Multidimensional correlation analysis method and system for advanced persistent threats

Abstract

The invention discloses a multidimensional association analysis method and system for advanced persistent threats, and the method comprises the steps: carrying out the association analysis and reorganization of original alarm information, and enabling the alarm information with an association relationship to form an alarm information chain; extracting an attack theme hidden in the alarm information chain through semantic analysis; and calculating a security evaluation value according to the probability of the attack theme. According to the invention, attack correlation assessment can be realized, and potential influence of each attack stage of network threats on the security situation is discovered, so that the whole network security situation assessment is realized.

Description

technical field [0001] This application relates to the technical field of network security monitoring, in particular to a multi-dimensional correlation analysis method and system for advanced persistent threats. Background technique [0002] The development of network information technology has brought huge changes to the productivity of today's society. More and more national companies, institutions and governments are accelerating the development of their own network applications and services. The existing computer networks and software systems are becoming more and more complex. The most important thing is the frequent occurrence of vulnerabilities and attacks. The attack methods of these events are increasingly diversified and persistent, and the attack surface extends from traditional computer networks to industrial control systems and social networks. [0003] Advanced Persistent Threat (Advanced Persistent Threat, APT) is a new type of network attack that has emerged ...

AI Technical Summary

Problems solved by technology

The rule-based evaluation method can accurately discover the existing vulnerabilities according to the current rules, but it is difficult to deal with unknown attacks and find the dependency relationship between vulnerabilities; the evaluation method based on the indicator system can combine the intermediate results of each stage to give the final assessment, but the assessment results are difficult to reflect state changes; model-based assessment methods can combine multiple factors for assessment, and can show the attack process and threat changes, but the reasonable application of attack dependencies and logical relationships in the assessment faces challenges

In short, the key to the challenge of APT to traditional security assessment techniques lies in the persistence of its attacks in stages. Existing security assessment techniques lack long-term monitoring correlation, and it is difficult to discover the hidden and continuous damage in each stage of attack.

Images