Tracing analysis method for network attacks

Abstract

The invention discloses a tracing analysis method for network attacks, which comprises the following steps: acquiring threat intelligence of a specified type, and caching the threat intelligence to alocal threat intelligence database; acquiring current alarm information and the local threat information, and judging the attack source of the alarm; respectively carrying out alarm association according to the attack source and / or the equipment identifier of the attack target, determining the attack stage of the equipment, and judging the equipment collapse level according to the attack stage; and obtaining asset information of the equipment, and determining the influence range of the attack according to the alarm association result. Effective traceability analysis of network attacks is achieved, various traceability results are obtained, traceability data can be updated every time traceability is conducted, and a basis is provided for network operation and maintenance personnel to handleproblems and strengthen security policies.

Description

technical field [0001] The invention belongs to the technical field of network security and data analysis, and in particular relates to a method for traceability and analysis of network attacks. Background technique [0002] With the advancement of technology, the Internet has penetrated into all aspects, and the number of attacks has increased year by year, and network security issues have gradually become the focus of society. The attack techniques and attack methods used by network attackers have also developed new trends. The traditional protection by setting up security tools such as firewalls at the network boundary points to isolate the internal and external networks is common for a single node to attack other nodes or target Single, easy-to-find attack methods such as attacking system vulnerabilities or preventing Trojan horse programs are effective. [0003] However, with the continuous emergence of network attack methods, not only are there various types, but also...

AI Technical Summary

Problems solved by technology

The attack techniques and attack methods used by network attackers have also developed new trends. The traditional protection by setting up security tools such as firewalls at the network boundary points to isolate the internal and external networks is common for a single node to attack other nodes or target A single, easy-to-find attack method such as attacking system vulnerabilities or preventing Trojan horse programs is effective

[0003] However, with the continuous emergence of network attack methods, not only are there various types, but also develop rapidly in the direction of high integration and automation. With the increasing complexity of the network, security threats are also tending to be diversified. and alerts, especially for advanced persistent threat attacks (Advanced Persistent Threat, APT), the tools or malicious programs used are generally targeted development, difficult to detect, 0day vulnerabilities will also be used in the attack, and it is persistent, will Make preparations for a long period of observation, spot check, information collection, social engineering, etc., and then gradually infiltrate, information return, communication control, etc.

Images