Network alarm information clustering method based on attribute correlation

Abstract

The invention discloses a network alarm information clustering method based on attribute correlation. The method comprises the following specific steps: arranging network alarm information; clustering the network alarm information with the same attack source or the same attack target according to the quintuple features; clustering the network alarm information with the same data characteristics and attack types according to the attack type characteristics of the alarm information to obtain a network alarm information set with the network alarm information type characteristics; clustering network alarm information based on attack occurrence time; and clustering network alarm information and fusing again. The alarm information clustering of the space-time global perspective is realized based on the multi-dimensional attribute feature clustering, which is matched with the situation that an attacker often carries out combined attack on an attacked target by adopting multiple attack technical and tactical methods in an actual attack event, and can cover the full view and important details of the attack event; and better basic conditions are prepared for attack event analysis and attack scene restoration.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network alarm information clustering method based on attribute correlation. Background technique [0002] At present, in the field of network security attack and defense, with the continuous development and progress of information technology and the continuous evolution and enrichment of network defense capabilities, network attack techniques and technologies are also becoming more and more complicated in the game with network security defense equipment. Various types of network security defense equipment and security monitoring and early warning equipment in the enterprise network will generate a lot of redundant alarm information in the face of increasingly complex attack methods. The real attack alarm information is covered up by a large number of low-quality alarm information, which leads to the continuous increase in the complexity and difficulty of alarm information proces...

AI Technical Summary

Problems solved by technology

The alarm information clustering based on the alarm information clustering method based on the alarm information type often only clusters a fragment of the attack event, which is not enough to cover the whole picture of the attack event

Images