Threat detection and alert method and system based on big data analysis

Abstract

The invention discloses a threat detection and alert method and system based on big data analysis. The system comprises an alert aggregation assembly, a scene extraction assembly, a study and detection assembly, a prediction assembly and a new attack strategy digging assembly. According to the threat detection and alert method and system, the big data technology is adopted to predict and alert network attacks to government and enterprise information systems in real time, thereby greatly covering the shortage of the existing information security alert analysis technology on one hand; and on the other hand, false alerts generated by information security equipment such as an intrusion detection system can be identified and unknown malicious attacks can be analyzed, and therefore, the accuracy and the credibility of the alerts can be improved and the security risks of the information systems can be sensed.

Description

technical field [0001] The invention relates to the fields of information security technology and big data technology, in particular to a method and system for threat detection and early warning of an information system. Background technique [0002] The English abbreviation included in the present invention is as follows: [0003] IDS: IntrusionDetectionSystems intrusion detection system. [0004] CIDS: CooperativeIntrusionDetectionSystems collaborative intrusion detection system [0005] EWS: EarlyWarningSystems Early Warning System [0006] CCM: CausalCorrelationMatrix causal correlation matrix [0007] DAG: directed acyclic graph directed acyclic graph [0008] CE: Criticalepisodes critical scenes [0009] BE: BenignEpisode kindness scene [0010] With the continuous advancement of technology and the online operation of various IT services, massive amounts of data have been generated. The main challenge in this regard is to provide network protection services agai...

AI Technical Summary

Problems solved by technology

[0012] However, the intrusion detection system itself also has defects: the false positive rate is high, the efficiency is low in real-time applications, and even the detection of unknown attacks is powerless and inefficient

In a complex network environment, due to the influence of network transmission delay and front-end processing delay, the timing of security events entering the engine may be reversed, resulting in the failure of the "state machine" to be triggered, and false positives or false negatives in the correlation analysis engine

Therefore, the accuracy of the existing rule-based correlation analysis technology is flawed, and it is difficult to meet the large data volume correlation analysis requirements such as information security operation and maintenance management cloud platform environment.

Images