A network attack path tracing method and device

Abstract

The invention belongs to the fields of computer security technology, advanced threat detection and artificial intelligence technology, and specifically relates to a network attack path tracking method and device: using a network traffic analysis sensor to obtain a collection of various types of network traffic threat events, using a host behavior capture sensor to obtain white Process communication data collections other than the list process; perform data cleaning, filtering, and enrichment operations to obtain data collections related to threat alarms; use the AttackGraph algorithm to build a network attack knowledge graph; use the AttackCampaign algorithm to analyze and identify the knowledge graph in the database Attack actions; use attack actions and attack entity threat weights to restore and track attack paths, and restore attack scenarios. The present invention can meet the requirements of tracking and tracing the source of advanced threats based on the existing data accumulation, and realize the replay of the attack path and attack scene of the network attack action.

Description

technical field [0001] The invention belongs to the fields of computer security technology, advanced threat detection and artificial intelligence technology, and specifically relates to a network attack path tracking method and device, which can satisfy network security researchers to trace the source of advanced threats based on existing data accumulation, and realize conveniently Review the attack paths and attack scenarios of cyber attacks. Background technique [0002] With the rapid development of network innovation and application, the chain of black interests carried in it is getting bigger and bigger, and the attack forms are also diverse and innovative, and the difficulty of network attack detection is increasing. Among them, the advanced threat has become one of the fastest changing forms, the most complex and sophisticated technology, the most targeted, highly concealed, and the most serious direct harm network threats. Advanced threats consist of three elements:...

AI Technical Summary

Problems solved by technology

CN110290116B, a malicious domain name detection method based on knowledge graph, the inventor aims at the problem that the existing static blacklist strategy cannot be flexibly expanded, and proposes to use the association ability of knowledge graph to predict the domain name with malicious behavior, which does not belong to the same technology as the present invention field

[0012] Due to the shortcomings of the above methods in the field of network attack path tracking and source tracing, these methods cannot really meet the needs of network security researchers to track and trace advanced threats based on the existing data accumulation, and conveniently implement network attack detection. Operational attack path and attack scene replay

Images