Attack behavior real-time tracking and analysis method for cyber range

Abstract

The invention discloses an attack behavior real-time tracking and analysis method for a cyber range. The method comprises the following steps: data are collected; the data are analyzed; whether an attack behavior is the first step for an attack kill chain is judged; whether the attack behavior is the second step for the attack kill chain is judged, and recording and scoring are carried out; whether the attack behavior is the third step for the attack kill chain is judged, and recording and scoring are carried out; whether the attack behavior is the fourth step for the attack kill chain is judged, and recording and scoring are carried out; whether the attack behavior is the fifth step for the attack kill chain is judged, and recording and scoring are carried out; whether the attack behavior is the sixth step for the attack kill chain is judged, and recording and scoring are carried out; and whether the attack behavior is the seventh step for the attack kill chain is judged, and recording and scoring are carried out, the attack is blocked or recording and scoring are carried out, and the process is over. Thus, the efficiency for judging whether to be the attack behavior is high, the attack behavior process can be tracked, and the accuracy for judging whether to be the attack behavior is high.

Description

technical field [0001] The invention relates to an intrusion detection technology of a network shooting range, in particular to a real-time tracking and analysis method for an attack behavior of a network shooting range. Background technique [0002] The importance of information security has been raised to the level of national strategy. In China's informatization development strategy, "building a credible, manageable, and controllable cyberspace" has been included in the overall goal of information security development. China has established the National Security Commission to improve the national security system and national security strategy to ensure national security. For this reason, it is a very urgent task and requirement at the current national security strategy level to strive to cultivate information security professionals and become the main guarantee of the national security strategy. [0003] In addition to mastering a large amount of theoretical knowledge, i...

AI Technical Summary

Problems solved by technology

[0010] First, the traditional intrusion detection technology relies heavily on the feature library or normal behavior library, which needs to be updated in time, and as time goes by, the data in the library will become larger and larger, and the matching judgment time will also be longer and longer , which greatly reduces the efficiency of intrusion detection;

[0011] Second, the traditional intrusion detection technology can only judge whether the intrusion behavior is yes or no, but cannot record or judge the attack process, nor can it score according to the entire process of the attack behavior;

[0012] Third, the traditional intrusion detection technology uses a mode that matches the relevant data of the event with the database, and the rate of false positives or false negatives is relatively high, which poses a severe challenge to the accuracy of the detection results.

[0013] Therefore, the traditional intrusion detection technology used in the network shooting range will not be able to track, analyze and score the intrusion behavior in real time

Images