Attack studying and judging method and system for network attack and defense test platform and medium

Abstract

The invention provides an attack studying and judging method and system for a network attack and defense test platform and a medium, which can effectively improve the accuracy of studying and judgingcomposite attacks, and the method comprises the following steps: constructing a security ontology model of a security knowledge graph, and constructing and expanding the security knowledge graph basedon a rule reasoning method; simulating network attacks on the network attack and defense test platform, and constructing a scene knowledge graph according to information of the simulated network attacks; constructing an attack rule base according to the general rule of the composite attack; performing data acquisition and detection on the simulated network attack, extracting corresponding a threat element, matching the threat element with the security knowledge graph, and returning the corresponding single-step attack if the matching succeeds; filtering single-step attacks through the scene knowledge graph, removing invalid single-step attacks, and reserving effective single-step attacks; and matching the effective single-step attack with an attack rule base, and outputting an attack chain of the corresponding network attack through the constraint of the space-time attribute.

Description

Technical field [0001] The invention relates to the technical field of network security, in particular to an attack research and judgment method, system and medium for a network attack and defense test platform. Background technique [0002] Cyber ​​attacks first started with computer viruses and have now developed into complex attacks with advanced persistent threats. Correspondingly, the consequences of cyber attacks have become more and more serious. At present, the problem of cyber security is not only in academic circles. His research topics are more related to the country’s political, economic, military and social stability. [0003] The problem of network security mainly includes two aspects: offense and defense. In order to achieve the best defense effect, you must understand the principles and methods of attack. In view of the actual situation, it is impossible to launch real attacks on real networks for research. Therefore, the current research on network attacks is don...

AI Technical Summary

Problems solved by technology

There is very little current research on analysis and detection methods for effective attacks

Images