Threat detection method, device and equipment and storage medium

Abstract

The invention discloses a threat detection method. The method comprises the steps of collecting weblog monitored in real time; performing threat detection on the weblog by utilizing a threat detectionmodel to obtain a detection result; if the detection result represents that the behavior of the weblog is abnormal, determining a target attack link to which the weblog with the abnormal behavior belongs based on an attack chain of a network space security framework; and taking the target attack link in the attack chain and all preorder attack links of the target attack link as attacked links tocomplete threat detection of the weblog. The invention further discloses a threat detection device and equipment and a storage medium. Threat capture is carried out from the global perspective of theattack chain, and the security defense capability is improved.

Description

technical field [0001] The present invention relates to the field of network security, in particular to a threat detection method, device, equipment and storage medium. Background technique [0002] The current security defense system prevailing in the industry still focuses on the defense or blocking capabilities at the network or host level. Intrusion detection systems are deployed on each network security node for threat capture. The intrusion detection systems of each network node are independent detection systems. It can only capture threat information in a single attack scenario. However, since many attackers' attack links cover multiple links and entities such as networks, servers, hosts, and applications, the current solution cannot conduct security analysis from the global perspective of the attack chain, and cannot place the attacker in the entire attack chain. Simultaneous capture of multiple links of the attack, so that the entire attack link cannot be restored,...

AI Technical Summary

Problems solved by technology

[0004] The main purpose of the present invention is to provide a threat detection method, device, equipment and storage medium, aiming to solve the technical problem of weak security defense capability due to the poor overall detection of threat information

Images