Association analysis method and association analysis system

Abstract

The invention discloses an association analysis method and an association analysis system. The method comprises the steps that: a receiving module receives original data; a real-time analysis module carries out real-time association processing on the original data according to a real-time association rule to generate association data; and a continuous analysis module judges whether the association data are abnormal according to an analysis rule and generates an alarm event when judging that the association data are abnormal. In the association analysis method in the technical scheme provided by the invention, the receiving module receives the original data, the real-time analysis module carries out the real-time association processing on the original data according to the real-time association rule to generate the association data, the continuous analysis module judges whether the association data are abnormal according to the analysis rule and generates the alarm event when judging that the association data are abnormal, and long-term association analysis is realized, so attack behaviors with long periods and strong concealment can be found.

Description

technical field [0001] The invention relates to the field of information security, in particular to an association analysis method and an association analysis system. Background technique [0002] At present, with the development of the information technology field, the attack methods and technologies are becoming more and more complex, and multiple steps are often required to complete an intrusion event, especially in recent years, Advanced Persistent Threat (APT) events have been frequently reported around the world. , APT incidents refer to long-term, planned and organized cyber attacks against specific objects that steal data and have strong concealment capabilities. The period of such incidents lasts for several years, and border detection devices can be bypassed. [0003] However, there are the following technical problems in the prior art: the prior art schemes are traditional detection technology based on feature matching and event analysis technology based on single...

AI Technical Summary

Problems solved by technology

[0003] However, there are the following technical problems in the prior art: the prior art schemes are traditional detection technology based on feature matching and event analysis technology based on single time point or short time segment, but the prior art scheme can only perform short-term Long-term correlation analysis cannot be realized, so it is impossible to discover long-term and concealed attacks

Images