Warning association method and device

Abstract

The invention provides a warning association method and device. The problems that the real attack intention of an attacker cannot be easily discovered since the existing network attack frequently combines multiple tools and methods to implement multistep attack in a certain time and space span, but the WAF warning only aims at the single attack behavior is solved. The method comprises the following steps: obtaining attack behavior information according to a WAF warning log of an application firewall; acquiring attack mode information of the attacker according to the attack behavior information, wherein the attack mode information comprises attack type information corresponding to each attack behavior in an attack process of the attacker; associating the different attackers according to the similarity between the attack mode information of different attackers. By use of the warning association method provided by the invention, multiple disperse fine-grained attack behaviors in a logic relation are combined as a coarse-grained attack process, thereby providing basis and convenience for eliminating redundant warning, reappearing an attack scene, analyzing the attack intention of the attacker and other related works.

Description

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine

Login to View More

AI Technical Summary

Benefits of technology

This patented system uses advanced techniques like analyzing network traffic data or detecting attacks on computer networks by collecting specific types of alarms that can be used for analysis purposes. These systems use this collected feature vector(s) along with previous patterns about these events to create new models called threat model (TMM). By comparing them against existing ones, it becomes possible to identify potential security risks based upon their impact level.

Problems solved by technology

Technological Problem addressed in this patents relates to improving the efficiency and accuracy of associating alaracters or suspicious activity patterns onto URLs during denialofings campaigns like Honeypass® attacks. Current solutions involve analyzing logs collected over time and manually grouping these events together. These techniques cannot efficiently associate them without previous knowledge about specific threat types being attacked.

Images