Network threat detection method, device and network management equipment

Abstract

The application provides a network threat detection method and device, and network management equipment. The method comprises the following steps: receiving target log information reported by networksecurity equipment; determining a target classification feature corresponding to the target log information; determining a target attack stage corresponding to the target classification feature in a mapping relation about each classification feature and each attack state in a preset target kill chain model; and determining a fact that a network node is under network threat when judging that the network node meets the preset threat condition based on the currently determined each target attack stage after determining out at least two target attack stages, wherein the preset threat condition isas follows: generating the stage combination in forward sequence in the target kill chain model according to time order on a time shaft, and the stage combination comprises at least two attack stages.Through the scheme provided by the application, the problem of low detection efficiency in the prior art can be solved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a network threat detection method, device and network management equipment. Background technique [0002] Security attacks and defenses have always existed and intensified, from the initial single attack to today's APT (Advanced Persistent Threat, Advanced Persistent Threat, Advanced Persistent Threat) attack with strong purpose, long duration and phased occurrence. In order to describe the APT attack, a kill chain model appeared, and based on the attacker's attack idea of ​​APT attack, the existing kill chain model consists of seven attack stages, namely, detection, arming, distribution, utilization, installation, command and control and target actions. [0003] Among them, the characteristics of the end-to-end "chain" of the kill chain model determine that interruption at any stage can lead to interruption of the entire process. As a defender, a counter kil...

AI Technical Summary

Problems solved by technology

[0006] In view of this, the present application provides a network threat detection method, device and network management equipment to solve the problem of low detection efficiency in the prior art

Images