Apparatus and method for intrusion detection and prevention of cyber threat intelligence

Abstract

An apparatus for intrusion detection and prevention of cyber threat intelligence is provided. The apparatus includes a feature extraction model, a feature selection model, a flow-based intrusion detection module, a packet-based intrusion detection module, and an IPM. The feature extraction model is configured to parse packets from network raw packet data into sessions as a network flow dataset. The feature selection model is configured to select flow-based features from the network flow dataset to generate network flow meta. The flow-based intrusion detection module is configured to generate flow-based labels. The packet-based intrusion detection module is configured to generate packet-based labels. The IPM is configured to perform intrusion analysis according to the flow-based labels and the packet-based labels so as to generate IPM rules for intrusion detection and prevention, thereby identifying and processing the network raw packet data.