Network risk sensing method and network risk defense method

Abstract

The embodiment of the invention provides a network risk sensing method and a network risk defense method. The network risk sensing method comprises the following steps: aggregating alarm data collected by an IDS to obtain a simplified alarm set; performing association analysis on the simplified alarm set to obtain a completed attack chain; matching the completed attack chain with a complete attack chain in a matching attack mode knowledge base, and calculating the threat degree of the completed attack chain; performing vulnerability scanning on a host, and querying a CVSS vulnerability score of the host; and performing open port scanning on the host, and calculating an open port attack utilization rate. The network risk defense method comprises: defending the host according to a CVSS vulnerability score in combination with the threat degree of the completed attack chain and the open port attack utilization rate. According to the method provided by the invention, multi-dimensional data is fused to carry out threat sensing, and state evaluation is carried out in combination with a scoring result, so that the accuracy of defense implementation is ensured, defense can be automatically completed, and manual decision is not needed.

Description

technical field [0001] One or more embodiments of this specification relate to the technical field of network security, and in particular to a network risk awareness method and defense method. Background technique [0002] In recent years, Internet security has faced severe challenges, and cyber threats have intensified. A network threat refers to a target or event that can destroy the security of the network system environment, and a threat is a potential attack. Cyber ​​threats cover a wide range, including but not limited to malware, web attacks, web application attacks, phishing, denial of service, spam, botnets, data breaches, insider threats, information leaks, identity theft, cyber espionage, etc. [0003] The traditional network defense technology is a static and passive defense technology, which usually restores and traces the source after suffering damage, and has a certain degree of passivity and hysteresis. In order to change the passivity of the defender, cybe...

AI Technical Summary

Problems solved by technology

[0004] Network threat awareness is a method for identifying threat event intentions through single-dimensional or multi-dimensional security information correlation and fusion; current network threat awareness methods are difficult to effectively use security intelligence information generated by multiple devices, and the perception results cannot be used for autonomous defense. effective advice

Images