Apparatus and method for analysis of cyber threat intelligence

Abstract

An apparatus for analysing and monitoring a network flow for cyber threat intelligence is provided. The apparatus includes a feature selection model, a feature classification model, a threat computation model, a cyber threat intelligence engine, and a monitoring system. The feature selection model is configured to select flow-based features from a dataset in a network flow to generate network flow meta. The feature classification model is configured to analysis the flow-based features of the network flow meta to generate classified features. The threat computation model is configured to predict the threat features from the classified features using a swappable prediction model. The cyber threat intelligence engine is configured to collect and combine the flow-based features, the classified features, and the threat features to form one or more cyber threat joint features. The monitoring system is configured to output the cyber threat joint features.