Attacker threat scoring method and related device

Abstract

The present application relates to the field of network security technology, and discloses an attacker threat scoring method and related devices. The present application determines the prior knowledge threat score of the attack source by using the intelligence threat score of the attack source determined by the intelligence type of the attack event hit and the honeypot threat score of the attack source determined by the hit situation of the attacker alarm information provided by the honeypot; then determines the attack information threat score of the attack source based on the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, the attack directionality and other dimensional information; finally, determines the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score, accurately evaluates the attacker from more dimensions, can improve the accuracy of the attacker threat score, so that users can quickly discover high threat sources and quickly deal with them, and improve security protection capabilities.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an attacker threat scoring method and related devices. Background Art

[0002] With the development of science and technology, network threats are becoming more and more frequent. Users from all walks of life are paying more and more attention to security protection. They have purchased various security equipment and tools and formed their own security protection systems. The most common ones include SIEM (Security Information and Event Management) and SOC (Security Operation Center) tools. The wide range of network attack sources and the automation of attack tools have led to a large number of attack alarms in the network. Even if various security tools are used to analyze, merge and filter the alarms, there will still be a lot of alarms that need to be processed.

[0003] In the related technology, the most commonly used method for handling alarms is to block the attack source. However, since many users need to provide services to the outside world, if the attack source is blocked by mistake because it is not clear, it may affect the user's reputation. In addition, when there are many external visits and many attack sources in the alarm, if the real attacker cannot be found in time, it will not be possible to provide customers with good security protection and countermeasure capabilities. Therefore, how to further improve the accuracy of the attacker threat score so that users can quickly find high threat sources and deal with them quickly, thereby improving security protection capabilities is an urgent problem to be solved. Summary of the invention

[0004] The present application provides an attacker threat scoring method and related devices, which are used to solve the problem of how to further improve the accuracy of attacker threat scoring, so that users can quickly discover high threat sources and quickly deal with them, thereby improving security protection capabilities.

[0005] In a first aspect, an embodiment of the present application provides an attacker threat scoring method, comprising:

[0006] Extracting attack sources based on attack events in a first specified period;

[0007] Determining an intelligence threat score of the attack source based on the intelligence type hit by the attack event of the attack source; and

[0008] Determine the honeypot threat score of the attack source based on the hit status of the attack event of the attack source on the attacker warning information provided by the honeypot;

[0009] Determining a priori knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score;

[0010] Determine the attack information threat score of the attack source based on the multi-dimensional information, wherein the multi-dimensional information includes at least two of the following: the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, and the attack directionality, wherein the attack directionality has a positive correlation with the number of attack events against the attack target;

[0011] An attacker threat score of the attack source is determined based on the prior knowledge threat score and the attack information threat score.

[0012] In a possible implementation manner, determining the prior knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score specifically includes:

[0013] The intelligence threat score and the honeypot threat score are weighted and summed to determine the prior knowledge threat score of the attack source.

[0014] In a possible implementation manner, determining the attack information threat score of the attack source based on the multi-dimensional information specifically includes:

[0015] Determining an attack target threat score of the attack source based on the number of attack chain stages, the attack directionality, and the asset status of the attack target;

[0016] Determine the attack means threat score of the attack source based on the attack chain stage level, the number of attack events, the threat level of the attack events, the confidence of the attack events and the attack result;

[0017] The attack target threat score and the attack means threat score are weighted and summed to determine the attack information threat score of the attack source.

[0018] In a possible implementation manner, determining the attack target threat score of the attack source based on the number of attack chain stages, the attack directionality, and the asset status of the attack target specifically includes:

[0019] Extracting attack targets based on attack events in the attack source, and setting the threat score of the attack target of the attack source to an initial value;

[0020] Determining an attack target threat score of the attack target based on the number of attack chain stages, the attack directionality, and the asset status of the attack target;

[0021] If the attack target threat score of the attack source is less than the attack target threat score of the attack target, then the attack target threat score of the attack source is set to the attack target threat score of the attack target;

[0022] If the attack target threat score of the attack source is greater than or equal to the attack target threat score of the attack target, the attack target threat score of the attack source remains unchanged.

