Multi-step attack scene mining method based on neural network and Bayesian network attack graph

Abstract

The invention provides a novel multi-step attack scene mining method. The method is divided into an offline mode and an online mode. In the offline mode, a user uses a known real attack alert log to carry out training to eliminate false alerts through a neural network and generates a Bayesian network attack graph through a series of processing such as alert aggregation processing and causal association attack sequence generation; in the online mode, the user can carry out update and iteration on the neural network and the Bayesian network attack graph which are generated in the previous offline mode through a large number of online alert logs, so that the attack graph after iteration is more complete and accurate; and lastly, a plurality of multi-step attack scenes are extracted from the Bayesian network attack graph. Through the adoption of the technical method, the attack mode can be found from a large amount of redundant alert logs through misinformation elimination of the alert logs and the multi-step attack scene can be constructed.

Description

technical field [0001] The invention relates to the field of scene analysis of network logs, and the invention proposes a multi-step attack scene mining method based on a neural network and a Bayesian network attack graph. Background technique [0002] So far, the research on alarm correlation is mainly divided into four categories, the method based on causal logic, the method based on the scene, the method based on similarity and the alarm correlation analysis based on data mining. [0003] The method based on causal logic assumes that there is a causal relationship between consecutive abnormal events from the same threat behavior, and the latter abnormal event is carried out on the premise that the previous abnormal event is valid. By matching the antecedents and consequences between the alarms, the alarm data is causally correlated to reconstruct the network threat behavior. The advantages of this type of method are: 1. It only needs to analyze the cause and effect of a ...

AI Technical Summary

Problems solved by technology

The disadvantages are: 1. It is only suitable for threat behaviors with obvious causal relationship between steps, and the ability to discover unknown threats is weak; 2. The search space is large, the calculation overhead is large, and the system resource requirements are high; 3. Rules It is difficult to control the granularity of the definition. Too fine a granularity will lead to a higher rate of false positives, and too coarse a granularity will lead to a higher rate of false positives.

The disadvantages are: 1. The data mining algorithm has high complexity and high computational overhead; 2. The accuracy of the results obtained by correlation is difficult to judge, and further analysis is required in combination with domain knowledge

Images