresponding to the file object in the threat intelligence library.
  • sending the object to be identified and metadata corresponding to the object to be identified to a threat intelligence operation platform includes:
  • the target terminal device is configured by the target terminal device according to the file object, metadata corresponding to the file object, static analysis results, dynamic analysis results, family gang tags, static behavior feature tags, dynamic behavior feature tags, and threats
  • the intelligence hit tag performs threat intelligence operation processing on the file object
  • adding the endogenous threat intelligence corresponding to the object to be identified to the threat intelligence library includes:
  • modifying the family gang tag When receiving the endogenous threat intelligence and intelligence context information corresponding to the file object fed back by the threat intelligence operation platform, modifying the family gang tag, modifying the static behavior characteristic tag, modifying the dynamic behavior characteristic tag, and modifying the threat intelligence hit tag Adding the intelligence context information corresponding to the file object, the modified family gang tag, the modified static behavior feature tag, the modified dynamic behavior feature tag, and the modified threat intelligence hit tag to the endogenous threat intelligence corresponding to the file object;
  • the endogenous threat intelligence corresponding to the file object is added to the threat intelligence library.
  • the object to be identified is specifically a mail object, a network traffic packet object, a log object, or an open source data object; After the first identification result, the method also includes:
  • the target historical identification object is a historical identification object whose identification result is a threat object
  • a threat intelligence hit tag corresponding to the object to be identified is generated according to the target threat intelligence, where the target threat intelligence is threat intelligence in the threat intelligence database that successfully matches metadata corresponding to the object to be identified.
  • sending the object to be identified and metadata corresponding to the object to be identified to a threat intelligence operation platform includes:
  • the metadata corresponding to the object to be identified, the family group tag and the threat intelligence hit tag are distributed to the target terminal device, and the target terminal device uses the object to be identified, the metadata corresponding to the object to be identified, the family group tag and threat intelligence hit tags to perform threat intelligence operation processing on the object to be identified;
  • adding the endogenous threat intelligence corresponding to the object to be identified to the threat intelligence library includes:
  • the endogenous threat intelligence corresponding to the object to be identified, the corrected family group tag, and the corrected threat intelligence hit tag, the corrected family group tag and the modified The threat intelligence hit tag is added to the endogenous threat intelligence corresponding to the object to be identified;
  • the endogenous threat intelligence corresponding to the object to be identified is added to the threat intelligence database.
  • the present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program code initialized with the following method steps: receiving an object to be authenticated sent by an inquiry terminal device, and performing an operation on the object to be authenticated Analyzing and processing to obtain metadata corresponding to the object to be identified; determining a first identification result corresponding to the object to be identified according to the metadata corresponding to the object to be identified and the threat intelligence library, wherein the threat intelligence library Contains original threat intelligence and historical endogenous threat intelligence, the historical endogenous threat intelligence is threat intelligence determined based on historical identification objects; when the first identification result corresponding to the object to be identified is a threat object, the to-be-identified The object and the metadata corresponding to the object to be identified are sent to the threat intelligence operation platform, so that the threat intelligence operation platform distributes the object to be identified and the metadata corresponding to the object to be identified to the target terminal device, and the The target terminal device performs threat intelligence operation processing on the object to be identified according to the object to be
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in computer readable media, in the form of random access memory (RAM) and/or nonvolatile memory such as read only memory (ROM) or flash RAM.
  • RAM random access memory
  • ROM read only memory
  • flash RAM flash random access memory
  • Computer-readable media including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information.
  • Information may be computer readable instructions, data structures, modules of a program, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape magnetic disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device.
  • computer-readable media excludes transitory computer-readable media, such as modulated data signals and carrier waves.
  • the embodiments of the present application may be provided as methods, systems or computer program products. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Health & Medical Sciences (AREA)
  • Evolutionary Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Computation (AREA)
  • Artificial Intelligence (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Computational Linguistics (AREA)
  • Library & Information Science (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Alarm Systems (AREA)

Abstract

本申请公开一种威胁情报内生方法及装置，涉及网络安全技术领域。本申请的方法包括：接收查询终端设备发送的待鉴定对象，并对待鉴定对象进行分析处理，以获得待鉴定对象对应的元数据；根据待鉴定对象对应的元数据和威胁情报库确定待鉴定对象对应的第一鉴定结果；当待鉴定对象对应的第一鉴定结果为威胁对象时，将待鉴定对象和待鉴定对象对应的元数据发送至威胁情报运营平台；当接收到威胁情报运营平台反馈的、待鉴定对象对应的内生威胁情报时，将待鉴定对象对应的内生威胁情报添加至威胁情报库中。

