Network security threat hunting method based on TTP and network equipment

Abstract

The invention discloses a TTP-based network security threat hunting method and network equipment, and the method comprises the steps: obtaining historical network attack event information, and carrying out the analysis processing of the historical network attack event information, and obtaining a TTP rule model; obtaining related data of the current running state of the terminal equipment, establishing a snapshot based on the related data, and obtaining a snapshot model; carrying out matching processing on the snapshot model based on the TTP rule model to obtain a matching result containing a matching score of the snapshot model, and judging whether a threat standard is reached or not based on the matching result; if the matching score is greater than or equal to a first preset threshold value, determining that a threat standard is reached, and outputting alarm information for warning that the terminal equipment is subjected to the network security threat; or, if the matching score is smaller than the first preset threshold value, determining that the threat standard is not reached, and ending the detection of the network security threat. In this way, various terminal devices can be compatible, compatibility is bettter, and the degree of dependence on entity file programs can be reduced.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a TTP-based network security threat hunting method and network equipment. Background technique [0002] At present, the binary characteristics and sensitive behavior rules of Trojan horse programs are usually used to hunt for network threats. For example, when the Trojan horse program is running or the user performs file operations on the Trojan horse program entity, the above rules are used for matching, so as to achieve the purpose of detecting and discovering the Trojan horse. [0003] The above-mentioned threat hunting method needs to extract binary features from existing Trojan horse programs, and also needs to monitor the running behavior of the terminal device from the driver layer to complete the threat hunting work. Therefore, the rules of the above-mentioned threat hunting method are not common to various terminal devices, and the compatibility is po...

AI Technical Summary

Problems solved by technology

Therefore, the rules of the above threat hunting method are not universal for various terminal devices, and the compatibility is poor, and there must be a physical file program in the hard disk, which is highly dependent on the physical file program

Images