Network attack target prediction method based on neighbor similarity

Abstract

The invention discloses a network attack target prediction method based on neighbor similarity. In the existing threat prediction methods, prediction and analysis are performed based on attack behaviors, and an attack target is not further predicted. The technical scheme adopted in the invention is as follows: firstly, preprocessing a safety event, performing normalization processing, and removing redundancy and misinformation; then matching the preprocessed safety event with a pre-defined rule library, performing correlation analysis, and reconstructing an attack scene; and finally calculating the similarity of a host address, an open port and an operating system of the attack target with these attributes of a neighbor host, and predicting the next step network attack target. The network attack target prediction method disclosed by the invention provides reference for an administrator to prepare handling strategies, achieves a prediction function of network attacks and improves the overall safety of the network.

Description

technical field [0001] The invention belongs to the field of network security, in particular to a network attack target prediction method based on the similarity of neighbors. Background technique [0002] Security products deployed in the existing network environment, such as firewalls and intrusion detection systems, help administrators identify network attacks and understand network security status from different perspectives. However, when these products are deployed on the network, a series of new problems are introduced, such as: multi-source security products have different log semantics and expressions; a large number of security alarms prevent administrators from identifying real attacks, and so on. Many researchers conduct alarm correlation analysis by constructing attack models, and correlate alarms through a pre-defined rule base, thereby mining potential threat intelligence and controlling the overall security situation. However, this method can only grasp the ...

AI Technical Summary

Problems solved by technology

However, the threat prediction methods mentioned in these literatures are all for predicting and analyzing attack behaviors, and do not predict further attack targets, so the prediction results obtained are not perfect, which limits the administrator to make better response strategies

Images