QBC Inconsistency-Based Threat Intelligence IOC Recognition

With the increase in cyber-attacks, threat intelligence (TI) has become a hot topic. Log detection using Indicators of Compromise (IOC) to detect critical risks, such as compromised internal hosts is the most common use scenario for TI. Recognition of the IOC is an important method to defend against cyber-attacks. Current IOC recognition methods mainly use regular expression matching and supervised learning. However, regular expression matching has low recognition accuracy, and supervised learning relies on a large amount of manually labeled data. To solve these problems, we propose a QBC inconsistency-based sample selection strategy query committee inconsistency (QCI) to select hard-sample more effectively by combining the inconsistency of the committee on sample entropy and sample similarity. The experimental results show that the number of labeled samples required for QCI is reduced by 62% and 39% compared to traditional QBC and QBC sample selection strategies using consistent entropy, respectively, with no reduction in accuracy.