Multi-step attack tracing method and system, terminal and readable storage medium

Abstract

The invention discloses a multi-step attack tracing method and system, a terminal and a readable storage medium. The tracing method comprises the following steps: formatting a log, extracting event features from the log, establishing a feature relationship, and constructing an event relationship graph according to the feature relationship; weighting the event relation graph through the weight vector to obtain a weighted relation graph; transmitting the weighted relation graph to a community detection module, performing relation division on the weighted relation graph through a community discovery algorithm, and discovering an attack community; after the community is found, based on the obtained attack community, according to the event logic relationship, establishing a sequence, and constructing an attack process. The invention also provides a system, a terminal and a readable storage medium for realizing the method, the problem of state explosion caused by relationship connection canbe solved by utilizing multiple log association analysis, the attack process of multi-step attack can be effectively analyzed, and the method can be used for multi-log-based attack analysis in varioussystems.

Description

technical field [0001] The invention belongs to the field of network security, and relates to a multi-step attack source tracing method, system, terminal and readable storage medium. Background technique [0002] In the era of network information, information security has become the most important technical goal. However, while the network provides convenience, it also brings many security risks. At present, governments and companies all over the world are frequently suffering from cyber attacks. Among all kinds of network attacks, multi-step attacks are more difficult to discover and analyze, and the harm caused by them is also more serious. For example, APT attacks are highly concealed and often go through long-term management and planning. They target commercial information and political security. In the past ten years, there have been more than 6,000 serious incidents, resulting in tens of billions of The economic loss has brought huge negative impact on a global scale...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide a multi-step attack traceability method, system, Terminals and readable storage media can build a complete and accurate attack process by extracting events from multiple logs and establishing reasonable correlations, improving the accuracy of detection and analysis

Images