Description

威胁情报内生方法及装置 技术领域
本申请涉及网络安全技术领域，尤其涉及一种威胁情报内生方法及装置。
背景技术
随着互联网技术的不断发展，网络成为企业、政府等组织办公、生产不可或缺的一部分。其中，网络安全问题是企业、政府等组织的关注重点，企业、政府等组织通常通过威胁鉴定平台维护自身的网络安全。威胁鉴定平台基于威胁情报，对文件、日志、网络流量包等对象进行威胁鉴定，其中，威胁情报是一种基于证据来描述威胁的知识信息。
目前，威胁鉴定平台在基于威胁情报对大量待鉴定对象进行威胁鉴定时，所使用的威胁情报是固定不变的，即不会新增威胁情报。然而，网络攻击者的攻击手段会不断改变，因此，威胁鉴定平台基于固定不变的威胁情报对待鉴定对象进行威胁鉴定时，漏报或误报的可能性较高。
发明内容
本申请实施例提供一种威胁情报内生方法及装置，主要目的在于在威胁鉴定平台对待鉴定对象进行威胁鉴定的过程中，生成新的威胁情报，从而提高威胁鉴定平台对待鉴定对象进行威胁鉴定的准确率。
为解决上述技术问题，本申请实施例提供如下技术方案：
第一方面，本申请提供了一种威胁情报内生方法，所述方法应用于威胁鉴定平台，包括：
接收查询终端设备发送的待鉴定对象，并对所述待鉴定对象进行分析处理，以获得所述待鉴定对象对应的元数据；
根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果，其中，所述威胁情报库中包含原始威胁情报和历史内生威胁情报，所述历史内生威胁情报为根据历史鉴定对象确定的威胁情报；
当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象和所述待鉴定对象对应的元数据分配给目标终端设备，由所述目标终端设备根据所述待鉴定对象和所述待鉴定对象对应的元数据对所述待鉴定对象进行威胁情报运营处理；
当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
可选的，所述待鉴定对象具体为文件对象；在所述根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，所述方法还包括：
对所述文件对象进行静态分析处理，以获得所述文件对象对应的静态分析结果；
对所述文件对象进行动态分析处理，以获得所述文件对象对应的动态分析结果；
根据所述静态分析结果和所述动态分析结果确定所述文件对象对应的第二鉴定结果；
当所述第一鉴定结果与所述第二鉴定结果不同时，将所述第二鉴定结果确定为所述文件对象对应的最终鉴定结果；
当所述第一鉴定结果与所述第二鉴定结果相同时，将所述第一鉴定结果确定为所述文件对象对应的最终鉴定结果。
可选的，所述方法还包括：
当所述文件对象对应的最终鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中，所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
根据预置分类算法和多个预置家族团伙标签对所述文件对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
根据预置聚类算法对所述文件对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
根据所述分类结果和所述聚类结果确定所述文件对象对应的家族团伙标签；
根据所述文件对象对应的静态分析结果生成所述文件对象对应的静态行为特征标签；
根据所述文件对象对应的动态分析结果生成所述文件对象对应的动态行为特征标签；
根据目标威胁情报生成所述文件对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述文件对象对应的元数据匹配成功的威胁情报。
可选的，所述当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，包括：
将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签对所述文件对象进行威胁情报运营处理；
所述当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中，包括：
当接收到所述威胁情报运营平台反馈的、所述文件对象对应的内生威胁情报、情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签时，将所述文件对象对应的情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签添加至所述文件对象对应的内生威胁情报中；
将所述文件对象对应的内生威胁情报添加至所述威胁情报库中。
可选的，所述待鉴定对象具体为邮件对象、网络流量包对象、日志对象或开源数据对象；在所述根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，所述方法还包括：
当所述待鉴定对象对应的第一鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中， 所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
根据预置分类算法和多个预置家族团伙标签对所述待鉴定对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
根据预置聚类算法对所述待鉴定对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
根据所述分类结果和所述聚类结果确定所述待鉴定对象对应的家族团伙标签；
根据目标威胁情报生成所述待鉴定对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述待鉴定对象对应的元数据匹配成功的威胁情报。
可选的，所述当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，包括：
将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签对所述待鉴定对象进行威胁情报运营处理；
所述当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中，包括：
当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报、修正家族团伙标签和修正威胁情报命中标签时，将所述待鉴定对象对应的修正家族团伙标签和修正威胁情报命中标签添加至所述待鉴定对象对应的内生威胁情报中；
将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
第二方面，本申请还提供一种威胁情报内生装置，所述装置应用于威胁鉴定平台，包括：
第一分析单元，用于接收查询终端设备发送的待鉴定对象，并对所述待鉴定对象进行分析处理，以获得所述待鉴定对象对应的元数据；
第一确定单元，用于根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果，其中，所述威胁情报库中包含原始威胁情报和历史内生威胁情报，所述历史内生威胁情报为根据历史鉴定对象确定的威胁情报；
发送单元，用于当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象和所述待鉴定对象对应的元数据分配给目标终端设备，由所述目标终端设备根据所述待鉴定对象和所述待鉴定对象对应的元数据对所述待鉴定对象进行威胁情报运营处理；
添加单元，用于当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
可选的，所述待鉴定对象具体为文件对象；所述装置还包括：
第二分析单元，用于在所述第一确定单元根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，对所述文件对象进行静态分析处理，以获得所述文 件对象对应的静态分析结果；
第三分析单元，用于对所述文件对象进行动态分析处理，以获得所述文件对象对应的动态分析结果；
第二确定单元，用于根据所述静态分析结果和所述动态分析结果确定所述文件对象对应的第二鉴定结果；
第三确定单元，用于当所述第一鉴定结果与所述第二鉴定结果不同时，将所述第二鉴定结果确定为所述文件对象对应的最终鉴定结果；
所述第三确定单元，还用于当所述第一鉴定结果与所述第二鉴定结果相同时，将所述第一鉴定结果确定为所述文件对象对应的最终鉴定结果。
可选的，所述装置还包括：
第一获取单元，用于当所述文件对象对应的最终鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中，所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
第一分类单元，用于根据预置分类算法和多个预置家族团伙标签对所述文件对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
第一聚类单元，用于根据预置聚类算法对所述文件对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
第四确定单元，用于根据所述分类结果和所述聚类结果确定所述文件对象对应的家族团伙标签；
第一生成单元，用于根据所述文件对象对应的静态分析结果生成所述文件对象对应的静态行为特征标签；
所述第一生成单元，还用于根据所述文件对象对应的动态分析结果生成所述文件对象对应的动态行为特征标签；
所述第一生成单元，还用于根据目标威胁情报生成所述文件对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述文件对象对应的元数据匹配成功的威胁情报。
可选的，所述发送单元，具体用于将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签对所述文件对象进行威胁情报运营处理；
