Asset security early warning method and device based on external threat intelligence analysis

Abstract

The invention discloses a method and a device for asset safety early warning based on external threat information analysis. The method specifically comprises: through acquiring latest threat intelligence information issued by authority organizations at home and abroad, and performing similar information deduplication combination on the acquired threat intelligence information, generating final threat intelligence information in an external threat intelligence bank; then, according to attribute information of the threat information in the formed external threat intelligence bank, detecting whether a threatened device exist in an internal threatened asset information base. Since source of intelligence information in the external threat intelligence bank is wide, complementation of threat intelligence information issued by each threat intelligence issue platform can be realized, to form the external threat intelligence bank which is comprehensive and accurate in contents, and high in timeliness. At the same time, when the external threat intelligence bank is used for safe early warning on asset and equipment in a target network, a problem that intelligence information is too simple when information issued by a single threat intelligence platform is used can be prevented.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to an asset security early warning method and device based on external threat intelligence analysis. Background technique [0002] With the rapid development of the Internet, the way of information security attacks has changed from "casting the net widely" and "simple and rude" to "precise and targeted attacks" and "refined DDOS (Distributed Denial of Service, Distributed Denial of Service) ". These attacks will collect accurate information on the target before the attack, actively dig out the trusted system and related vulnerabilities of the target, and then choose the opportunity to attack the target. Therefore, how to provide accurate and timely early warning of possible attacks before an attack occurs has become an urgent security issue for enterprises today. [0003] In order to realize the protection of enterprise assets in terms of information security,...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides an asset security early warning method and device based on external threat intelligence analysis to solve the problems in the prior art that there is only one way to obtain external information and the accuracy, timeliness and comprehensiveness of the early warning cannot be ensured

Images