The invention discloses a control and defense graph decision-making method and
system based on defined organization
attack preferences, and the method comprises the steps: collecting
attack information from a log
server of a honey point, attributing and defining a behavior mode of an
attack organization through the combined search of a
threat intelligence
knowledge graph and an external
threat intelligence
library, and determining the attack preference of the attack organization; the attack preferences of the attack organizations are sorted; from the perspective of attackers, an
attack graph is generated through
topological information, asset information and configuration information in a target network, mapping from defined organization attack preferences to
attack graph nodes is carried out, a control and defense graph is generated, and a control and defense matrix used for quantitatively calculating the influence of attack mode preferences on the
attack graph is generated; on the basis of analysis of a control and defense matrix of an attack graph on defined organization attack preferences, honey point services are generated emphatically, and decision support is provided for deployment of defense measures. According to the method, the honey point service type can be more flexibly, quickly and automatically generated, and manpower and
time cost is greatly saved for analysis and deployment of deception defense.