Method and device for asset safety early warning based on external threat information analysis

Abstract

The invention discloses a method and a device for asset safety early warning based on external threat information analysis. The method specifically comprises: through acquiring latest threat intelligence information issued by authority organizations at home and abroad, and performing similar information deduplication combination on the acquired threat intelligence information, generating final threat intelligence information in an external threat intelligence bank; then, according to attribute information of the threat information in the formed external threat intelligence bank, detecting whether a threatened device exist in an internal threatened asset information base. Since source of intelligence information in the external threat intelligence bank is wide, complementation of threat intelligence information issued by each threat intelligence issue platform can be realized, to form the external threat intelligence bank which is comprehensive and accurate in contents, and high in timeliness. At the same time, when the external threat intelligence bank is used for safe early warning on asset and equipment in a target network, a problem that intelligence information is too simple when information issued by a single threat intelligence platform is used can be prevented.

Description

Technical field [0001] The invention relates to the technical field of network information security, in particular to an asset security early warning method and device based on external threat intelligence analysis. Background technique [0002] With the rapid development of the Internet, the methods of information security attacks have changed from "spreading the net" and "simple and rude" to "precise targeted attacks" and "refined DDOS (Distributed Denial of Service). ". These attacks will collect accurate information on the attacked object before the attack, actively explore the trusted system of the attacked object and related vulnerabilities, and then choose the opportunity to attack the target object. Therefore, how to provide accurate and timely warning of possible attacks before an attack occurs has become an urgent security issue for enterprises. [0003] In order to realize the protection of corporate assets in terms of information security, a vulnerability threat warni...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides an asset security early warning method and device based on external threat intelligence analysis to solve the problems in

Images