所述添加单元，具体用于当接收到所述威胁情报运营平台反馈的、所述文件对象对应的内生威胁情报、情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签时，将所述文件对象对应的情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签添加至所述文件对象对应的内生威胁情报中；将所述文件对象对应的内生威胁情报添加至所述威胁情报库中。
可选的，所述待鉴定对象具体为邮件对象、网络流量包对象、日志对象或开源数据对象；所述装置还包括：
第二获取单元，用于在所述第一确定单元根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，当所述待鉴定对象对应的第一鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中，所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
第二分类单元，用于根据预置分类算法和多个预置家族团伙标签对所述待鉴定对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
第二聚类单元，用于根据预置聚类算法对所述待鉴定对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
第五确定单元，用于根据所述分类结果和所述聚类结果确定所述待鉴定对象对应的家族团伙标签；
第二生成单元，用于根据目标威胁情报生成所述待鉴定对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述待鉴定对象对应的元数据匹配成功的威胁情报。
可选的，所述发送单元，具体用于将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签对所述待鉴定对象进行威胁情报运营处理；
所述添加单元，具体用于当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报、修正家族团伙标签和修正威胁情报命中标签时，将所述待鉴定对象对应的修正家族团伙标签和修正威胁情报命中标签添加至所述待鉴定对象对应的内生威胁情报中；将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
第三方面，本申请的实施例提供了一种存储介质，所述存储介质包括存储的程序，其中，在所述程序运行时控制所述存储介质所在设备执行第一方面所述的威胁情报内生方法。
第四方面，本申请的实施例提供了一种威胁情报内生装置，所述装置包括存储介质；及一个或者多个处理器，所述存储介质与所述处理器耦合，所述处理器被配置为执行所述存储介质中存储的程序指令；所述程序指令运行时执行第一方面所述的威胁情报内生方法。
借由上述技术方案，本申请提供的技术方案至少具有下列优点：
本申请提供一种威胁情报内生方法及装置，本申请能够在威胁鉴定平台接收得到查询终端设备发送的待鉴定对象后，由威胁鉴定平台对待鉴定对象进行分析处理，从而获得待鉴定对象对应的元数据，再根据待鉴定对象对应的元数据和威胁情报库确定待鉴定对象对应的第一鉴定结果，当确定待鉴定对象对应的第一鉴定结果为威胁对象时，威胁鉴定平台将待鉴定对象和待鉴定对象对应的元数据发送至威胁情报运营平台，以便威胁情报运营平台将待鉴定对象和待鉴定对象对应的元数据分配给目标终端设备，由目标终端设备对应的威胁情报分析师根据待鉴定对象和待鉴定对象对应的元数据对待鉴定对象进行威胁情报运营处理，从而确定待鉴定对象对应的内生威胁情 报，并通过目标终端设备将待鉴定对象对应的内生威胁情报发送给威胁情报运营平台，再由威胁情报运营平台将待鉴定对象对应的内生威胁情报转发给威胁鉴定平台；威胁鉴定平台在接收到威胁情报运营平台反馈的、待鉴定对象对应的内生威胁情报后，便可将待鉴定对象对应的内生威胁情报添加至威胁情报库中，从而更新威胁情报库。由于，威胁鉴定平台在对待鉴定对象进行威胁鉴定的过程中，会生成新的威胁情报，并将新生成的威胁情报添加至威胁情报库中，从而实现更新威胁情报库，进而能够提高威胁鉴定平台对待鉴定对象进行威胁鉴定的准确率。
上述说明仅是本申请技术方案的概述，为了能够更清楚了解本申请的技术手段，而可依照说明书的内容予以实施，并且为了让本申请的上述和其它目的、特征和优点能够更明显易懂，以下特举本申请的具体实施方式。
附图说明
通过参考附图阅读下文的详细描述，本申请示例性实施方式的上述以及其他目的、特征和优点将变得易于理解。在附图中，以示例性而非限制性的方式示出了本申请的若干实施方式，相同或对应的标号表示相同或对应的部分，其中：
图1示出了本申请实施例提供的一种威胁情报内生方法流程图；
图2示出了本申请实施例提供的另一种威胁情报内生方法流程图；
图3示出了本申请实施例提供的一种威胁情报内生装置的组成框图；
图4示出了本申请实施例提供的另一种威胁情报内生装置的组成框图。
具体实施方式
下面将参照附图更详细地描述本申请的示例性实施方式。虽然附图中显示了本申请的示例性实施方式，然而应当理解，可以以各种形式实现本申请而不应被这里阐述的实施方式所限制。相反，提供这些实施方式是为了能够更透彻地理解本申请，并且能够将本申请的范围完整的传达给本领域的技术人员。
需要注意的是，除非另有说明，本申请使用的技术术语或者科学术语应当为本申请所属领域技术人员所理解的通常意义。
本申请实施例提供一种威胁情报内生方法，该方法应用于威胁鉴定平台，具体如图1所示，该方法包括：
101、接收查询终端设备发送的待鉴定对象，并对待鉴定对象进行分析处理，以获得待鉴定对象对应的元数据。
其中，查询终端设备为企业(政府或其他组织)内部需要对待鉴定对象进行威胁鉴定的终端设备；其中，待鉴定对象可以但不限于为：文件对象、邮件对象、网络流量包对象、日志对象或开源数据对象等等，待鉴定对象对应的元数据为用于描述待鉴定对象特征的数据。
在本申请实施例中，当查询终端设备期望对待鉴定对象进行威胁鉴定时，查询终端设备便会向威胁鉴定平台发送待鉴定对象，此时，威胁鉴定平台便可接收得到查询终端设备发送的待鉴定对象；威胁鉴定平台在接收得到查询终端设备发送的待鉴定对象后，需要对待鉴定对象进行分析 处理，从而获得待鉴定对象对应的元数据。
具体的，在步骤中，当待鉴定对象具体为邮件对象时，威胁鉴定平台可以通过邮件检测引擎对待鉴定对象进行分析处理，从而获得待鉴定对象对应的元数据；当待鉴定对象具体为文件对象时，威胁鉴定平台可以通过RAS(RedDrip APT Scanner，红雨滴APT检测引擎)引擎对待鉴定对象进行分析处理，从而获得待鉴定对象对应的元数据，但不限于此。
102、根据待鉴定对象对应的元数据和威胁情报库确定待鉴定对象对应的第一鉴定结果。
其中，威胁情报库中包含原始威胁情报和历史内生威胁情报，原始威胁情报为威胁鉴定平台投入使用前工作人员为威胁鉴定平台配置的威胁情报，历史内生威胁情报为威胁鉴定平台投入使用后，其根据历史鉴定对象确定的威胁情报，历史鉴定对象为在本次威胁鉴定之前，进行威胁鉴定的对象。
在本申请实施例中，威胁鉴定平台在获取得到待鉴定对象对应的元数据后，便可根据待鉴定对象对应的元数据和威胁情报库确定待鉴定对象对应的鉴定结果(即第一鉴定结果)，即将待鉴定对象对应的元数据与威胁情报库中包含的原始威胁情报和历史内生威胁情报进行匹配，当待鉴定对象对应的元数据与威胁数据库中的所有威胁情报均匹配失败时，确定待鉴定对象对应的第一鉴定结果为非威胁对象(即待鉴定对象不具备威胁)，当待鉴定对象对应的元数据与威胁数据库中的某个威胁情报匹配成功时，确定待鉴定对象对应的第一鉴定结果为威胁对象(即待鉴定对象具备威胁)。
需要进行说明的是，当确定待鉴定对象对应的第一鉴定结果为非威胁对象时，需要向查询终端设备反馈待鉴定对象为非威胁对象的鉴定结果。
103、当待鉴定对象对应的第一鉴定结果为威胁对象时，将待鉴定对象和待鉴定对象对应的元数据发送至威胁情报运营平台。
在本申请实施例中，当确定待鉴定对象对应的第一鉴定结果为威胁对象时，威胁鉴定平台便可将待鉴定对象和待鉴定对象对应的元数据发送至威胁情报运营平台，以便威胁情报运营平台将待鉴定对象和待鉴定对象对应的元数据分配给目标终端设备，其中，目标终端设备为某个威胁情报分析师对应的终端设备；目标终端设备在接收得到威胁情报运营平台分配的待鉴定对象和待鉴定对象对应的元数据后，目标终端设备对应的威胁情报分析师便可根据待鉴定对象和待鉴定对象对应的元数据对待鉴定对象进行威胁情报运营处理，即先根据待鉴定对象和待鉴定对象对应的元数据确定待鉴定对象对应的第一鉴定结果是否正确，当确定待鉴定对象对应的第一鉴定结果正确时，便会根据待鉴定对象和待鉴定对象对应的元数据确定待鉴定对象对应的威胁情报(即内生威胁情报)，并通过目标终端设备将待鉴定对象对应的内生威胁情报发送给威胁情报运营平台，再由威胁情报运营平台将待鉴定对象对应的内生威胁情报转发给威胁鉴定平台；当确定待鉴定对象对应的第一鉴定结果错误时，便会通过目标终端设备向威胁情报运营平台发送报错信息，再由威胁情报运营平台将报错信息转发给威胁鉴定平台。
104、当接收到威胁情报运营平台反馈的、待鉴定对象对应的内生威胁情报时，将待鉴定对象对应的内生威胁情报添加至威胁情报库中。
在本申请实施例中，当接收到威胁情报运营平台反馈的、待鉴定对象对应的内生威胁情报时， 威胁鉴定平台便可将待鉴定对象对应的内生威胁情报添加至威胁情报库中，从而更新威胁情报库。
需要进行说明的是，威胁鉴定平台在将待鉴定对象对应的内生威胁情报添加至威胁情报库中后，需要向查询终端设备反馈待鉴定对象为威胁对象的鉴定结果，同时也可以将待鉴定对象对应的内生威胁情报连同鉴定结果一起反馈给查询终端设备。
需要进行说明的是，当接收到威胁情报运营平台反馈的报错信息时，威胁鉴定平台需要向查询终端设备反馈待鉴定对象为非威胁对象的鉴定结果。
