Security event type determination method, device and system and storage medium

Abstract

The invention provides a security event type determination method. The method comprises the steps of obtaining a to-be-determined security event set containing a plurality of to-be-determined securityevents; processing any to-be-determined security event in the to-be-determined security event set, and determining feature information of a preset dimension; and determining the type of any to-be-determined security event based on the feature information of the preset dimension. The invention further provides a safety event type determining device and system and a storage medium. According to thesecurity event type determination method provided by the invention, the accuracy of determining any to-be-determined security event type can be more flexibly improved, so that the probability of missing report of the security event is reduced, and the security is improved.

Description

technical field [0001] The present invention relates to the field of information technology, in particular to a method, device, system and computer-readable storage medium for determining a security event type. Background technique [0002] Cyber ​​security incidents are detected and identified through threat intelligence technology. In related technologies, the characteristic data of suspected security events detected by the threat intelligence technology are only intrusion indicators (Indicators of Compromise, IOC). However, with the increasing types of characteristic attributes of current network security events and the frequent changes of various types of characteristic attributes, the threat intelligence technology in related technologies cannot accurately detect and determine the type of security events with changeable characteristic attributes, so it is easy to appear Missing detection and reporting of security events poses a huge threat to the security of network de...

AI Technical Summary

Problems solved by technology

However, with the increasing types of characteristic attributes of current network security events and the frequent changes of various types of characteristic attributes, the threat intelligence technology in related technologies cannot accurately detect and determine the type of security events with changeable characteristic attributes, so it is easy to appear Missing detection and reporting of security events poses a huge threat to the security of network equipment and terminal equipment

Images