Network attack path prediction method and device and security management platform

Abstract

The invention discloses a network attack path prediction method and device and a security management platform, and the method comprises the steps: obtaining various types of alarm information generated in the operation of a network, the alarm information at least comprises unknown equipment alarm information and peripheral alarm information, and each piece of alarm information comprises alarm time, a source asset IP and a target asset IP; sorting the alarm information according to time, and constructing a plurality of attack paths by taking target asset IPs in the unknown equipment alarm information and the peripheral alarm information as attack path starting points; calculating the attack probability of each attack path according to each attack path and a preset probability calculation rule; and determining the attack path with the maximum attack probability as the optimal attack path. According to the optimal attack path determined by the method, an attack source, an attack destination, attacked assets and equipment with potential safety hazards can be clearly checked, so that all assets in the attack process can be specifically analyzed, and the assets which may be attacked aresubjected to safety protection.

Description

technical field [0001] The invention relates to the technical field of network security of information technology, in particular to a network attack path prediction method, device and security management platform. Background technique [0002] In the practice of industrial control system (referred to as industrial control system) network security, because the process, communication and data of the industrial control system are relatively single and stable, the industrial control system has strict requirements on the reliability and continuity of the business. Whitelist or blacklist techniques are introduced. [0003] At present, the attack analysis of industrial assets and equipment is based on blacklist technology. The attack analysis based on blacklist technology is based on the analysis of known security vulnerabilities and assets that have been attacked, but there is no attack path in the attack process. The overall cognition cannot predict the attack path, which is not...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the embodiment of the present invention provides a network attack path prediction method, device and security management platform to solve the problem that in the existing attack analysis, there is no overall cognition of the attack path in the attack process, and the attack path cannot be predicted. , which is not conducive to the subsequent security protection of assets

Images