A network threat event attack scene interactive automatic restoration method

Abstract

The invention discloses an interactive automatic restoration method for network threat event attack scenes, which extracts key information points from various types of structured and unstructured data and constructs a unified description framework for multi-dimensional threat event attack scenes; the above description framework is enhanced Data mining depth, extract entities and entity relationships, form key information sequences, and classify them in a hierarchical and structured manner; and use the hierarchical structure to build a logical time-space sequence threat event description model for the entire attack life cycle of threat events; The above-mentioned space-time sequence threat event description model restores attack scenarios in a visual and interactive manner. The present invention can automatically, accurately and comprehensively present network threat events to attack scenarios within the attack life cycle, help timely identify attackers / attack organizations with malicious attack behaviors, and improve the efficiency and tracking of network threat analysts in analyzing attack events Accuracy of traceability.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an interactive automatic restoration method for attack scenes of network threat events. Background technique [0002] Network attack and defense, also known as "network confrontation". A collective term for network attack and network protection. Network attack refers to the comprehensive use of loopholes and security defects in the target network to attack the hardware, software and data in the network system. Backdoor and other steps; network protection refers to the comprehensive use of one's own network system functions and technical means to protect one's own network and equipment, so that information and data will not be intercepted, counterfeited, stolen, tampered with or eliminated during storage and transmission, including encryption technology, access control, Detection technology, monitoring technology, auditing technology, etc. Network attack and network pr...

AI Technical Summary

Problems solved by technology

The asymmetry of attack and defense has intensified, and a large number of traditional security devices deployed by enterprise users are still difficult to effectively deal with the increasingly severe threat situation. It is very difficult to trace the source of an attack event

Not only does it require a lot of professional security analysis and operation and maintenance personnel to manually search and compare, but also the tracking efficiency is low and the accuracy is poor

Images