Attack chain obtaining method and system in network environment

Abstract

The invention brings forward an attack chain obtaining method and system in a network environment. According to a specified time period, network data is obtained, whether the obtained network data includes an attack event is detected, if the attack event is included, active window data associated with the attack event within a period before and after the time when the attack event takes place is obtained and stored at an attack end or a victim end, according to the active window data, an attack chain is obtained, furthermore, denoising processing is also performed on the obtained attack chain, a high-threat event attack chain is obtained, and according to an event taking place taking place at the earliest time in the attack chain, an attack source is traced back. The method and system provided by the invention make up for the technical defect of difficult restoration of an attack chain due to single-point detection frequently employed in conventional network threat detection technologies.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and system for acquiring an attack chain in a network environment. Background technique [0002] Driven by interests, the hacker team is growing and the attack methods are becoming more and more complex. This makes tracking hackers' attack chains and locking hackers an effective way to stop cybercrime from the source. In order to track down the identity of hackers faster, it is essential to detect network attack behavior, and threat detection is usually the detection of single-point rules, that is, only detect the threat events that meet a certain rule at any point in time and save them in the same way Threat events, viewing the detection results also lists events captured at different time points of the same detection rule, which makes it difficult to restore the entire attack chain from a single point of event. Contents of the invention [0003] Aiming at t...

AI Technical Summary

Problems solved by technology

In order to track down the identity of hackers faster, it is essential to detect network attack behavior, and threat detection is usually the detection of single-point rules, that is, only detect the threat events that meet a certain rule at any point in time and save them in the same way Threat events, viewing the detection results also lists the capture events at different time points of the same detection rule, so it is difficult to restore the entire attack chain from a single point of event

Images