本申请实施例提供一种威胁情报内生方法，本申请实施例能够在威胁鉴定平台接收得到查询终端设备发送的待鉴定对象后，由威胁鉴定平台对待鉴定对象进行分析处理，从而获得待鉴定对象对应的元数据，再根据待鉴定对象对应的元数据和威胁情报库确定待鉴定对象对应的第一鉴定结果，当确定待鉴定对象对应的第一鉴定结果为威胁对象时，威胁鉴定平台将待鉴定对象和待鉴定对象对应的元数据发送至威胁情报运营平台，以便威胁情报运营平台将待鉴定对象和待鉴定对象对应的元数据分配给目标终端设备，由目标终端设备对应的威胁情报分析师根据待鉴定对象和待鉴定对象对应的元数据对待鉴定对象进行威胁情报运营处理，从而确定待鉴定对象对应的内生威胁情报，并通过目标终端设备将待鉴定对象对应的内生威胁情报发送给威胁情报运营平台，再由威胁情报运营平台将待鉴定对象对应的内生威胁情报转发给威胁鉴定平台；威胁鉴定平台在接收到威胁情报运营平台反馈的、待鉴定对象对应的内生威胁情报后，便可将待鉴定对象对应的内生威胁情报添加至威胁情报库中，从而更新威胁情报库。由于，威胁鉴定平台在对待鉴定对象进行威胁鉴定的过程中，会生成新的威胁情报，并将新生成的威胁情报添加至威胁情报库中，从而实现更新威胁情报库，进而能够提高威胁鉴定平台对待鉴定对象进行威胁鉴定的准确率。
以下为了更加详细地说明，本申请实施例提供了另一种威胁情报内生方法，该方法应用于渲染服务器，具体如图2所示，该方法包括：
201、接收查询终端设备发送的待鉴定对象，并对待鉴定对象进行分析处理，以获得待鉴定对象对应的元数据。
其中，关于步骤201、接收查询终端设备发送的待鉴定对象，并对待鉴定对象进行分析处理，以获得待鉴定对象对应的元数据，可以参考图1对应部分的描述，本申请实施例此处将不再赘述。
202、根据待鉴定对象对应的元数据和威胁情报库确定待鉴定对象对应的第一鉴定结果。
其中，关于步骤202、根据待鉴定对象对应的元数据和威胁情报库确定待鉴定对象对应的第一鉴定结果，可以参考图1对应部分的描述，本申请实施例此处将不再赘述。
203、确定待鉴定对象对应的家族团伙标签。
在本申请实施例中，威胁鉴定平台在根据待鉴定对象对应的元数据和威胁情报库确定待鉴定对象对应的第一鉴定结果之后，还需要确定待鉴定对象对应的家族团伙标签。
具体的，在本步骤中，威胁鉴定平台可以采用以下方式确定待鉴定对象对应的家族团伙标签：
(1)当待鉴定对象具体为文件对象时，威胁鉴定平台需要先对文件对象进行静态分析处理，从而获得文件对象对应的静态分析结果；再对文件对象进行动态分析处理，从而获得文件对象对应的动态分析结果；然后，根据文件对象对应的静态分析结果和动态分析结果确定文件对象对应 的第二鉴定结果；当文件对象对应的第一鉴定结果与第二鉴定结果不同时，将文件对象对应的第二鉴定结果确定为文件对象对应的最终鉴定结果；当文件对象对应的第一鉴定结果与第二鉴定结果相同时，将文件对象对应的第一鉴定结果确定为文件对象对应的最终鉴定结果，从而实现基于文件对象的动态分析结果和静态分析结果修正基于威胁情报库确定的鉴定结果，从而提高威胁鉴定平台对文件对象进行威胁鉴定的准确率。
其中，威胁鉴定平台对文件对象进行动态分析处理的具体过程为：通过预置文件动态高对抗分析器对文件对象进行动态分析处理，从而获得文件对象对应的动态分析结果，预置文件动态高对抗分析器可以但不限于为：沙箱、RAS引擎或其他文件鉴定器；其中，威胁鉴定平台根据文件对象对应的静态分析结果和动态分析结果确定文件对象对应的第二鉴定结果的具体过程为：当文件对象对应的静态分析结果和动态分析结果均为威胁对象时，确定文件对象对应的第二鉴定结果为威胁对象；当文件对象对应的静态分析结果和动态分析结果均为非威胁对象时，确定文件对象对应的第二鉴定结果为非威胁对象；当文件对象对应的静态分析结果为威胁对象、动态分析结果为非威胁对象时，确定文件对象对应的第二鉴定结果为非威胁对象；当文件对象对应的静态分析结果为非威胁对象、动态分析结果为威胁对象时，确定文件对象对应的第二鉴定结果为威胁对象。
当文件对象对应的最终鉴定结果为威胁对象时，威胁鉴定平台便可执行确定文件对象对应的家族团伙标签的操作，其具体过程为：首先，获取多个目标历史鉴定对象，其中，目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；其次，根据预置分类算法和多个预置家族团伙标签对文件对象和多个目标历史鉴定对象进行分类处理，从而获得分类结果，其中，分类结果中包含多个类别，每个类别包含多个鉴定对象，每个类别对应于一个预置家族团伙标签，预置分类算法可以但不限于为：随机森林分类算法；再次，根据预置聚类算法对文件对象和多个目标历史鉴定对象进行聚类处理，从而获得聚类结果，其中，聚类结果中包含多个类簇，每个类簇包含多个鉴定对象，预置聚类算法可以但不限于为：K临近聚类算法；然后，根据分类结果和聚类结果确定文件对象对应的家族团伙标签，即当分类结果包含的多个类别与聚类结果包含的多个类簇相互对应时，将文件对象所处类别对应的预置家族团伙标签确定为文件对象对应的家族团伙标签，当分类结果包含的多个类别与聚类结果包含的多个类簇存在差异时，将分类结果和聚类结果暂时确定为文件对象对应的家族团伙标签，以便后续威胁情报分析师根据分类结果和聚类结果确定文件对象对应的家族团伙标签；其中，根据文件对象对应的家族团伙标签可以对文件对象进行威胁溯源，确定文件对象对应的威胁源头。
需要进行说明的是，当确定文件对应的最终鉴定结果为非威胁对象时，威胁鉴定平台需要向查询终端设备反馈文件对象为非威胁对象的鉴定结果。
进一步的，在本申请实施例中，威胁鉴定平台在确定文件对象对应的家族团伙标签后，还可以先根据文件对象对应的静态分析结果生成文件对象对应的静态行为特征标签，即根据预置规则在文件对象对应的静态分析结果中提取文件对象对应的静态行为特征，并根据文件对象对应的静态行为特征生成文件对象对应的静态行为特征标签；再根据文件对象对应的动态分析结果生成文件对象对应的动态行为特征标签，即根据预置规则在文件对象对应的动态分析结果中提取文件 对象对应的动态行为特征，并根据文件对象对应的动态行为特征生成文件对象对应的动态行为特征标签；最后，根据目标威胁情报生成文件对象对应的威胁情报命中标签，其中，目标威胁情报为威胁情报库中与文件对象对应的元数据匹配成功的威胁情报，文件对象对应的威胁情报命中标签用于表明文件对象命中了威胁情报库中的哪个威胁情报。
(2)当待鉴定对象具体为邮件对象、网络流量包对象、日志对象或开源数据对象时，威胁鉴定平台便可直接执行确定待鉴定对象对应的家族团伙标签的操作，其具体过程为：首先，获取多个目标历史鉴定对象；其次，根据预置分类算法和多个预置家族团伙标签对待鉴定对象和多个目标历史鉴定对象进行分类处理，从而获得分类结果，其中，分类结果中包含多个类别，每个类别包含多个鉴定对象，每个类别对应于一个预置家族团伙标签；再次，根据预置聚类算法对待鉴定对象和多个目标历史鉴定对象进行聚类处理，从而获得聚类结果，其中，聚类结果中包含多个类簇，每个类簇包含多个鉴定对象；然后，根据分类结果和聚类结果确定待鉴定对象对应的家族团伙标签，即当分类结果包含的多个类别与聚类结果包含的多个类簇相互对应时，将待鉴定对象所处类别对应的预置家族团伙标签确定为待鉴定对象对应的家族团伙标签，当分类结果包含的多个类别与聚类结果包含的多个类簇存在差异时，将分类结果和聚类结果暂时确定为待鉴定对象对应的家族团伙标签，以便后续威胁情报分析师根据分类结果和聚类结果确定待鉴定对象对应的家族团伙标签；其中，根据待鉴定对象对应的家族团伙标签可以对待鉴定对象进行威胁溯源，确定待鉴定对象对应的威胁源头。
进一步的，在本申请实施例中，威胁鉴定平台在确定待鉴定对象对应的家族团伙标签后，还可以根据目标威胁情报生成待鉴定对象对应的威胁情报命中标签，其中，目标威胁情报为威胁情报库中与待鉴定对象对应的元数据匹配成功的威胁情报，待鉴定对象对应的威胁情报命中标签用于表明待鉴定对象命中了威胁情报库中的哪个威胁情报。
204、当待鉴定对象对应的第一鉴定结果为威胁对象时，将待鉴定对象和待鉴定对象对应的元数据发送至威胁情报运营平台。
具体的，在本步骤中，当待鉴定对象具体为文件对象，且确定文件对象对应的最终鉴定结果为威胁对象时，需要将文件对象、文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签发送至威胁情报运营平台，以便威胁情报运营平台将文件对象、文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签分配给目标终端设备；目标终端设备在接收得到威胁情报运营平台分配的文件对象、文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签后，目标终端设备对应的威胁情报分析师便可根据文件对象、文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签对文件对象进行威胁情报运营处理，即先根据文件对象、文件对象对应的元数据、静态分析结果和动态分析结果确定文件对象对应的最终鉴定结果是否正确，当确定文件对象对应的最终鉴定结果正确时，便会根据文件对象和文件对象对应的元数据确定文件对象对应的内生威胁情报，并根据文件对象对应的静态分析结果和动态分析结果确定文件对象对应的情报上下文信息，以及 对文件对象对应的家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签进行修正处理，以获得文件对象对应的修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签，最后通过目标终端设备将文件对象对应的内生威胁情报、情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签发送给威胁情报运营平台，再由威胁情报运营平台将文件对象对应的内生威胁情报、情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签转发给威胁鉴定平台；当确定文件对象对应的最终鉴定结果错误时，便会通过目标终端设备向威胁情报运营平台发送报错信息，再由威胁情报运营平台将报错信息转发给威胁鉴定平台。其中，当文件对象对应的家族团伙标签具体为分类结果和聚类结果时，威胁情报分析师便可根据分类结果和聚类结果确定文件对象对应的修正家族团伙标签。
