Network threat information association system and method

Abstract

The embodiment of the invention provides a network threat information association analysis system and method. The system comprises a log collection server, a log collection database, an intelligence association analysis server and an association analysis result database, the log collection server collects threat information logs from the threat information monitoring systems in a preset data collection mode and records the threat information logs in a log collection database according to a preset data format; the threat information log comprises an IP address; and the information associationanalysis server acquires the threat description information of each IP address from the open source threat information query system, merges the threat description information with the threat information log containing the same IP address in the log acquisition database, obtains an association analysis result corresponding to each IP address, and stores the association analysis result in the association analysis result database. Through the embodiment of the invention, rapid association analysis of various kinds of network threat information is realized, the threat information is effectively aggregated, and powerful threat analysis is rapidly formed.

Description

technical field [0001] The invention relates to the technical field of network systems, in particular to a network threat information association analysis system and method. Background technique [0002] With the continuous expansion of network scale and the increase of network attack methods, network systems can obtain threat information in various ways, such as: distributed denial of service attack (Distributed denial of service attack, DDOS) threat early warning system, anti-grabbing station Detection system, Internet Data Center (IDC) firewall system, Open Threat Exchange (Open Threat Exchange, OTX) open source threat intelligence query system, etc. [0003] Due to the different sources of threat information obtained, there are different data formats and information analysis methods, forming islands of threat information. However, in order to aggregate and analyze various threat information, the existing technology requires workers to log in to their respective informat...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the embodiments of the present invention is to provide a network threat information association analysis system and method to solve the problem of the low efficiency of manually performing association analysis on various network threat information in the face of a huge amount of information, and the threat information cannot be effectively analyzed. Aggregate, quickly form powerful threat analysis questions

Images