关键词: 威胁情报, 本体, 网络攻击, 知识图谱

Abstract:

Threat intelligence is described in a variety of ways in the field of cyber security, there is an urgent need for a standard for the format description of threat intelligence, which can transform unformatted intelligence information into formatted data to provide support for the visual knowledge graph of intelligence. According to the description specification of STIX 2.0, many ontology elements adapted to network security threat information are extracted, a threat intelligence ontology model that can be shared, reused and extended is constructed, and the domain ontology, application ontology and atomic ontology are classified in detail. Finally, the model is applied in the Poisonivy attack event, and 61 entities and 102 relationships in the Poisonivy research report are extracted, and the extracted formatted data is imported into Gephi for visual expression. Through the construction of the threat intelligence ontology model, the transformation of intelligence information from unstructured to structured is completed, and the unified grammar is used for description. Finally, the important elements in the intelligence are expressed in the way of knowledge graph, and the network security event can be quickly located. The core elements and relationships between them provide an important basis for network security analysts and decision makers.

Key words: threat intelligence, ontology, cyber attacks, knowledge graph