威胁情报可靠性验证和质量评估方法研究

As a recent security research focus,cyber threat intelligence has changed entirely and deeply in conception,technology and information platform.Threat intelligence plays an important role in suppressing network security threats and defending against network attacks. At present, currently, as attacks are more pretended , persistent and purposeful, it is an impendent need to acquire high-value cyber security threat intelligence persistently. .Due to different analysis capabilities of different intelligence sources, incorrect data, missing records, expired data, etc,the types of information and data formats provided by various information sources are different. It is difficult to implement heterogeneous data fusion. Afterwards, data processing faces the problem of redundancy and confliction. Consequently, it brings challenges to the analysis and processing of threat intelligence. After the conflict of intelligence is resolved, how to scientifically and objectively evaluate the threat intelligence products and services is also an issue that needs to be resolved.We formalize the resolution of information confliction problem as a truth discovery problem. Truth discovery based on topic model, semi-supervised truth discovery and hierarchical analysis are studied in our project. Our aims are to conduct reliability validation and quality evaluation for threat intelligence and support the analysis of threat information. It helps to promote information sharing and has a good application prospect.

作为近几年来兴起的安全热点，网络威胁情报已经从理念到技术再到平台逐步开始落地。威胁情报对于抑制网络安全威胁，抵御网络攻击发挥着重要作用。目前，网络攻击方式更加隐蔽、持续和有目的性，持续获取高价值的网络安全威胁情报成为重中之重。由于各情报源的分析能力不同、错误数据、缺失记录、过期数据等原因，导致各情报源提供的情报类型、数据格式不同，异构数据融合存在困难，并且融合后，易出现重复数据、冲突数据等问题，对威胁情报的分析处理产生极大的困扰。情报冲突消解之后，如何科学、客观地评估威胁情报产品和服务，同样是亟待解决的问题。本项目将情报冲突消解问题形式化为真值发现问题，对基于主题模型的真值发现、半监督真值发现、层次分析法等内容进行研究，旨在对威胁情报进行可靠性验证和质量评估，为进一步的威胁情报分析提供可靠的数据支撑，有利于情报共享的推进，具备良好的应用前景。

高质量的威胁情报对于抑制网络安全威胁，抵御网络攻击发挥着重要作用。然而由于各情报源的分析能力不同、错误数据、缺失记录、过期数据等原因，情报融合后，易出现重复数据、冲突数据等问题。针对多源情报融合时导致的情报冲突问题，本项目重点研究1）面向威胁情报的知识图谱构建；2）异常流量检测和加密流量识别算法；3）恶意域名检测算法。具体地，本项目提出了安全情报知识图谱构建框架，在此基础上提出了安全实体识别方法，所构建的知识图谱可用作情报验证的先验知识。在异常流量这一威胁情报信息方面,提出了加密流量的识别算法和异常流量的检测算法，并将解决冲突之后的情报用于异常流量检测。在域名这一威胁情报信息方面，总结了恶意域名检测算法。在项目研究成果基础上，设计了网络威胁情报元数据融合的系统，该系统用于多源异构网络威胁情报冲突的解决，能够以一种更加细粒度的方式进行网络威胁情报融合。相关成果支撑了国家网络空间威胁情报共享开放平台（CNTIC）建设，有一定的应用前景。