具体的，在本步骤中，当待鉴定对象具体为邮件对象、网络流量包对象、日志对象或开源数据对象，且确定待鉴定对象对应的第一鉴定结果为威胁对象时，需要将待鉴定对象、待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签发送至威胁情报运营平台，以便威胁情报运营平台将待鉴定对象、待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签分配给目标终端设备；目标终端设备在接收得到威胁情报运营平台分配的待鉴定对象、待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签后，目标终端设备对应的威胁情报分析师便可根据待鉴定对象、待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签对待鉴定对象进行威胁情报运营处理，即先根据待鉴定对象和待鉴定对象对应的元数据确定待鉴定对象对应的第一鉴定结果是否正确，当确定待鉴定对象对应的第一鉴定结果正确时，便会根据待鉴定对象和待鉴定对象对应的元数据确定待鉴定对象对应的内生威胁情报，并对待鉴定对象对应的家族团伙标签和威胁情报命中标签进行修正处理，以获得待鉴定对象对应的修正家族团伙标签和修正威胁情报命中标签，最后通过目标终端设备将待鉴定对象对应的内生威胁情报、修正家族团伙标签和修正威胁情报命中标签发送给威胁情报运营平台，再由威胁情报运营平台将待鉴定对象对应的内生威胁情报、修正家族团伙标签和修正威胁情报命中标签转发给威胁鉴定平台；当确定待鉴定对象对应的第一鉴定结果错误时，便会通过目标终端设备向威胁情报运营平台发送报错信息，再由威胁情报运营平台将报错信息转发给威胁鉴定平台。其中，当待鉴定对象对应的家族团伙标签具体为分类结果和聚类结果时，威胁情报分析师便可根据分类结果和聚类结果确定待鉴定对象对应的修正家族团伙标签。
205、当接收到目标终端设备反馈的、待鉴定对象对应的内生威胁情报时，将待鉴定对象对应的内生威胁情报添加至威胁情报库中。
具体的，在本步骤中，当待鉴定对象具体为文件对象时，威胁情报运营平台会将文件对象对应的内生威胁情报、情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签发送给威胁鉴定平台，当接收到威胁情报运营平台反馈的、文件对象对应的内生威胁情报、情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签时，威胁鉴定平台需要先将文件对象对应的情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情 报命中标签添加至文件对象对应的内生威胁情报中；再将文件对象对应的内生威胁情报添加至威胁情报库中，从而丰富文件对象对应的内生威胁情报所包含的内容。
具体的，在本步骤中，当待鉴定对象具体为邮件对象、网络流量包对象、日志对象或开源数据对象时，威胁情报运营平台会将待鉴定对象对应的内生威胁情报、修正家族团伙标签和修正威胁情报命中标签转发给威胁鉴定平台，当接收到威胁情报运营平台反馈的、待鉴定对象对应的内生威胁情报、修正家族团伙标签和修正威胁情报命中标签时，威胁鉴定平台需要先将待鉴定对象对应的修正家族团伙标签和修正威胁情报命中标签添加至待鉴定对象对应的内生威胁情报中，再将待鉴定对象对应的内生威胁情报添加至威胁情报库中，从而丰富文件对象对应的内生威胁情报所包含的内容。
需要进行说明的是，威胁鉴定平台在将待鉴定对象对应的内生威胁情报添加至威胁情报库中后，需要向查询终端设备反馈待鉴定对象为威胁对象的鉴定结果，同时也可以将待鉴定对象对应的内生威胁情报连同鉴定结果一起反馈给查询终端设备。
需要进行说明的是，当接收到目标终端设备反馈的报错信息时，威胁鉴定平台需要向查询终端设备反馈待鉴定对象为非威胁对象的鉴定结果。
为了实现上述目的，根据本申请的另一方面，本申请实施例还提供了一种存储介质，所述存储介质包括存储的程序，其中，在所述程序运行时控制所述存储介质所在设备执行上述所述的威胁情报内生方法。
为了实现上述目的，根据本申请的另一方面，本申请实施例还提供了一种威胁情报内生装置，所述装置包括存储介质；及一个或者多个处理器，所述存储介质与所述处理器耦合，所述处理器被配置为执行所述存储介质中存储的程序指令；所述程序指令运行时执行上述所述的威胁情报内生方法。
进一步的，作为对上述图1及图2所示方法的实现，本申请另一实施例还提供了一种威胁情报内生装置，该装置应用于威胁鉴定平台。该装置实施例与前述方法实施例对应，为便于阅读，本装置实施例不再对前述方法实施例中的细节内容进行逐一赘述，但应当明确，本实施例中的装置能够对应实现前述方法实施例中的全部内容。该装置应用于在威胁鉴定平台对待鉴定对象进行威胁鉴定的过程中，生成新的威胁情报，从而提高威胁鉴定平台对待鉴定对象进行威胁鉴定的准确率，具体如图3所示，该装置包括：
第一分析单元301，用于接收查询终端设备发送的待鉴定对象，并对所述待鉴定对象进行分析处理，以获得所述待鉴定对象对应的元数据；
第一确定单元302，用于根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果，其中，所述威胁情报库中包含原始威胁情报和历史内生威胁情报，所述历史内生威胁情报为根据历史鉴定对象确定的威胁情报；
发送单元303，用于当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象和所述待鉴定对象对应的元数据分配给目标终端设备，由所述目标终端设备根据所述待鉴定对象和所述待鉴定对象对应的元数据对所述待鉴定对象进行威胁情报运营处理；
添加单元304，用于当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
进一步的，如图4所示，所述待鉴定对象具体为文件对象；该装置还包括：
第二分析单元305，用于在第一确定单元302根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，对所述文件对象进行静态分析处理，以获得所述文件对象对应的静态分析结果；
第三分析单元306，用于对所述文件对象进行动态分析处理，以获得所述文件对象对应的动态分析结果；
第二确定单元307，用于根据所述静态分析结果和所述动态分析结果确定所述文件对象对应的第二鉴定结果；
第三确定单元308，用于当所述第一鉴定结果与所述第二鉴定结果不同时，将所述第二鉴定结果确定为所述文件对象对应的最终鉴定结果；
第三确定单元308，还用于当所述第一鉴定结果与所述第二鉴定结果相同时，将所述第一鉴定结果确定为所述文件对象对应的最终鉴定结果。
进一步的，如图4所示，该装置还包括：
第一获取单元309，用于当所述文件对象对应的最终鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中，所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
第一分类单元310，用于根据预置分类算法和多个预置家族团伙标签对所述文件对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
第一聚类单元311，用于根据预置聚类算法对所述文件对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
第四确定单元312，用于根据所述分类结果和所述聚类结果确定所述文件对象对应的家族团伙标签；
第一生成单元313，用于根据所述文件对象对应的静态分析结果生成所述文件对象对应的静态行为特征标签；
第一生成单元313，还用于根据所述文件对象对应的动态分析结果生成所述文件对象对应的动态行为特征标签；
第一生成单元313，还用于根据目标威胁情报生成所述文件对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述文件对象对应的元数据匹配成功的威胁情报。
进一步的，如图4所示，发送单元303，具体用于将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签对所述文件对象进行威胁情报运营处理；
添加单元304，具体用于当接收到所述威胁情报运营平台反馈的、所述文件对象对应的内生威胁情报、情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标 签和修正威胁情报命中标签时，将所述文件对象对应的情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签添加至所述文件对象对应的内生威胁情报中；将所述文件对象对应的内生威胁情报添加至所述威胁情报库中。
进一步的，如图4所示，所述待鉴定对象具体为邮件对象、网络流量包对象、日志对象或开源数据对象；该装置还包括：
第二获取单元314，用于在第一确定单元302根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，当所述待鉴定对象对应的第一鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中，所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
第二分类单元315，用于根据预置分类算法和多个预置家族团伙标签对所述待鉴定对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
第二聚类单元316，用于根据预置聚类算法对所述待鉴定对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
第五确定单元317，用于根据所述分类结果和所述聚类结果确定所述待鉴定对象对应的家族团伙标签；
第二生成单元318，用于根据目标威胁情报生成所述待鉴定对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述待鉴定对象对应的元数据匹配成功的威胁情报。
进一步的，如图4所示，发送单元303，具体用于将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签对所述待鉴定对象进行威胁情报运营处理；
