Maximum likelihood estimation method and system for inferring attack stage based on factor graph

Abstract

The invention discloses a factor graph-based maximum likelihood estimation method and system for inferring an attack stage. The method comprises the following steps: extracting a binary sequence of an attack event-attack stage from an APT data set; training based on the binary sequence of attack event-attack stage to obtain related parameters, and generating a probability transition matrix; receiving an attack chain and constructing a corresponding factor graph, and converting an attack stage of the attack chain into a node and a factor function of the factor graph; and processing the factor graph to obtain the maximum likelihood estimation of the attack stage sequence corresponding to the attack chain. The system comprises a sequence extraction module, a probability transfer matrix generation module, a factor graph construction module and an attack stage inference module. The method has the advantages of being high in accuracy, high in calculation speed and high in expandability.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to a method and system for inferring attack stage maximum likelihood estimation based on a factor graph, which realizes the processing of an attack that has occurred and infers the attack stage. Background technique [0002] With the rapid development of Internet digital technology, people's demand for network bandwidth is increasing year by year, and there is a higher demand for the convenience and security of network access. The importance of network security is self-evident. [0003] APT stands for Advanced Persistent Threat, which can sneak into the target system in stages and stay there for a long time without being detected. The targets of these attacks are carefully selected and researched, especially for large enterprise or government networks, and are prone to serious consequences. However, they are difficult to detect or prevent. But these attacks will leave c...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a maximum likelihood estimation method and system for inferring the attack stage based on a factor graph to quickly and efficiently infer the attack stage

Images