Clue analysis and verification system and device for network security and storage medium

Abstract

The embodiment of the invention provides a clue analysis and verification system and equipment for network security. The system comprises a clue studying and judging module which is used for displaying the state of a clue; a clue expansion module which is used for providing clues capable of being deeply excavated; a network attack target positioning module which is used for positioning an attacked target, evaluating the risk degree of the target and screening out the target of which the risk degree exceeds a preset threshold value; a clue positioning module which is used for positioning an IP address of a network attacker; and a collaborative sharing module which is used for sharing the analysis result to all members of the analysis working group. According to the clue analysis and verification system and equipment for network security provided by the embodiment of the invention, efficient big data processing can be realized, visual analysis interaction can be performed, an efficient clue analysis tool can be established according to rich clue data resources, and an analysis result can be visually displayed.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of network security, and in particular to a clue analysis and verification system, equipment and storage medium for network security. Background technique [0002] At present, APT attacks with national and organizational backgrounds are increasing. Since 2014, there have been many APT incidents in China, which have been confirmed as targeted attacks targeting technology, education, energy and transportation, affecting nearly 30 provinces and cities across the country. ; More than 10 types of anti-virus Trojan horses were found, involving Windows, Mac OS and Android platforms. In response to these network security incidents, after the law enforcement agencies obtain relevant attack clues such as C2 domain names, IPs, samples, etc., they need to carry out clue research and judgment, expand, trace the source of the attack, locate criminals, etc., but face long-term challenges in the wo...

AI Technical Summary

Problems solved by technology

In response to these network security incidents, after the law enforcement agencies obtain relevant attack clues such as C2 domain names, IPs, samples, etc., they need to carry out clue research and judgment, expand, trace the source of the attack, locate criminals, etc., but face long-term challenges in the work process Lack of Internet data analysis tools, background research and judgment of new clues through correlation analysis, global expansion of clues in time and space dimensions, etc.

Images