[0023] In a possible implementation manner, determining the attack target threat score of the attack target based on the number of attack chain stages, the attack directionality, and the asset status of the attack target specifically includes:

[0024] Determining an attack chain coverage threat score of the attack target based on the number of attack chain stages included in the event against the attack target;

[0025] Determining a ratio of the number of attack events against the attack target to the number of attack events at the attack source based on the number of attack events against the attack target and the number of attack events at the attack source;

[0026] Determining a threat score of the attack events directed to the attack target based on a ratio of the number of attack events directed to the attack target to the number of attack events of the attack source;

[0027] The attack chain coverage threat score and the attack event pointing threat score are weighted and summed to determine the attack intention threat score of the attack target;

[0028] Based on the asset status of the attack target, determine the asset status threat score of the attack target; wherein the asset status of the attack target includes the compromise status, vulnerability value and asset value score of the attack target;

[0029] The attack intention threat score and the asset status threat score are weighted and summed to determine the attack target threat score of the attack target.

[0030] In a possible implementation manner, determining the attack means threat score of the attack source based on the attack chain stage level, the number of attack events, the threat level of the attack event, the confidence of the attack event, and the attack result specifically includes:

[0031] Determining an attack chain stage threat score of the attack source based on the highest attack chain stage level of the attack source;

[0032] Determine a threat score of the number of attack events of the attack source based on the number of attack events;

[0033] Determining a threat score of the attack event threat level of the attack source based on the threat level of the attack event, the confidence of the attack event and the attack result;

[0034] The attack means threat score of the attack source is determined by weighted summing the attack chain stage threat score, the attack event quantity threat score and the attack event threat degree threat score.

[0035] In a possible implementation manner, determining the attack event quantity threat score of the attack source based on the attack event quantity specifically includes:

[0036] Determine, based on the number of attack events of the attack source and the number of attack events in the first specified period, a ratio of the number of attack events of the attack source to the number of attack events in the first specified period;

[0037] Determining a threat score of the attack event ratio of the attack source based on a ratio of the number of attack events of the attack source to the number of attack events in the first specified period;

[0038] Determine a threat score for the total number of attack events of the attack source based on the number of attack events of the attack source;

[0039] The threat score of the attack event proportion and the threat score of the total number of attack events are weighted and summed to determine the threat score of the number of attack events of the attack source.

[0040] In a possible implementation manner, determining the threat score of the attack event threat level of the attack source based on the attack event threat level, the confidence of the attack event, and the attack result specifically includes:

[0041] Determine the attack success event threat score of the attack source based on the highest attack event threat level of the attack events whose attack results are successful attacks and the average confidence score of the attack events whose attack results are successful attacks and whose attack event threat levels are the highest;

[0042] Determine the attack event threat score of the attack source based on the highest attack event threat level of the attack events in the attack source and the average confidence score of the attack events with the highest attack event threat level;

[0043] The threat score of the attack success event and the threat score of the attack event are weighted and summed to determine the threat score of the attack event threat level of the attack source.

[0044] In a possible implementation manner, determining the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score specifically includes:

[0045] If there is prior knowledge, a weighted sum of the prior knowledge threat score and the attack information threat score is taken to determine the attacker threat score of the attack source in the first specified period;

[0046] If there is no prior knowledge, setting the attacker threat score of the attack source in the first specified period as the attack information threat score;

[0047] The attacker threat score of the attack source of a specified number of second specified periods is weightedly summed to determine the attacker threat score of the attack source; wherein the second specified period includes multiple first specified periods; wherein the attacker threat score of the attack source of the last of the first specified periods in the second specified period is used as the attacker threat score of the attack source of the second specified period.

[0048] In a possible implementation manner, extracting the attack source based on the attack events in the first specified period specifically includes:

[0049] Acquire attack events in the first specified period and attack source identifiers corresponding to each attack event in the first specified period;

[0050] Based on the attack source identifier corresponding to each attack event in the first specified period, multiple attack sources corresponding to the attack event in the first specified period and the number of attack events included in each attack source are extracted.

[0051] In a possible implementation manner, extracting the attack target based on the attack event in the attack source specifically includes:

[0052] Acquire attack events in the attack source and attack target identifiers corresponding to each attack event in the attack source;

[0053] Based on the attack target identifier corresponding to each attack event in the attack source, multiple attack targets corresponding to the attack event in the attack source and the number of attack events included in each attack target are extracted.

