IP精准情报数据

1.网络与基础架构安全 高级持续性威胁防护（APT）：APT攻击往往通过特定的IP地址进行隐蔽的C&C（命令与控制）通信。IP精准情报库能够实时跟踪和识别这些恶意IP地址，从而帮助安全团队及时发现并阻断APT攻击。 防火墙/UTM/第二代防火墙：防火墙等网络设备可以集成IP精准情报库，对来自恶意IP地址的流量进行实时阻断，从而增强网络的安全防护能力。 入侵检测预防御：IDS/IPS系统可以利用IP精准情报库中的信息，对来自已知恶意IP地址的流量进行快速检测和拦截，提高入侵检测的准确性和效率。 2.安全解决方案 威胁管理/XDR：在XDR（扩展检测与响应）解决方案中，IP精准情报库为安全团队提供了关于恶意IP地址的详细信息，支持对威胁的全面检测、分析和响应。 安全运营/MDR/MSS：对于安全运营、托管检测与响应（MDR）以及托管安全服务（MSS）提供商来说，IP精准情报库是提升服务质量和效率的重要工具，能够帮助他们快速识别和处理与恶意IP地址相关的威胁。 3.端点安全 终端防病毒：恶意软件往往通过特定的IP地址进行通信或下载更新。IP精准情报库可以帮助防病毒软件识别这些恶意IP地址。数据采集：通过事件采集系统获取网络安全攻击相关事件，内容包括但不限于攻击事件名称、攻击行为、相关的IOC，技术细节，及样本等。通过恶意文件监控系统获取内外部流行恶意文件样本。并综合收集各类产品日志、SaaS监测数据、SaaS防护数据、狩猎数据、资产测绘数据、APT研究、漏洞研究攻防研究、数据安全研究、应用安全研究、物联网安全研究、云安全研究、开源情报、商业情报等

数据清洗：对采集到的数据进行结构化转换和标准化处理，清洗不必要的字段，并进行多维信息的聚合。以更好地满足后续对IP威胁情报进行数据分析和生产的需求。

数据加工：
1. 使用公司自主研发的新一代沙箱对恶意文件样本进行动态分析，从中获取样本的攻击行为，包括包含IP的网络请求行为。
2. 利用AI大模型、LSTM+CRF算法等技术进行自然语言处理和安全文章分析，提取分析相关IP威胁情报信息。
3. 采用多因子AI威胁评分模型，对恶意IP的威胁程度进行评估。
4. 采用MinHashLSH、Xgboost等算法结合海量数据进行恶意IOC挖掘
5. 利用威胁定性模型，聚合多源情报及关联数据，进行精准威胁情报生产输出。

1. Cybersecurity and Infrastructure Security
Advanced Persistent Threat (APT) Protection: APT attacks typically conduct covert Command and Control (C&C) communications via specific IP addresses. The Precise IP Intelligence Database can track and identify these malicious IP addresses in real time, enabling security teams to timely detect and block APT attacks.
Firewall/Unified Threat Management (UTM)/Second-Generation Firewall: Network devices such as firewalls can integrate the Precise IP Intelligence Database to block traffic from malicious IP addresses in real time, thereby strengthening network security protection capabilities.
Intrusion Detection and Prevention: IDS/IPS systems can leverage information from the Precise IP Intelligence Database to rapidly detect and intercept traffic originating from known malicious IP addresses, improving the accuracy and efficiency of intrusion detection.

2. Security Solutions
Threat Management/Extended Detection and Response (XDR): In XDR (Extended Detection and Response) solutions, the Precise IP Intelligence Database provides security teams with detailed information on malicious IP addresses, supporting comprehensive threat detection, analysis, and response.
Security Operations/Managed Detection and Response (MDR)/Managed Security Services (MSS): For security operations, MDR, and MSS providers, the Precise IP Intelligence Database is a critical tool to enhance service quality and efficiency, enabling them to quickly identify and address threats associated with malicious IP addresses.

3. Endpoint Security
Endpoint Antivirus: Malicious software often communicates via specific IP addresses or downloads updates. The Precise IP Intelligence Database can assist antivirus software in identifying these malicious IP addresses.

Data Collection: Obtain cybersecurity attack-related events through event collection systems, including but not limited to attack event names, attack behaviors, relevant IOCs, technical details, samples, etc. Acquire prevalent malicious file samples from internal and external environments via malicious file monitoring systems. Additionally, comprehensively collect various product logs, SaaS monitoring data, SaaS protection data, hunting data, asset mapping data, APT research, vulnerability research and offensive-defensive research, data security research, application security research, IoT security research, cloud security research, open-source intelligence, and commercial intelligence.

Data Cleaning: Perform structured conversion and standardization processing on the collected data, eliminate unnecessary fields, and aggregate multi-dimensional information, to better meet the requirements of subsequent data analysis and production of IP threat intelligence.

Data Processing:
1. Use the company's independently developed next-generation sandbox to conduct dynamic analysis on malicious file samples, extracting the attack behaviors of the samples, including network request behaviors involving IP addresses.
2. Utilize technologies such as AI Large Language Models (LLMs) and LSTM+CRF algorithms to perform natural language processing and security article analysis, and extract relevant IP threat intelligence information.
3. Adopt a multi-factor AI threat scoring model to evaluate the threat level of malicious IP addresses.
4. Employ algorithms such as MinHashLSH and XGBoost combined with massive datasets to conduct malicious IOC mining.
5. Leverage a threat qualitative model to aggregate multi-source intelligence and associated data, and produce and output precise threat intelligence.