Method, device, storage medium and equipment for generating analysis report of security incident

Abstract

The invention discloses a method, device, storage medium and equipment for generating an analysis report of a safety event, and belongs to the technical field of network safety. The method includes: obtaining an input sample queue, the input sample queue includes at least one virus sample; performing data query in the knowledge map of the information collection system based on the input sample queue, clustering the queried data, and obtaining the primary relationship of the virus group data; call the homology clustering server and sandbox to expand the primary relational data; perform data query in the knowledge map based on the obtained extended relational data to obtain the first description information; place the primary relational data and extended relational data in the sandbox Execute in the box to obtain the second description information; obtain security recommendations and associated intrusion indicators matching the virus group; generate an analysis report of the virus group based on the first description information, the second description information, security recommendations and associated intrusion indicators. The report quality of the present invention is controllable and time-consuming is short.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method, device, storage medium and equipment for generating an analysis report of a security event. Background technique [0002] The rapid development of network technology has brought great convenience to the dissemination of information, but at the same time, people are also facing huge challenges in information security. As information security issues become increasingly prominent, people pay more and more attention to network security issues. For example, after a security event is discovered, a threat analysis report on the security event is usually generated, so that the user can learn more about the security threat and give relevant prompts or security suggestions. [0003] Related technologies rely on manual completion when generating threat analysis reports on security incidents, that is, after discovering security incidents, manually perform sample analysis ...

AI Technical Summary

Problems solved by technology

[0005] The embodiment of the present invention provides a method, device, storage medium and equipment for generating an analysis report of a security event, which solves the problems in the related technology that it takes a long time to generate a report and the quality of the report is difficult to control

Images