[0054] In a second aspect, an embodiment of the present application provides an attacker threat scoring device, the device comprising:

[0055] An attack source extraction module, used to extract an attack source based on attack events in a first specified period;

[0056] an intelligence threat score determination module, configured to determine the intelligence threat score of the attack source based on the intelligence type hit by the attack event of the attack source; and

[0057] A honeypot threat score determination module, configured to determine a honeypot threat score of the attack source based on a hit condition of the attack event of the attack source on the attacker warning information provided by the honeypot;

[0058] A priori knowledge threat score determination module, used to determine the priori knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score;

[0059] an attack information threat score determination module, configured to determine the attack information threat score of the attack source based on multi-dimensional information, wherein the multi-dimensional information includes at least two of the following: the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, and the attack directivity, wherein the attack directivity has a positive correlation with the number of attack events against the attack target;

[0060] The attacker threat score determination module is used to determine the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score.

[0061] In a possible implementation, the determining of the prior knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score is performed, and the prior knowledge threat score determination module is specifically used to:

[0062] The intelligence threat score and the honeypot threat score are weighted and summed to determine the prior knowledge threat score of the attack source.

[0063] In a possible implementation, the step of determining the attack information threat score of the attack source based on the multi-dimensional information is performed, and the attack information threat score determination module specifically includes:

[0064] an attack target threat score determination unit, configured to determine an attack target threat score of the attack source based on the number of attack chain stages, the attack directionality, and the asset status of the attack target;

[0065] an attack means threat score determination unit, configured to determine the attack means threat score of the attack source based on the attack chain stage level, the number of attack events, the attack event threat level, the confidence level of the attack event, and the attack result;

[0066] The attack information threat score determination unit is used to perform a weighted summation of the attack target threat score and the attack means threat score to determine the attack information threat score of the attack source.

[0067] In a possible implementation, the step of determining the attack target threat score of the attack source based on the number of attack chain stages, the attack directionality, and the asset status of the attack target is performed, and the attack target threat score determination unit is specifically configured to:

[0068] Extracting attack targets based on attack events in the attack source, and setting the threat score of the attack target of the attack source to an initial value;

[0069] Determining an attack target threat score of the attack target based on the number of attack chain stages, the attack directionality, and the asset status of the attack target;

[0070] If the attack target threat score of the attack source is less than the attack target threat score of the attack target, then the attack target threat score of the attack source is set to the attack target threat score of the attack target;

[0071] If the attack target threat score of the attack source is greater than or equal to the attack target threat score of the attack target, the attack target threat score of the attack source remains unchanged.

[0072] In a possible implementation, the step of determining the attack target threat score of the attack target based on the number of attack chain stages, the attack directionality, and the asset status of the attack target is performed, and the attack target threat score determination unit is specifically configured to:

[0073] Determining an attack chain coverage threat score of the attack target based on the number of attack chain stages included in the event against the attack target;

[0074] Determining a ratio of the number of attack events against the attack target to the number of attack events at the attack source based on the number of attack events against the attack target and the number of attack events at the attack source;

[0075] Determining a threat score of the attack events directed to the attack target based on a ratio of the number of attack events directed to the attack target to the number of attack events of the attack source;

[0076] The attack chain coverage threat score and the attack event pointing threat score are weighted and summed to determine the attack intention threat score of the attack target;

[0077] Based on the asset status of the attack target, determine the asset status threat score of the attack target; wherein the asset status of the attack target includes the compromise status, vulnerability value and asset value score of the attack target;

[0078] The attack intention threat score and the asset status threat score are weighted and summed to determine the attack target threat score of the attack target.

[0079] In a possible implementation, the step of determining the attack means threat score of the attack source based on the attack chain stage level, the number of attack events, the threat level of the attack event, the confidence of the attack event, and the attack result is performed, and the attack means threat score determination unit is specifically used to:

[0080] Determining an attack chain stage threat score of the attack source based on the highest attack chain stage level of the attack source;

[0081] Determine a threat score of the number of attack events of the attack source based on the number of attack events;

[0082] Determining a threat score of the attack event threat level of the attack source based on the threat level of the attack event, the confidence of the attack event and the attack result;

[0083] The attack means threat score of the attack source is determined by weighted summing the attack chain stage threat score, the attack event quantity threat score and the attack event threat degree threat score.

