Network attack scene generating method based on multi-source alarm logs

Abstract

The invention relates to a network attack scene generating method based on multi-source alarm logs. The network attack scene generating method includes the steps that firstly, the alarm logs generated by multiple network security protection devices are collected, effective alarm log data are extracted through preprocessing, and noise, redundancy or ineffective logs are removed; for the effective alarm logs acquired by one device, log format differences of different devices are shielded through single-source log aggregation and mapping, and attack event information is analyzed and extracted; attack events extracted from different sources are fused and analyzed, and network attack events with high credibility are generated; then through correlation analysis of the attack events, a network attack scene graph is generated, and the whole attack process of one attack operation is analyzed. Due to the fact that the multi-source logs are fused, the analyzed attack event information can more completely and more reliably depict attacks to which a network is subject, attack scenes are acquired through correlation analysis of the attack events, the intentions of attackers can be more clearly shown, and the security threat state of the network can be more clearly reflected.

Description

technical field [0001] The invention relates to a network attack scene generation method based on multi-source alarm logs. Background technique [0002] With the development of Internet technology and the continuous improvement of social informatization, the network has gradually become an indispensable part of people's production and life, and network security has received more and more attention. Various security products are used to detect attack threats in the network and maintain the safe operation of the network. However, these security measures generally can only play a specific role within a certain range, and lack effective data fusion and collaborative management mechanisms among each other. Faced with a lot of scattered information, network security managers cannot respond to these network attack threats in a timely manner. For the purpose of grasping the threats of network attacks as a whole and maintaining the safe operation of the network, the network threat ...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the present invention is to provide a method for generating network attack scenarios based on multi-source alarm logs to solve the problem of incomplete attack scenarios constructed by existing methods

Images