Distributed security event associated analysis method based on knowledge graph

Abstract

The invention discloses a distributed network security event associated analysis method based on a knowledge graph. The method specifically comprises the following steps of 1, building a network security knowledge graph comprising five dimensions such as the basic dimension, the loophole dimension, the threat dimension, the alarm event dimension and the attack rule dimension; 2, designing a security event implementation associated analysis algorithm based on the knowledge graph built in the step 1; and 3, building a real-time big data analysis platform, applying the associated analysis algorithm designed in the step 2 to the built big data platform, and thus achieving a distributed associated analysis system. According to the method provided by the invention, related technologies of current big data process are fully used for dealing with the large data volume, the associated analysis algorithm is parallelized, and the design of the distributed associated analysis algorithm based on the knowledge graph is achieved.

Description

technical field [0001] The invention belongs to the field of network security situation awareness, and mainly relates to a distributed security event correlation analysis method based on a knowledge graph. Background technique [0002] With the application of computer networks more and more widely, its scale is getting bigger and bigger, multi-level network security threats and security risks are also increasing, and the threats and losses posed by network viruses and Dos / DDos attacks are increasing. Network attacks are developing toward distributed, large-scale, and complex trends. Only relying on single network security protection technologies such as firewalls, intrusion detection, anti-virus, and access control can no longer meet the needs of network security. In order to deal with increasingly complex and highly hidden network security threats and ensure the safe operation of the system, it is necessary to use related technologies in the field of network security situat...

AI Technical Summary

Problems solved by technology

[0004] First of all, the traditional situational awareness system stores multiple dimensions independently in a relational database, such as Mysql. When doing real-time correlation analysis, it needs to quickly join many tables. The degree of impact on the real-time and accuracy of correlation analysis is very severe for the situational awareness system with high real-time requirements

Second, other information such as attack rule knowledge is usually unstructured, and conventional relational database storage is not flexible enough

Third, traditional rule-based association analysis needs to rely on expert knowledge to construct attack scenarios. For new attacks that are not in the attack template knowledge base, automatic analysis and reasoning are usually not possible.

[0005] Another outstanding problem is that the association analysis methods proposed by earlier scholars are usually stand-alone designed algorithms, but the current era is the era of big data, the rapid development of the Internet, and the continuous expansion of network scale cannot well meet the needs of large-scale data analysis.

Images