[0084] In a possible implementation manner, the determining of the attack event quantity threat score of the attack source based on the attack event quantity is performed, and the attack means threat score determining unit is specifically configured to:

[0085] Determine, based on the number of attack events of the attack source and the number of attack events in the first specified period, a ratio of the number of attack events of the attack source to the number of attack events in the first specified period;

[0086] Determining a threat score of the attack event ratio of the attack source based on a ratio of the number of attack events of the attack source to the number of attack events in the first specified period;

[0087] Determine a threat score for the total number of attack events of the attack source based on the number of attack events of the attack source;

[0088] The threat score of the attack event proportion and the threat score of the total number of attack events are weighted and summed to determine the threat score of the number of attack events of the attack source.

[0089] In a possible implementation, the step of determining the threat score of the attack event threat level of the attack source based on the threat level of the attack event, the confidence of the attack event, and the attack result, the attack means threat score determination unit is specifically configured to:

[0090] Determine the attack success event threat score of the attack source based on the highest attack event threat level of the attack events whose attack results are successful attacks and the average confidence score of the attack events whose attack results are successful attacks and whose attack event threat levels are the highest;

[0091] Determine the attack event threat score of the attack source based on the highest attack event threat level of the attack events in the attack source and the average confidence score of the attack events with the highest attack event threat level;

[0092] The threat score of the attack success event and the threat score of the attack event are weighted and summed to determine the threat score of the attack event threat level of the attack source.

[0093] In a possible implementation, the method of determining the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score is performed, and the attacker threat score determination module is specifically used to:

[0094] If there is prior knowledge, a weighted sum of the prior knowledge threat score and the attack information threat score is taken to determine the attacker threat score of the attack source in the first specified period;

[0095] If there is no prior knowledge, setting the attacker threat score of the attack source in the first specified period as the attack information threat score;

[0096] The attacker threat score of the attack source of a specified number of second specified periods is weightedly summed to determine the attacker threat score of the attack source; wherein the second specified period includes multiple first specified periods; wherein the attacker threat score of the attack source of the last of the first specified periods in the second specified period is used as the attacker threat score of the attack source of the second specified period.

[0097] In a possible implementation manner, the attack source is extracted based on the attack events in the first specified period, and the attack source extraction module is specifically configured to:

[0098] Acquire attack events in the first specified period and attack source identifiers corresponding to each attack event in the first specified period;

[0099] Based on the attack source identifier corresponding to each attack event in the first specified period, multiple attack sources corresponding to the attack event in the first specified period and the number of attack events included in each attack source are extracted.

[0100] In a possible implementation manner, the step of extracting the attack target based on the attack event in the attack source, the attack target threat score determination unit is specifically configured to:

[0101] Acquire attack events in the attack source and attack target identifiers corresponding to each attack event in the attack source;

[0102] Based on the attack target identifier corresponding to each attack event in the attack source, multiple attack targets corresponding to the attack event in the attack source and the number of attack events included in each attack target are extracted.

[0103] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0104] processor;

[0105] a memory for storing instructions executable by the processor;

[0106] The processor is configured to execute the instructions to implement any attacker threat scoring method provided in the first aspect above.

[0107] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any attacker threat scoring method provided in the first aspect above.

[0108] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, wherein the computer program is executed by a processor to implement any attacker threat scoring method provided in the first aspect above.

[0109] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0110] The attacker threat scoring method provided in the embodiment of the present application determines the intelligence threat score of the attack source by the intelligence type of the attack event hit based on the attack source; and determines the honeypot threat score of the attack source based on the attack event of the attack source hitting the attacker warning information provided by the honeypot; determines the prior knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score; then determines the attack information threat score of the attack source based on the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, the attack directionality and other multi-dimensional information, and finally determines the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score. The present application conducts a comprehensive evaluation through multi-dimensional information, so that the attacker threat score of the attack source can be accurately evaluated from more dimensions, the accuracy of the attacker threat score can be improved, and the generated attacker threat score can be used to prioritize many attackers and determine high-threat attackers, so that users can quickly discover high-threat sources and quickly dispose of high-threat sources through security protection tools, thereby improving security protection capabilities.

