Threat response method and device based on threat intelligence and ATT&CK

Abstract

The invention discloses a threat response method and device based on threat intelligence and ATT&CK, and belongs to the technical field of computer network security. The method comprises the following steps: establishing a threat intelligence library, collecting threat intelligence from public resources and traditional security equipment, analyzing the full life cycle of an attack behavior in combination with an ATT&CK framework, and establishing an attacker machine learning model in a complete attack chain form; establishing a mapping relation between the label and the processing rule according to an attacker machine learning model; monitoring and identifying the real-time flow data by using a DFI-based depth flow detection technology, and continuously changing a label value according to the change of the real-time characteristics of the flow; and activating threat defense according to the mapping relation between the label and the processing rule. According to the method, the problems that the traceability process lacks effective evidence due to single and disordered threat intelligence information and the load overhead of a forbidding and blocking strategy system which is usually adopted is large are solved.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a threat response method and device based on threat intelligence and ATT&CK. Background technique [0002] With the increasing openness and complexity of the Internet and the rapid development of new information technologies such as big data, cloud computing, the Internet of Things, and 5G mobile communication networks, cyberspace threats are also developing towards generalization and complexity. Network security defense based on threat intelligence can analyze existing intrusions in a timely manner, judge future threat situations, and assess potential security risks based on this to guide users to make effective security decisions. [0003] Traditional security protection only relies on firewalls, IDS, IPS and other security devices deployed on borders or special nodes for static control, implements network security monitoring based on feature detection, and ge...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the present invention provides a threat response method and device based on threat intelligence and ATT&CK, which is mainly used to solve the single and chaotic threat intelligence information in the prior art, which leads to the lack of effective evidence in the traceability process, and the commonly adopted Issues such as banning and blocking strategies, high system load overhead, etc.

Images