Attack organization identification method based on industrial control flow and threat intelligence association analysis

Abstract

The invention belongs to the technical field of network security and machine learning, and provides an attack organization identification method based on industrial control traffic and threat intelligence association analysis, which comprises the following steps of: obtaining traffic data, threat intelligence information, targeted characteristics and a scanning tool of an industrial control attacker; aiming at the obtained data characteristics of the threat intelligence characteristics and the industrial control traffic characteristics of the attacker, respectively adopting different similarity measurement methods to construct a similarity matrix, fusing to construct a composite weighted similarity matrix, and mapping data points in an original high-dimensional space to a low-dimensional space; clustering the obtained data sample points to obtain an industrial control attack organization; according to the method, the recognition precision of the attack organization is improved, the expandability is high, and the method can be used for monitoring network intruders in real time and actively defending distributed attacks of the attack organization in time. The number of clusters does not need to be specified, the bandwidth can be adaptively calculated, and industrial control attack organizations can be identified more accurately and flexibly.

Description

Technical field [0001] The present invention relates to the field of network security and machine learning techniques, specifically to an attack organization identification method based on industrial control traffic and threat intelligence correlation analysis. Background [0002] In recent years, cyberattacks against critical infrastructure have become increasingly severe, especially advanced persistent threats (APTs), which are highly targeted, well-organized, long-lasting, highly concealed, and indirect attacks compared to traditional cyber attacks. Successful APT attacks can often generate huge profits, so attackers often exist as an organization, consisting of a highly skilled group of hackers, collaborating on attacks and planning their attacks in advance. APT attacks can cause huge losses to businesses and even countries through multi-attacker collaborative attacks that disrupt the critical infrastructure of specific targets, steal confidential data, or encrypt user files...

AI Technical Summary

Problems solved by technology

However, the existing identification methods for attacking organizations have low accuracy, and are not very practical and informative

Images