An attack path restoration method, electronic device and computer-readable storage medium

Abstract

The invention discloses an attack path restoration method, an electronic device and a computer-readable storage medium, by acquiring target attack events related to assets to be restored in attack events generated based on alarms, and determining assets to be restored in each target attack event The identity of the target IP is the source IP or the destination IP, so as to determine the target attack event where the asset to be restored is the victim, and the attack stage of the target attack event; then based on the occurrence time and attack stage of each target attack event where the asset to be restored is the victim , to restore the attacked path of the asset to be restored. Based on the above description, it can be seen that this application restores the attacked path based on the role of the asset in the target attack event, the time of occurrence and the attack stage of the target attack event. Given that the target attack event occurred within a period of time, the restored attacked path can be Reflecting the law of attacks on assets within a certain period of time is conducive to improving the threat perception and prediction capabilities of the network.

Description

technical field [0001] The present application relates to the technical field of the Internet, and in particular to a method for restoring an attack path, an electronic device, and a computer-readable storage medium. Background technique [0002] Intrusion Kill Chain is a framework proposed by Lockheed Martin security experts in 2011 to protect computer and network security. They mentioned that cyberattacks occur in stages and can be interrupted by establishing effective defense mechanisms at each stage. However, the current methods of attack discovery mainly rely on intrusion detection equipment or algorithm models to analyze traffic. This method of attack discovery has the following disadvantages: [0003] 1. The threat detected by the attack discovery is basically a single point and a single moment; [0004] 2. The method of using this attack to discover threats makes the network security response ineffective for advanced persistent threats (Advanced Persistent Threat, ...

AI Technical Summary

Problems solved by technology

[0003] 1. The threat detected by the attack discovery is basically a single point and a single moment;

[0004] 2. The method of using this attack to discover threats makes the network security response ineffective against Advanced Persistent Threat (APT) perception

Images