An attack chain intelligence analysis method, system and storage medium

Abstract

The present invention provides an attack chain intelligence analysis method and system, which collects data information in various ways and preprocesses it into an intelligence data stream, overcoming the problem of analyzing the intelligence data stream by analyzing the information in the prior art only from local events and behaviors. The high-frequency project team obtains its tree structure, uses different machine learning models to analyze the intelligence data flow and tree structure, and conducts parallel traceability to obtain the infection surface, which is convenient for administrators to dynamically deploy defense strategies.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method and system for analyzing attack chain intelligence. Background technique [0002] With the rapid development of network technology, the degree of informationization of enterprises is getting higher and higher, and the degree of dependence on information systems has also reached a very high level, which has also led to information security issues such as various new types of network attacks and sensitive information leakage. Traditional security detection can only resist security threats from a certain aspect, forming an island of security defense, lacking correlation analysis of security data of massive information, and unable to produce synergistic effects. [0003] There is an urgent need for a targeted attack chain intelligence analysis method and system. Contents of the invention [0004] The purpose of the present invention is to provide a meth...

AI Technical Summary

Problems solved by technology

Traditional security detection can only resist security threats from a certain aspect, forming an island of security defense, lacking correlation analysis of massive information security data, and unable to produce synergistic effects

Images