Interactive automatic restoration method for network threat event attack scene

Abstract

The invention discloses an interactive automatic restoration method for a network threat event attack scene, comprising the following steps: extracting key information key points from various types of structured and unstructured data, and constructing a multi-dimensional threat event attack scene unified description framework; enhancing the data mining depth for the description framework, extracting entities and entity relationships to form a key information sequence, and classifying according to a hierarchical and structured mode; constructing a time-space sequence threat event description model conforming to logic for the whole attack life cycle of the threat event by using a hierarchical structure; and carrying out attack scene restoration on the space-time sequence threat event description model in a visual interactive mode. The attack scene of the network threat event can be automatically, accurately and comprehensively presented in the attack life cycle, attackers / attack organizations with hostile attack behaviors are helped to be recognized in time, and the attack event analysis efficiency and tracing accuracy of network threat analysts are improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an interactive automatic restoration method for attack scenes of network threat events. Background technique [0002] Network attack and defense, also known as "network confrontation". A collective term for network attack and network protection. Network attack refers to the comprehensive use of loopholes and security defects in the target network to attack the hardware, software and data in the network system. Backdoor and other steps; network protection refers to the comprehensive use of one's own network system functions and technical means to protect one's own network and equipment, so that information and data will not be intercepted, counterfeited, stolen, tampered with or eliminated during storage and transmission, including encryption technology, access control, Detection technology, monitoring technology, auditing technology, etc. Network attack and network pr...

AI Technical Summary

Problems solved by technology

The asymmetry of attack and defense has intensified, and a large number of traditional security devices deployed by enterprise users are still difficult to effectively deal with the increasingly severe threat situation. It is very difficult to trace the source of an attack event

Not only does it require a lot of professional security analysis and operation and maintenance personnel to manually search and compare, but also the tracking efficiency is low and the accuracy is poor

Images