A correlation analysis method and system for mail information and malicious code information

Abstract

The invention discloses a correlation analysis method and system for mail information and malicious code information, and relates to network security. Step S1, obtaining mail information and malicious code information in the network; Step S2, for each mail information, extracting multi-dimensional key information from the mail information to obtain the first multi-dimensional key information; Step S3, for each malicious code information , extracting multi-dimensional key information from malicious code information to obtain the second multi-dimensional key information; the first and second multi-dimensional key information have the same information content dimension; step S4, correlating the first and second multi-dimensional key information respectively Relevance analysis is performed to obtain correlation values ​​of corresponding information content dimensions; step S5, summing up the correlation values ​​to obtain a total correlation value representing the correlation between email information and malicious code information. The invention has the following beneficial effects: correlation analysis is performed on email information and malicious codes, which is convenient for deep mining and analysis.

Description

technical field [0001] The invention relates to the field of computer security, in particular to a correlation analysis method and system for mail information and malicious code information. Background technique [0002] With the rapid development of informatization construction and IT technology, the application of various network technologies has become more extensive and in-depth. Information resources and asset risks of institutions and individual users are also related to national security and social stability, and have become a new field of hot research and talent demand. Practical and effective measures must be taken in all aspects of law, management, technology, and ethics in order to ensure the "good and fast" stable development of network construction and application. [0003] With the rapid development of the network, the security of the network is becoming more and more prominent. However, the existing security devices, security data, and security policies are o...

AI Technical Summary

Problems solved by technology

[0003] With the rapid development of the network, the security of the network is becoming more and more prominent. However, the existing security devices, security data, and security policies are often scattered and independent. Global correlation makes it difficult to monitor the security situation of the entire network in real time and dynamically

Although the current analysis of persistent attacks has been carried out gradually, for example, in the email analysis process, analysts will analyze which pre-sequence emails are in the current malicious emails, and will continue to monitor the follow-up emails of these emails. The detection work is carried out separately, and it is difficult to unify the information of mail monitoring and malicious code monitoring. Code information for further correlation analysis

Images