Network security threat identification method based on event detection mode

Abstract

The invention relates to a network security threat identification method based on an event detection mode. According to the method, feature engineering processing is performed on event big data of each node of a network, model learning training is performed on the data after feature engineering processing according to two modes of event points and event streams, and two types of model knowledge of an event point anomaly detection model and an event stream risk prediction model are generated. On the basis of model knowledge, for threat identification of a single-point event, a matching value of an event feature and a certain threat model abnormal point feature is calculated to judge whether a potential threat exists or not; for threat identification of a plurality of associated events similar to multi-step attacks, firstly, a feature sequence of the associated events is obtained by using an association analysis algorithm, and then a matching value of a sequence feature of an event stream and a sequence feature of a certain threat model is calculated to predict whether potential threats exist or not. According to the method, instant threat identification and hidden threat mining can be realized, and the level of network security operation and maintenance is greatly improved.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network security threat identification method based on an event detection mode. Background technique [0002] In the context of the modern network environment and complex network assets, the importance of solving problems such as how to identify threats in an instant and efficiently, and how to comprehensively gain insight into the threat situation of the overall network has become increasingly prominent. However, traditional threat identification methods have many limitations. From the perspective of security operation and maintenance personnel, threat monitoring based on manpower is time-consuming, laborious and inefficient, and security operation and maintenance personnel are generally insufficient in analyzing potential threats and predicting unknown types of threats; from the perspective of security protection tools , The implementation of threat identification in existing...

AI Technical Summary

Problems solved by technology

From the perspective of security operation and maintenance personnel, threat monitoring based on manpower is time-consuming, laborious and inefficient, and security operation and maintenance personnel are generally insufficient in analyzing potential threats and predicting unknown types of threats; from the perspective of security protection tools , the implementation of threat identification in existing tools is too dependent on rules, lacks the ability to correlate data, and lacks the ability to intelligently warn

Images