添加单元304，具体用于当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报、修正家族团伙标签和修正威胁情报命中标签时，将所述待鉴定对象对应的修正家族团伙标签和修正威胁情报命中标签添加至所述待鉴定对象对应的内生威胁情报中；将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
本申请实施例提供一种威胁情报内生方法及装置，本申请实施例能够在威胁鉴定平台接收得到查询终端设备发送的待鉴定对象后，由威胁鉴定平台对待鉴定对象进行分析处理，从而获得待鉴定对象对应的元数据，再根据待鉴定对象对应的元数据和威胁情报库确定待鉴定对象对应的第一鉴定结果，当确定待鉴定对象对应的第一鉴定结果为威胁对象时，威胁鉴定平台将待鉴定对象和待鉴定对象对应的元数据发送至威胁情报运营平台，以便威胁情报运营平台将待鉴定对象和待鉴定对象对应的元数据分配给目标终端设备，由目标终端设备对应的威胁情报分析师根据待鉴定对象和待鉴定对象对应的元数据对待鉴定对象进行威胁情报运营处理，从而确定待鉴定对象对应的内生威胁情报，并通过目标终端设备将待鉴定对象对应的内生威胁情报发送给威胁情报运营平台，再由威胁情报运营平台将待鉴定对象对应的内生威胁情报转发给威胁鉴定平台；威胁鉴定平 台在接收到威胁情报运营平台反馈的、待鉴定对象对应的内生威胁情报后，便可将待鉴定对象对应的内生威胁情报添加至威胁情报库中，从而更新威胁情报库。由于，威胁鉴定平台在对待鉴定对象进行威胁鉴定的过程中，会生成新的威胁情报，并将新生成的威胁情报添加至威胁情报库中，从而实现更新威胁情报库，进而能够提高威胁鉴定平台对待鉴定对象进行威胁鉴定的准确率。
所述威胁情报内生装置包括处理器和存储器，上述第一分析单元、第一确定单元、发送单元和添加单元等均作为程序单元存储在存储器中，由处理器执行存储在存储器中的上述程序单元来实现相应的功能。
处理器中包含内核，由内核去存储器中调取相应的程序单元。内核可以设置一个或以上，通过调整内核参数来在威胁鉴定平台对待鉴定对象进行威胁鉴定的过程中，生成新的威胁情报，从而提高威胁鉴定平台对待鉴定对象进行威胁鉴定的准确率。
本申请实施例提供了一种存储介质，所述存储介质包括存储的程序，其中，在所述程序运行时控制所述存储介质所在设备执行上述所述的威胁情报内生方法。
存储介质可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)，存储器包括至少一个存储芯片。
本申请实施例还提供了一种威胁情报内生装置，所述装置包括存储介质；及一个或者多个处理器，所述存储介质与所述处理器耦合，所述处理器被配置为执行所述存储介质中存储的程序指令；所述程序指令运行时执行上述所述的威胁情报内生方法。
本申请实施例提供了一种设备，设备包括处理器、存储器及存储在存储器上并可在处理器上运行的程序，处理器执行程序时实现以下步骤：
接收查询终端设备发送的待鉴定对象，并对所述待鉴定对象进行分析处理，以获得所述待鉴定对象对应的元数据；
根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果，其中，所述威胁情报库中包含原始威胁情报和历史内生威胁情报，所述历史内生威胁情报为根据历史鉴定对象确定的威胁情报；
当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象和所述待鉴定对象对应的元数据分配给目标终端设备，由所述目标终端设备根据所述待鉴定对象和所述待鉴定对象对应的元数据对所述待鉴定对象进行威胁情报运营处理；
当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
可选的，所述待鉴定对象具体为文件对象；在所述根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，所述方法还包括：
对所述文件对象进行静态分析处理，以获得所述文件对象对应的静态分析结果；
对所述文件对象进行动态分析处理，以获得所述文件对象对应的动态分析结果；
根据所述静态分析结果和所述动态分析结果确定所述文件对象对应的第二鉴定结果；
当所述第一鉴定结果与所述第二鉴定结果不同时，将所述第二鉴定结果确定为所述文件对象对应的最终鉴定结果；
当所述第一鉴定结果与所述第二鉴定结果相同时，将所述第一鉴定结果确定为所述文件对象 对应的最终鉴定结果。
可选的，所述方法还包括：
当所述文件对象对应的最终鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中，所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
根据预置分类算法和多个预置家族团伙标签对所述文件对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
根据预置聚类算法对所述文件对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
根据所述分类结果和所述聚类结果确定所述文件对象对应的家族团伙标签；
根据所述文件对象对应的静态分析结果生成所述文件对象对应的静态行为特征标签；
根据所述文件对象对应的动态分析结果生成所述文件对象对应的动态行为特征标签；
根据目标威胁情报生成所述文件对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述文件对象对应的元数据匹配成功的威胁情报。
可选的，所述当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，包括：
将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签对所述文件对象进行威胁情报运营处理；
所述当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中，包括：
当接收到所述威胁情报运营平台反馈的、所述文件对象对应的内生威胁情报、情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签时，将所述文件对象对应的情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签添加至所述文件对象对应的内生威胁情报中；
将所述文件对象对应的内生威胁情报添加至所述威胁情报库中。
可选的，所述待鉴定对象具体为邮件对象、网络流量包对象、日志对象或开源数据对象；在所述根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，所述方法还包括：
当所述待鉴定对象对应的第一鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中，所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
根据预置分类算法和多个预置家族团伙标签对所述待鉴定对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
根据预置聚类算法对所述待鉴定对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
根据所述分类结果和所述聚类结果确定所述待鉴定对象对应的家族团伙标签；
根据目标威胁情报生成所述待鉴定对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述待鉴定对象对应的元数据匹配成功的威胁情报。
可选的，所述当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，包括：
将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签对所述待鉴定对象进行威胁情报运营处理；
所述当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中，包括：
当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报、修正家族团伙标签和修正威胁情报命中标签时，将所述待鉴定对象对应的修正家族团伙标签和修正威胁情报命中标签添加至所述待鉴定对象对应的内生威胁情报中；
将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
本申请还提供了一种计算机程序产品，当在数据处理设备上执行时，适于执行初始化有如下方法步骤的程序代码：接收查询终端设备发送的待鉴定对象，并对所述待鉴定对象进行分析处理，以获得所述待鉴定对象对应的元数据；根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果，其中，所述威胁情报库中包含原始威胁情报和历史内生威胁情报，所述历史内生威胁情报为根据历史鉴定对象确定的威胁情报；当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象和所述待鉴定对象对应的元数据分配给目标终端设备，由所述目标终端设备根据所述待鉴定对象和所述待鉴定对象对应的元数据对所述待鉴定对象进行威胁情报运营处理；当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
本领域内的技术人员应明白，本申请的实施例可提供为方法、***、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和 /或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
存储器可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。存储器是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本申请的实施例可提供为方法、***或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
以上仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (10)

