Attacked path reduction method, electronic device and computer readable storage medium

Abstract

The invention discloses an attacked path reduction method, an electronic device and a computer readable storage medium. By acquiring target attack events related to to-be-reduced assets in attack events generated on the basis of alarms and determining whether an identity of the to-be-reduced asset in each target attack event is a source IP or a target IP, target attack events in which the to-be-reduced assets are victims and attack stages of the target attack events are determined; and then on the basis of occurrence time and the attack stage of each target attack event in which the to-be-reduced asset is the victim, an attacked path of the to-be-reduced asset is reduced. Based on the description above, it can be known that according to the application, the attacked paths are reduced on the basis of roles of the assets in the target attack events and the occurrence time and the attack stages of the target attack events; and in consideration of a case that the target attack events occurin a period of time, the reduced attacked paths can reflect laws of attacks from which the assets suffer in a certain time so as to benefit for improving the threat perception ability and the prediction ability of a network.

Description

technical field [0001] The present application relates to the technical field of the Internet, and in particular to a method for restoring an attack path, an electronic device, and a computer-readable storage medium. Background technique [0002] Intrusion Kill Chain is a framework proposed by Lockheed Martin security experts in 2011 to protect computer and network security. They mentioned that cyberattacks occur in stages and can be interrupted by establishing effective defense mechanisms at each stage. However, the current methods of attack discovery mainly rely on intrusion detection equipment or algorithm models to analyze traffic. This method of attack discovery has the following disadvantages: [0003] 1. The threat detected by the attack discovery is basically a single point and a single moment; [0004] 2. The method of using this attack to discover threats makes the network security response ineffective for advanced persistent threats (Advanced Persistent Threat, ...

AI Technical Summary

Problems solved by technology

[0003] 1. The threat detected by the attack discovery is basically a single point and a single moment;

[0004] 2. The method of using this attack to discover threats makes the network security response ineffective against Advanced Persistent Threat (APT) perception

Images