The present invention relates to the field of
network security technology, specifically to a method and
system based on
network security threat information collection, comprising the following steps: based on
network security threat information, extracting network attackers and
attack methods, identifying and classifying attacker identifiers and target types, and standardizing data to obtain a standardized
threat behavior
data set. In the present invention, by extracting
attack behavior information from security event logs and intrusion detection alarms,
parsing subject-predicate-object structures, achieving data
standardization, improving the accuracy of identifying attacker identities and
attack methods, merging attack chains, enhancing intelligence coherence and path identification accuracy, using target co-
occurrence probability and consistency weight calculation, optimizing event merging, reducing
information redundancy, analyzing behavior node
time dependency, summarizing similar attack paths, improving attack
pattern recognition capabilities, sorting path priorities according to node weight values, screening high-risk chains, focusing on
emergency response, and improving security defense efficiency.