  1. 一种威胁情报内生方法，其特征在于，所述方法应用于威胁鉴定平台，包括：
    接收查询终端设备发送的待鉴定对象，并对所述待鉴定对象进行分析处理，以获得所述待鉴定对象对应的元数据；
    根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果，其中，所述威胁情报库中包含原始威胁情报和历史内生威胁情报，所述历史内生威胁情报为根据历史鉴定对象确定的威胁情报；
    当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象和所述待鉴定对象对应的元数据分配给目标终端设备，由所述目标终端设备根据所述待鉴定对象和所述待鉴定对象对应的元数据对所述待鉴定对象进行威胁情报运营处理；
    当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
  2. 根据权利要求1所述的方法，其特征在于，所述待鉴定对象具体为文件对象；在所述根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，所述方法还包括：
    对所述文件对象进行静态分析处理，以获得所述文件对象对应的静态分析结果；
    对所述文件对象进行动态分析处理，以获得所述文件对象对应的动态分析结果；
    根据所述静态分析结果和所述动态分析结果确定所述文件对象对应的第二鉴定结果；
    当所述第一鉴定结果与所述第二鉴定结果不同时，将所述第二鉴定结果确定为所述文件对象对应的最终鉴定结果；
    当所述第一鉴定结果与所述第二鉴定结果相同时，将所述第一鉴定结果确定为所述文件对象对应的最终鉴定结果。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    当所述文件对象对应的最终鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中，所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
    根据预置分类算法和多个预置家族团伙标签对所述文件对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
    根据预置聚类算法对所述文件对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
    根据所述分类结果和所述聚类结果确定所述文件对象对应的家族团伙标签；
    根据所述文件对象对应的静态分析结果生成所述文件对象对应的静态行为特征标签；
    根据所述文件对象对应的动态分析结果生成所述文件对象对应的动态行为特征标签；
    根据目标威胁情报生成所述文件对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述文件对象对应的元数据匹配成功的威胁情报。
  4. 根据权利要求3所述的方法，其特征在于，所述当所述待鉴定对象对应的第一鉴定结果为 威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，包括：
    将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述文件对象、所述文件对象对应的元数据、静态分析结果、动态分析结果、家族团伙标签、静态行为特征标签、动态行为特征标签和威胁情报命中标签对所述文件对象进行威胁情报运营处理；
    所述当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中，包括：
    当接收到所述威胁情报运营平台反馈的、所述文件对象对应的内生威胁情报、情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签时，将所述文件对象对应的情报上下文信息、修正家族团伙标签、修正静态行为特征标签、修正动态行为特征标签和修正威胁情报命中标签添加至所述文件对象对应的内生威胁情报中；
    将所述文件对象对应的内生威胁情报添加至所述威胁情报库中。
  5. 根据权利要求1所述的方法，其特征在于，所述待鉴定对象具体为邮件对象、网络流量包对象、日志对象或开源数据对象；在所述根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，所述方法还包括：
    当所述待鉴定对象对应的第一鉴定结果为威胁对象时，获取多个目标历史鉴定对象，其中，所述目标历史鉴定对象是鉴定结果为威胁对象的历史鉴定对象；
    根据预置分类算法和多个预置家族团伙标签对所述待鉴定对象和多个所述目标历史鉴定对象进行分类处理，以获得分类结果；
    根据预置聚类算法对所述待鉴定对象和多个所述目标历史鉴定对象进行聚类处理，以获得聚类结果；
    根据所述分类结果和所述聚类结果确定所述待鉴定对象对应的家族团伙标签；
    根据目标威胁情报生成所述待鉴定对象对应的威胁情报命中标签，其中，所述目标威胁情报为所述威胁情报库中与所述待鉴定对象对应的元数据匹配成功的威胁情报。
  6. 根据权利要求5所述的方法，其特征在于，所述当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，包括：
    将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签发送至所述威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签分配给所述目标终端设备，由所述目标终端设备根据所述待鉴定对象、所述待鉴定对象对应的元数据、家族团伙标签和威胁情报命中标签对所述待鉴定对象进行威胁情报运营处理；
    所述当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中，包括：
    当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报、修正家族团伙标签和修正威胁情报命中标签时，将所述待鉴定对象对应的修正家族团伙标签和修正威胁情报命中标签添加至所述待鉴定对象对应的内生威胁情报中；
    将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
  7. 一种威胁情报内生装置，其特征在于，所述装置应用于威胁鉴定平台，包括：
    第一分析单元，用于接收查询终端设备发送的待鉴定对象，并对所述待鉴定对象进行分析处理，以获得所述待鉴定对象对应的元数据；
    第一确定单元，用于根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果，其中，所述威胁情报库中包含原始威胁情报和历史内生威胁情报，所述历史内生威胁情报为根据历史鉴定对象确定的威胁情报；
    发送单元，用于当所述待鉴定对象对应的第一鉴定结果为威胁对象时，将所述待鉴定对象和所述待鉴定对象对应的元数据发送至威胁情报运营平台，以便所述威胁情报运营平台将所述待鉴定对象和所述待鉴定对象对应的元数据分配给目标终端设备，由所述目标终端设备根据所述待鉴定对象和所述待鉴定对象对应的元数据对所述待鉴定对象进行威胁情报运营处理；
    添加单元，用于当接收到所述威胁情报运营平台反馈的、所述待鉴定对象对应的内生威胁情报时，将所述待鉴定对象对应的内生威胁情报添加至所述威胁情报库中。
  8. 根据权利要求7所述的装置，其特征在于，所述待鉴定对象具体为文件对象；所述装置还包括：
    第二分析单元，用于在所述第一确定单元根据所述待鉴定对象对应的元数据和威胁情报库确定所述待鉴定对象对应的第一鉴定结果之后，对所述文件对象进行静态分析处理，以获得所述文件对象对应的静态分析结果；
    第三分析单元，用于对所述文件对象进行动态分析处理，以获得所述文件对象对应的动态分析结果；
    第二确定单元，用于根据所述静态分析结果和所述动态分析结果确定所述文件对象对应的第二鉴定结果；
    第三确定单元，用于当所述第一鉴定结果与所述第二鉴定结果不同时，将所述第二鉴定结果确定为所述文件对象对应的最终鉴定结果；
    所述第三确定单元，还用于当所述第一鉴定结果与所述第二鉴定结果相同时，将所述第一鉴定结果确定为所述文件对象对应的最终鉴定结果。
  9. 一种存储介质，其特征在于，所述存储介质包括存储的程序，其中，在所述程序运行时控制所述存储介质所在设备执行权利要求1至6中任一项所述的威胁情报内生方法。
  10. 一种威胁情报内生装置，其特征在于，所述装置包括存储介质；及一个或者多个处理器，所述存储介质与所述处理器耦合，所述处理器被配置为执行所述存储介质中存储的程序指令；所述程序指令运行时执行权利要求1至6中任一项所述的威胁情报内生方法。
PCT/CN2022/115680 2021-12-31 2022-08-30 威胁情报内生方法及装置 WO2023124166A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111671703.3 2021-12-31
CN202111671703.3A CN114218578A (zh) 2021-12-31 2021-12-31 威胁情报内生方法及装置

