关键词: 暗网, 威胁情报, 机器学习, 多分类, 信息检索, 数据挖掘

Abstract: The information in the darknet tends to appear earlier than the surface web and can be used for threat intelligence acquisition and research. Aiming at the problem that security researchers cant quickly obtain the emerging threat information from the massive darknet data, a framework for a proactive acquisition of threat intelligence based on darknet is proposed. The framework includes three modules: dark network data acquisition, data filtering and threat intelligence acquisition. For the three types of information such as “malware”, “hacking tools” and “data leakage” in the darknet, the framework proposes and uses the information amount calculation method I@n (information at n), calculating the amount of dark network information in the surface network by using the difference in the time of information appearing in the darknet and the surface network. The updated threat information in the dark network is proactively acquired through the law between the amount of information in the surface network and the timeliness of the information. Experiments show that it is feasible to use this framework to acquire threat intelligence proactively from the darknet, helping security analysts respond to unknown cyber threats in a timely manner.

Key words: darknet, threat intelligence, machine learning, multi-classification, information retrieval, data mining