Mining method and device of attacking organization

Abstract

The invention discloses a mining method of an attacking organization. The mining method of the attacking organization comprises the steps of extracting attacking behaviors recorded in a firewall intrusion prevention system log, wherein each attacking behavior comprises attacking time, an attacking mode and an IP address of an attacker; and clustering the IP addresses of all the attackers based on the attacking time and the attacking mode corresponding to the IP address of each attacker to obtain the attacking organization. The invention also discloses a mining device of the attacking organization.

Description

technical field [0001] The invention relates to network security technology, in particular to a mining method and device for attacking organizations. Background technique [0002] With the increasing development and popularization of the Internet, the Internet has penetrated into all aspects of people's daily work and life. However, the network security problem introduced by it has gradually become one of the problems that people focus on. In particular, the existing network attack methods are showing a trend of diversification and complexity, making institutions and systems that provide business services based on the Internet face unprecedented threats. Once the networks of these institutions and systems are successfully attacked, huge damage will be caused. Economic losses. [0003] At present, with the continuous development of the social economy, the division of labor among practitioners from all walks of life in society is becoming more and more detailed. For a techno...

AI Technical Summary

Problems solved by technology

In addition, advanced persistent threats have become the main security threats faced by all types of networks at all levels. Advanced persistent threats have transformed network threats from random attacks of stragglers into purposeful, organized, and premeditated group attacks. Traditional defense methods based on real-time detection and real-time blocking are difficult to play a role anymore

[0004] The current network security protection methods and product systems still use traditional stand-alone and private ideas to solve network and public threats, but now is the era of dynamic security. Traditional equipment and solutions are static, and it is difficult to fight against continuous threats. Due to changing and upgraded attack methods, network security protection methods and products based on traditional security thinking cannot perceive attacking organizations because they do not have data intelligence functions.

Images