Threat pursuit method, device and equipment in network security defense

Abstract

The invention discloses a threat pursuit method in network security defense. The method comprises the steps of obtaining updated network threat feature information in threat intelligence; calling a flow record database which is generated and stored in history, and performing matching search on the flow record database according to the network threat feature information, wherein traffic characteristic metadata of historical network traffic is recorded in the traffic record database; and if the matching search succeeds, determining threat activity information in the network according to the traffic feature metadata matched with the network threat feature information. According to the invention, the flow record database is established to store the flow characteristic metadata of the network flow, and the backtracking detection is utilized to effectively improve the detection capability for the network threat and enhance the network security defense capability. The invention also disclosesa threat pursuit device and equipment in network security defense and a computer readable storage medium, which also have the above beneficial effects.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a threat hunting method, device, equipment and computer-readable storage medium in network security defense. Background technique [0002] With the rapid development and wide application of network technology, network security issues have also highlighted its importance. [0003] Due to factors such as the openness of the network and the sharing of network resources, computer networks are vulnerable to attacks by various viruses, hackers, malware and other misconduct. Among these threats, there are some unknown and latent advanced threats. They usually have a long incubation period after a successful intrusion, and do not have too much threat behavior and threat data performance, so it is difficult to be detected by existing network threat detection products. detected. [0004] In fact, a large number of unknown network threats appear every day. Therefore, th...

AI Technical Summary

Problems solved by technology

However, existing network threat detection products can only perform real-time detection of network traffic data without retrospective detection capabilities. Therefore, once these unknown latent threats are not found in real-time detection, existing network threat detection products and won't test it again

That is to say, the existing network threat detection products can easily make some network threats slip through the net when the threat intelligence update is insufficient, and once these unknown network threats enter the incubation period, it is difficult to be detected again, forming a network security threat. Hidden danger

Images