Network security data association analysis method, device and equipment and storage medium

Abstract

The invention discloses a network security data association analysis method and device, equipment and a storage medium, and the method comprises the steps: collecting data capable of representing thecurrent security condition of a network as a sample, extracting corresponding information from the sample as knowledge according to a preset business logic, and constructing a knowledge graph throughthe knowledge; respectively extracting features from each preset rule to obtain corresponding rule features, wherein the rule is data representing that the network has a security threat; and carryingout deep search on the knowledge graph, and if knowledge matched with any rule feature exists in the knowledge graph, determining that the knowledge is a knowledge identification risk matched with anyrule feature. According to the invention, the accuracy and effectiveness of network security analysis can be improved while the network security analysis time is reduced.

Description

technical field [0001] The present invention relates to the technical field of network security, and more specifically, relates to a network security data association analysis method, device, equipment and storage medium. Background technique [0002] Network security-related data are diverse and complex, including security threat intelligence data, vulnerability information, network environment asset data, network security event data, and expert knowledge of security incident response. In the existing technology, when analyzing network security-related data, analysts usually manually analyze each network security-related data, but this method of separate analysis leads to one-sided security analysis results, often with a large number of false positives, Not only is the analyst's precious time wasted, but the real security threat is likely to be overwhelmed. Contents of the invention [0003] The purpose of the present invention is to provide a network security data assoc...

AI Technical Summary

Problems solved by technology

In the existing technology, when analyzing network security-related data, analysts usually manually analyze each network security-related data, but this method of separate analysis leads to one-sided security analysis results, often with a large number of false positives, Not only wastes valuable analyst time, but also has the potential to overwhelm real security threats

Images