[0111] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0112] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0113] Figure 1 A flowchart of an attacker threat scoring method provided in an embodiment of the present application;

[0114] Figure 2 A flowchart of a method for determining a priori knowledge threat scoring of an attack source provided in an embodiment of the present application;

[0115] Figure 3 A flowchart of a method for determining an attack information threat scoring of an attack source provided in an embodiment of the present application;

[0116] Figure 4 A flowchart of a method for determining an attack target threat score of an attack source provided in an embodiment of the present application;

[0117] Figure 5 A flowchart of a method for determining an attack target threat score for an attack target provided in an embodiment of the present application;

[0118] Figure 6 A flowchart of a method for determining an attack source's attack threat scoring provided in an embodiment of the present application;

[0119] Figure 7 A flowchart of a method for determining a threat scoring method of the number of attack events of an attack source provided in an embodiment of the present application;

[0120] Figure 8 A flowchart of a method for determining the threat level of an attack event of an attack source provided in an embodiment of the present application;

[0121] Fig. 9 A flowchart of a method for determining an attacker threat scoring of an attack source provided in an embodiment of the present application;

[0122] Fig.10 A schematic diagram of the structure of an attacker threat scoring device provided in an embodiment of the present application;

[0123] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0124] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0125] Below, some terms in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0126] (1) In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0127] (2) "and / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0128] (3) Servers provide services for terminals. The services provided include providing resources to terminals and storing terminal data. Servers correspond to applications installed on terminals and work in conjunction with applications on terminals.

[0129] (4) Terminal, which can refer to software APP (Application) or client. It has a visual display interface and can interact with users; it corresponds to the server and provides local services to customers. For software applications, except for some applications that only run locally, they are generally installed on ordinary client terminals and need to cooperate with the server to run. After the development of the Internet, more commonly used applications include email clients for sending and receiving emails, and instant messaging clients. For this type of application, there needs to be corresponding servers and service programs in the network to provide corresponding services, such as database services, configuration parameter services, etc. In this way, specific communication connections need to be established between the client terminal and the server to ensure the normal operation of the application.

[0130] (5) Intelligence data: mainly includes Ioc (Indicator of Compromise) types, such as: IP (Internet Protocol, a protocol for interconnecting networks), URL (Uniform Resource Locators), MD5 (message-digest algorithm 5); intelligence values, such as: 211.211.211.211, www.evi l.com, ab12cd34ef56fa78eb90dc81ad72be63, etc.;

[0131] (6) Event data: mainly includes information such as attack source IP, attack target IP or URL, event type, event threat level, event confidence, number of attacks, event attack results, attack chain stage, etc. The attack source IP may hit intelligence data. When the attacker uses malicious samples, the malicious sample summary information may be included in the event. The attack target IP may hit the customer's assets.

[0132] (7) Asset data: mainly including: asset name, asset identification, asset IP, asset URL, asset value, asset responsible person, asset department, etc.;

[0133] (8) Attack chain: The attack chain model uses different steps to describe each stage of the cyber attack life cycle, including: reconnaissance, tool creation, delivery, attack penetration, tool installation, command and control, and malicious activities.

[0134] Any number of elements in the drawings is for illustration and not limitation, and any naming is for distinction only and does not have any limiting meaning.

[0135] With the development of science and technology, network threats are becoming more and more frequent. Users from all walks of life are paying more and more attention to security protection, purchasing various security equipment and security tools, and forming their own security protection systems. The most common ones include SIEM (Security Information and Event Management) and SOC (security operation center) tools. The wide range of network attack sources and the automation of attack tools have led to a large number of attack alarms in the network. Even if various security tools are used to analyze, merge, and filter the alarms, there will still be a lot of alarms that need to be processed.

[0136] In the related technology, the most commonly used method for handling alarms is to block the attack source. However, since many users need to provide services to the outside world, if the attack source is blocked by mistake because it is not clear, it may affect the user's reputation. In addition, when there are many external visits and many attack sources in the alarm, if the real attacker cannot be found in time, it will not be possible to provide customers with good security protection and countermeasure capabilities. Therefore, how to further improve the accuracy of the attacker threat score so that users can quickly find high threat sources and deal with them quickly, thereby improving security protection capabilities is an urgent problem to be solved.

