Association graph-based anomaly analysis method and device

Abstract

The invention provides an association graph-based anomaly analysis method and device. The method comprises the steps of obtaining aggregation anomaly of different devices of different manufacturers, generating an association table according to the historical aggregation anomaly, according to the association table, constructing a current association graph containing the current aggregation anomaly on an equipment network topological graph corresponding to each historical aggregation anomaly on a network, in the current association graph, sorting according to threat degrees from large to small, and selecting a first preset number of threat paths, and combining the preset number of threat paths to generate a threat graph, and sending the threat graph to a server. And security personnel can be assisted in distinguishing attack scenes. The association table is generated according to the association between the aggregation anomalies, and the current association graph is constructed in combination with the network topological graph, so that the problem of inaccurate analysis caused by complex association is solved, the threat paths are selected according to the threat degree to form the threat graph for analysis, and the accuracy of analyzing the complex association anomalies is improved.

Description

technical field [0001] The present invention relates to the technical field of data identification, in particular to an abnormal analysis method and device based on a correlation graph. Background technique [0002] With the development of network technology, when a network attack occurs, the system will generate a large number of abnormalities. In terms of system traffic, there will be exceptions related to traffic analysis. In terms of system applications, there will be exceptions in application logs. In terms of the operation of the system itself, exceptions in system audit logs will be generated. The identification of abnormal data is a necessary means to maintain network security, and most of the abnormal data are related, and it is necessary to evaluate and analyze the abnormal data after correlation to determine the abnormality. [0003] In the prior art, the aggregated abnormality is obtained by aggregating the abnormalities generated by different devices of multipl...

AI Technical Summary

Problems solved by technology

In terms of the application of the anomaly evaluation system, due to the large amount of anomaly data and complex anomaly associations in the enterprise, the existing anomaly evaluation system is based on a single analysis system, and the accuracy of its analysis of aggregation anomalies is not high

Images