A state machine-based security monitoring correlation analysis method and system

Abstract

The invention discloses a security monitoring association analysis method based on a state machine, which includes the following steps: determining the security status corresponding to each attack stage of an attack scene of a target system, the attack scene being interdependent and time-ordered mutual behaviors When it occurs, the set of security events generated; classify the security events related to the attack scene detected by the monitoring program of the target system, and establish a comparison table between the security status and security events; check and Document the security state of the target system. The present invention can store the security state of assets for a long time under the condition that the running speed of the system is guaranteed; it can check distributed system attacks; it can determine the security state of the system without defining precise attack scenarios; it can analyze Find out the track of the system being attacked, and provide a basis for investigation and evidence collection.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a state machine-based security monitoring correlation analysis method and system. Background technique [0002] In the traditional attack scenario reconstruction method for solving multi-step attacks, the timing correlation method is mainly used. [0003] The main implementation process of traditional attack scenario reconstruction is as follows: [0004] (1) Customize the attack scenario, and express the attack process that needs to be checked with rules. [0005] (2) Match the checked security event with the rule, and generate an alarm if the rule is met. [0006] The shortcoming of prior art one: [0007] (1) Accurately defined attack scenarios are required. [0008] (2) When too many security attack scenarios are defined, it is necessary to match each attack scenario to the security event, resulting in a significant decrease in the inspection efficiency of the sy...

AI Technical Summary

Problems solved by technology

[0007] (1) Accurately defined attack scenarios are required

[0008] (2) When too many security attack scenarios are defined, it is necessary to match the security events with each attack scenario, resulting in a significant drop in system inspection efficiency

[0009] (3) When the attacker conducts a coordinated attack, it is necessary to maintain too many security states, resulting in a decrease in the inspection efficiency of the system

Images