Intelligent security event association analysis system for threat scene

Abstract

The invention provides an intelligent security event association analysis system for a threat scene. The intelligent security event association analysis system comprises a mass format event storage module, an analysis module and a visual display module, and the analysis module comprises an event association analysis module, a comprehensive threat analysis module, an attack chain analysis module, an attack path analysis module, a Web attack deep analysis module, a network flow metadata behavior analysis module and a network abnormal behavior analysis module. The analysis system provided by the invention can summarize and rationalize threat data to automatically screen out an attack index (IOC) as a machine-readable threat intelligence (MRTI), and uses existing log contrast matching to easily discover uncommon trends or clues and effectively perform operations on the uncommon trends or clues. By combining a team, a process and a tool together, a system platform provides an unprecedented view from which threats come for a security team, the whole event can be tracked from head to tail, and a security response can be guided and blocked through a report.

Description

technical field [0001] The invention relates to network security analysis, in particular to an intelligent security event correlation analysis system oriented to threat scenarios. Background technique [0002] With the continuous expansion of the network scale, the current network has played an increasingly important role in social life; at the same time, network security issues have become increasingly prominent, and have gradually become the key issues that need to be solved urgently for the further development of network services and applications . In addition, with the development of network intrusions and attacks toward distribution, scale, complexity, and indirection, the threats and losses caused by network viruses and Dos / DDos attacks are increasing. Many researchers and Organizations have begun to realize that it is impossible to monitor the entire network security situation in real time only by relying on existing network security products. [0003] As we all kno...

AI Technical Summary

Problems solved by technology

The inevitable problem is that the data sources in the enterprise are scattered, and the analysis system established on this basis must be isolated

However, there is a lack of effective association and comprehensive analysis among these "information islands", and it is impossible to form a unified view of enterprise data

Images