Network attack organization detection method, device, equipment and readable storage medium

Abstract

The invention discloses a network attack organization detection method, which comprises the following steps: when a target network attack is detected, obtaining a target attack feature of the target network attack; performing honeypot environment matching on the target attack features by using a preset rule base; judging whether the honeypot environment is successfully matched or not; if yes, pulling target attack traffic corresponding to the target network attack to the matched target honeypot environment, and capturing an attack sample and attack context information according to the target attack traffic by using the target honeypot environment; analyzing the attack sample to obtain sample recognition information; and determining a target attack organization according to the attack context information and the sample recognition information. By applying the detection method of the network attack organization provided by the invention, the dependence on known information is reduced, and the accuracy of the detection of the network attack organization is improved. The invention further discloses a network attack organization detection device and equipment and a storage medium, which have corresponding technical effects.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a detection method, device, equipment and computer-readable storage medium of a network attacking organization. Background technique [0002] Threat intelligence is some kind of evidence-based knowledge, including context, mechanism, indication, meaning and actionable advice, which is related to existing or brewing threats or hazards faced by assets, and can be used by assets-related entities to assess threats or Provide information to support hazard response or treatment decisions. Most of the threat intelligence mentioned in the industry can be regarded as threat intelligence in a narrow sense. Its main content is the identification of compromises used to identify and detect threats, such as file HASH (hash value), IP (Internet Protocol, network interconnection Protocol), domain name, program running path, registry entries, etc., and related attribution labels...

AI Technical Summary

Problems solved by technology

This method is only inference, and the existing information is time-sensitive. When the attack method is updated, or the information elements are incomplete, the inference based on the existing information is prone to deviation, and then the context supplement error occurs, resulting in the inability to effectively analyze Identify the purpose of the attack and associate it with a specific network attack organization

Images