Safety monitoring correlation analysis method based on state machine

Abstract

The invention discloses a safety monitoring correlation analysis method based on a state machine, which comprises the following steps: determining the safety state corresponding to attack phases of an attack scenario of a target system, the attack scenario is a safety event set which is generated when interdependent interactive behaviors with time order occur; categorizing the safety events which are inspected by a monitoring program of the target system and relative to the attack scenario and establishing a comparison table of the safety state and the safety events; and inspecting and recording the safety state of the target system according to the comparison table. In the condition of guaranteeing the sustainable system running speed, the method can store the safety state of assets for a longer time; the method can inspect distributed system attacks; in the condition of not defining an accurate attack scenario, the method can determine the safety state of the system; and the method can analyze the attacked track of the system and provide evidence for investigation and evidence collection.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a state machine-based security monitoring association analysis method. Background technique [0002] In the traditional attack scenario reconstruction method for solving multi-step attacks, the timing correlation method is mainly used. [0003] The main implementation process of traditional attack scenario reconstruction is as follows: [0004] (1) Customize the attack scenario, and express the attack process that needs to be checked with rules. [0005] (2) Match the checked security event with the rule, and generate an alarm if the rule is met. [0006] The shortcoming of prior art one: [0007] (1) Accurately defined attack scenarios are required. [0008] (2) When too many security attack scenarios are defined, it is necessary to match each attack scenario to the security event, resulting in a significant decrease in the inspection efficiency of the system. [0...

AI Technical Summary

Problems solved by technology

[0007] (1) Accurately defined attack scenarios are required

[0008] (2) When too many security attack scenarios are defined, it is necessary to match the security events with each attack scenario, resulting in a significant drop in system inspection efficiency

[0009] (3) When the attacker conducts a coordinated attack, it is necessary to maintain too many security states, resulting in a decrease in the inspection efficiency of the system

Images