Threat intelligence-based network security detection method and system

Abstract

The embodiment of the invention provides a threat intelligence-based network security detection method and system, aiming at improving the accuracy of network security detection. The method provided by the embodiment of the invention includes the following steps: periodically acquiring threat intelligence data from at least one preset website; grouping associated data in the threat intelligence data according to a preset rule to form at least one threat intelligence group, wherein the threat intelligence group includes at least one type of the threat intelligence data, and each type of the threat intelligence data includes one or more pieces of data; and performing multidimensional matching on acquired network access data of a target terminal and the threat intelligence data in the threatintelligence group, and calculating target threat intelligence data that is successfully matched, and if the number of the target threat intelligence data that is successfully matched exceeds a presetnumber, determining that the target terminal is infected with a virus.

Description

technical field [0001] The invention relates to the field of network security, in particular to a threat intelligence-based network security detection method and system. Background technique [0002] With the continuous growth of new threats and attacks typified by APT, enterprises and organizations increasingly need to rely on sufficient and effective security threat intelligence to help them better deal with these new threats in the process of preventing external attacks. A market for security threat intelligence analysis emerged and is thriving. [0003] The current threat intelligence system is only a platform for data sharing and exchange, focusing on the threat intelligence data of various security vendors, ignoring some of the threat intelligence data distributed in various Internet forums and websites, and using a single-dimensional threat intelligence database to match customers. Traffic, such as: IP address, domain name, URL, etc. [0004] In existing solutions, ...

AI Technical Summary

Problems solved by technology

[0004] In existing solutions, only single-dimensional threat intelligence databases are used to match customer traffic, such as IP addresses, domain names, URLs, etc., and single-dimensional threat intelligence databases are matched without correlation analysis of threat intelligence data in various dimensions. Sexual analysis, the matching accuracy is relatively low, and when the matching is wrong, it is easy to cause false positives on the user side

Images