Vulnerability-based security event association method and related equipment

Abstract

The invention provides a security event association method based on vulnerabilities and related equipment, and aims to establish a vulnerability library by analyzing attributes of vulnerabilities existing in a network, extract utilization relationships in vulnerability attribute information, and establish an attack path by using a causal association analysis technology. Wherein the vulnerability library only needs to be established once, the modification operation is very simple, and the attack path is automatically updated along with the update of the vulnerability library. According to the association method, the association of the security events is pre-judged from the perspective of static analysis. According to the method, attack paths can be extracted from massive alarm events and used as associated events, and the security event association efficiency can be improved while the event analysis difficulty can be effectively reduced.

Description

technical field [0001] The present application relates to the technical field of network security events, and in particular, to a vulnerability-based security event correlation method and related devices. Background technique [0002] At this stage, the form of network attack is mainly multi-step attack. If an attacker wants to obtain data or destroy the normal operation of the device, he usually needs to go through the steps of information collection, infiltration, lateral movement, attack, and data return. The implementation of each step involves many technologies and generates corresponding security data, and the data is not isolated and often has some correlation. Many large-scale network security incidents are often composed of a series of small security incidents according to certain rules, causing serious harm. It is therefore necessary to correlate scattered security data to uncover larger potential threats. [0003] The security event correlation analysis technol...

AI Technical Summary

Problems solved by technology

At present, the main security event correlation analysis techniques include correlation methods based on probabilistic similarity, correlation methods based on environmental status, and correlation methods based on causality, etc., but none of them can satisfy the accuracy and efficiency of correlation results at the same time.

Images