Publications (1)

Publication Number Publication Date
WO2023124166A1 true WO2023124166A1 (zh) 2023-07-06

Family

ID=80707722

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/115680 WO2023124166A1 (zh) 2021-12-31 2022-08-30 威胁情报内生方法及装置

Country Status (2)

Country Link
CN (1) CN114218578A (zh)
WO (1) WO2023124166A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114218578A (zh) * 2021-12-31 2022-03-22 奇安信科技集团股份有限公司 威胁情报内生方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107872454A (zh) * 2017-11-04 2018-04-03 公安部第三研究所 一种基于大数据技术的超大型互联网平台安全等级保护威胁信息监测与分析***及方法
CN110460594A (zh) * 2019-07-31 2019-11-15 平安科技（深圳）有限公司 威胁情报数据采集处理方法、装置及存储介质
CN111460445A (zh) * 2020-03-04 2020-07-28 奇安信科技集团股份有限公司 样本程序恶意程度自动识别方法及装置
CN113162953A (zh) * 2021-06-09 2021-07-23 南京聚铭网络科技有限公司 网络威胁报文检测及溯源取证方法和装置
CN114218578A (zh) * 2021-12-31 2022-03-22 奇安信科技集团股份有限公司 威胁情报内生方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180191781A1 (en) * 2016-12-30 2018-07-05 Microsoft Technology Licensing, Llc Data insights platform for a security and compliance environment
CN110543506B (zh) * 2019-09-10 2022-09-09 百度在线网络技术（北京）有限公司 数据分析方法、装置、电子设备及存储介质
CN111404939B (zh) * 2020-03-16 2022-08-09 深信服科技股份有限公司 邮件威胁检测方法、装置、设备及存储介质
CN111447215A (zh) * 2020-03-25 2020-07-24 深信服科技股份有限公司 数据检测方法、装置和存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107872454A (zh) * 2017-11-04 2018-04-03 公安部第三研究所 一种基于大数据技术的超大型互联网平台安全等级保护威胁信息监测与分析***及方法
CN110460594A (zh) * 2019-07-31 2019-11-15 平安科技（深圳）有限公司 威胁情报数据采集处理方法、装置及存储介质
CN111460445A (zh) * 2020-03-04 2020-07-28 奇安信科技集团股份有限公司 样本程序恶意程度自动识别方法及装置
CN113162953A (zh) * 2021-06-09 2021-07-23 南京聚铭网络科技有限公司 网络威胁报文检测及溯源取证方法和装置
CN114218578A (zh) * 2021-12-31 2022-03-22 奇安信科技集团股份有限公司 威胁情报内生方法及装置

Also Published As

Publication number Publication date
CN114218578A (zh) 2022-03-22

Similar Documents

Publication Publication Date Title
US12021881B2 (en) Automatic inline detection based on static data
US10972495B2 (en) Methods and apparatus for detecting and identifying malware by mapping feature data into a semantic space
US8799190B2 (en) Graph-based malware classification based on file relationships
US11483213B2 (en) Enterprise process discovery through network traffic patterns
Namanya et al. Similarity hash based scoring of portable executable files for efficient malware detection in IoT
US20170339192A1 (en) Computer-implemented process and system employing outlier score detection for identifying and detecting scenario-specific data elements from a dynamic data source
US20210248234A1 (en) Malware Clustering Based on Function Call Graph Similarity
US9116879B2 (en) Dynamic rule reordering for message classification
KR20120018226A (ko) 검색 부하들에 따라 균형이 맞춰지는 지문 데이터베이스를 갖는 미디어 식별 시스템
US11250166B2 (en) Fingerprint-based configuration typing and classification
US10984104B2 (en) Malware clustering based on analysis of execution-behavior reports
WO2023124166A1 (zh) 威胁情报内生方法及装置
CN113282630B (zh) 基于接口切换的数据查询方法及装置
US11003643B2 (en) Multi-level conflict-free entity clusterings
CN113965389B (zh) 一种基于防火墙日志的网络安全管理方法、设备及介质
CN114244611B (zh) 异常攻击检测方法、装置、设备及存储介质
Ouellette et al. Countering malware evolution using cloud-based learning
US20210201270A1 (en) Machine learning-based change control systems
US20210034740A1 (en) Threat analysis system, threat analysis method, and threat analysis program
US11928221B2 (en) Source code clustering for automatically identifying false positives generated through static application security testing
US20230254340A1 (en) Apparatus for processing cyber threat information, method for processing cyber threat information, and medium for storing a program processing cyber threat information
US11941115B2 (en) Automatic vulnerability detection based on clustering of applications with similar structures and data flows
US11636161B1 (en) Intelligent clustering systems and methods useful for domain protection
Fernandes de Araújo et al. Leveraging active learning to reduce human effort in the generation of ground‐truth for entity resolution
Hou et al. Unleash the power for tensor: A hybrid malware detection system using ensemble classifiers

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22913447

Country of ref document: EP

Kind code of ref document: A1