Attack chain construction method and device, equipment and medium

Abstract

The invention discloses an attack chain construction method and device, equipment and a medium. The method comprises the following steps: trapping attack behaviors of an attacker by utilizing a honeypot network; acquiring attack data corresponding to the attack behavior; preprocessing the attack data to obtain target attack data; carrying out feature extraction on the target attack data to obtaintarget features, and carrying out warehousing storage on the target features; and performing association analysis on the target features to construct an attack chain. Thus, the honeypot network is utilized to accurately trap attack behaviors; attack data corresponding to the attack behaviors are collected, the attack behaviors are preprocessed, then corresponding target features are extracted, then association analysis is conducted on the target features, and an attack chain is constructed, so that the attack chain can be accurately constructed, the network security defense level is improved,and the method is also suitable for complex network conditions and low in cost.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular to an attack chain construction method, device, equipment, and medium. Background technique [0002] In the information age, preventing network intrusion has become an important part of network security. In the process of preventing network intrusion, it is usually necessary to build an attack chain to make corresponding countermeasures for corresponding network attack behaviors according to the attack chain. At present, the attack chain acquisition method is mainly to detect malicious attack behaviors through different types of security detection equipment, and then collect attack logs through the backend, store the attack logs in a pre-selected database, and centralize the data in the attack logs. Push it to the data sharing platform for correlation analysis to build an attack chain. However, in the process of obtaining the attack chain, there are high requ...

AI Technical Summary

Problems solved by technology

However, in the process of obtaining the attack chain, there are high requirements on the network security hardware equipment used, and the cost is high, which is not suitable for deployment in a complex network environment. If the network security equipment in a specific scenario is missing, it will lead to lack of a link in the attack chain

Images