Network attack surface tracking method, server and system

Abstract

The invention discloses a network attack surface tracking method, a server and a system. The method comprises: collecting data fragment copies on each network node; extracting available attack vectors; and combining the data fragment copies with historical big data, analyzing whether the data fragments are abnormal or not, and whether logic association exists among the abnormal data fragments or not, thereby determining and labeling abnormal points, obtaining potential attack trajectories and security vulnerabilities of network nodes, and achieving the purpose of tracking attack surfaces in alarge number of network nodes. For different vulnerabilities of a single network node, whether the vulnerabilities are threatened or not can be continuously monitored according to evaluation of each network node, and possible threats are eliminated.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method, server and system for network attack surface tracking. Background technique [0002] The current network communication is facing more and more hidden security issues. Many attacks come from hidden and fragmented forms. The vulnerability points and attack links of a single network node will constitute multiple attack surfaces. The existing methods of preventing network attacks will fail. Especially the current network usually has a large number of network nodes, and the attacker can disperse the fragments on various network nodes, so as to avoid being discovered. At the same time, the vulnerabilities of individual network nodes are not the same, and the system needs to be able to continuously monitor whether vulnerabilities generate threats and eliminate possible threats based on the assessment of each network node. There is an urgent need for a meth...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to provide a method, server and system for network attack surface tracking, collect copies of data fragments on each network node, extract exploitable attack vectors, merge data fragments with historical big data, and analyze whether the data fragments are There are exceptions, and whether there is a logical relationship between multiple abnormal data fragments, so as to determine the abnormal point, obtain the potential attack track and the security hole of the network node, and solve the problem that the attack surface cannot be tracked in the existing technology

Images