Network threat detection method and device

Abstract

The invention provides a network threat detection method. The method comprises the following steps: acquiring threat index IOC data; performing feature extraction processing on the IOC data to obtain at least one threat index feature associated with the IOC data; a preset threat detection model is utilized to perform malicious rule matching operation based on the at least one threat index feature to obtain a malicious matching score, and the malicious matching score is determined according to the number of matched malicious rules and the type of the malicious rules; and under the condition that the malicious matching score is higher than a preset threshold value, determining that the IOC data is malicious IOC data. The invention further provides a network threat detection device, electronic equipment and a computer readable storage medium.

Description

technical field [0001] The present disclosure relates to the field of network security, and in particular, to a network threat detection method, a network threat detection device, an electronic device, a computer-readable storage medium, and a computer program product. Background technique [0002] With the diversified development of network attack methods and channels, network threats have shown rapid and vicious evolution, which puts forward higher requirements for network threat detection capabilities. IOC (Indicator of Compromise, threat intelligence) data is threat intelligence data that can describe threat event information. Based on IOC data, it is beneficial to realize network threat detection and external attack prevention. [0003] In the process of realizing the technical concept of the present disclosure, the inventor found that the related technology needs to rely heavily on the time investment and experience accumulation of security analysts to perform network ...

AI Technical Summary

Problems solved by technology

[0003] In the process of realizing the technical conception of the present disclosure, the inventors found that related technologies need to rely heavily on the time investment and experience accumulation of security analysts to detect network threats based on IOC data, which has high professional requirements, low detection efficiency, and poor detection results. unstable problem

Images