[0137] Existing threat assessment methods for attackers include analysis from the perspectives of intelligence, events, and attack targets. However, the means used in the assessment are relatively simple. For example, in terms of intelligence, only whether a hit is achieved is considered, and in terms of events, the number of events and the attributes of the threat level are mainly considered. The dimensions considered by related technologies are not comprehensive, resulting in the inability of the assessment scores to truly reflect the threat level of the attackers. Even a large number of attackers have the same assessment scores, making it impossible to accurately identify the targets that need to be prioritized.

[0138] In view of this, the present application provides an attacker threat scoring method and related devices to solve the problem of how to further improve the accuracy of attacker threat scoring, so that users can quickly discover high threat sources and quickly deal with them, thereby improving security protection capabilities.

[0139] The inventive concept of the present invention is as follows: the present application determines the intelligence threat score of the attack source by the intelligence type of the attack event hit based on the attack source; and determines the honeypot threat score of the attack source based on the attack event of the attack source hitting the attacker warning information provided by the honeypot; determines the prior knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score; then determines the attack information threat score of the attack source based on the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, the attack directionality and other dimensional information, and finally determines the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score. The present application conducts a comprehensive evaluation through multiple dimensional information, so that the attacker threat score of the attack source can be accurately evaluated from more dimensions, the accuracy of the attacker threat score can be improved, and the generated attacker threat score can be used to prioritize many attackers and determine high-threat attackers, so that users can quickly discover high-threat sources and quickly dispose of high-threat sources through security protection tools, thereby improving security protection capabilities.

[0140] After introducing the inventive concept of the embodiment of the present application, in order to further illustrate the technical solution provided by the embodiment of the present application, this is described in detail in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application.

[0141] refer to Figure 1 , is a flow chart of an attacker threat scoring method provided in an embodiment of the present application. Figure 1 As shown, the method comprises the following steps:

[0142] In step 101, attack sources are extracted based on attack events in a first specified period.

[0143] In one possible implementation, the attacker threat scoring is performed continuously and can be divided into multiple first specified periods. There may be multiple attack events in one first specified period, and the multiple attack events may be used by multiple attack sources. Therefore, the embodiment of the present application can obtain the attack events in the first specified period and the attack source identifier corresponding to each attack event in the first specified period, and then based on the attack source identifier corresponding to each attack event in the first specified period, extract the multiple attack sources corresponding to the attack events in the first specified period and the number of attack events included in each attack source.

[0144] Exemplarily, the attack source is identified as the attack source IP, and the first designated period is set to 1 hour. After all attack events acquired in 1 hour are classified and counted according to the attack source IP, there will be multiple attack sources, and each attack source includes corresponding multiple attack events, and then the attacker threat scoring method provided in this application is used to calculate the corresponding attacker threat score for each attack source. The first designated period can be set according to actual conditions, and generally 1 hour can be set as a first designated period.

[0145] In step 102, based on the intelligence type hit by the attack event of the attack source, the intelligence threat score of the attack source is determined.

[0146] In a possible implementation, the intelligence type of the attack event hit and the intelligence threat score of the corresponding attack source are first given in the embodiment of the present application, as shown in Table 1, and then the intelligence threat score of the corresponding attack source can be found in Table 1 according to the intelligence type of the attack event hit of the attack source to obtain the intelligence threat score of the corresponding attack source.

[0147] Table 1

[0148]

[0149] In step 103, based on the hit status of the attack events of the attack source on the attacker warning information provided by the honeypot, the honeypot threat score of the attack source is determined.

[0150] Among them, honeypot is an active defense technology for security threats. It attracts attackers by simulating one or more vulnerable hosts or services, capturing attack traffic and samples, discovering network threats, and extracting threat features. The value of honeypot lies in being detected and conquered, and it is usually deployed in the customer network environment.

[0151] In a possible implementation, in the embodiment of the present application, the hit situation of the attack event on the attacker warning information provided by the honeypot and the honeypot threat score of the corresponding attack source are first given, as shown in Table 2, and then the honeypot threat score of the corresponding attack source can be found in Table 2 according to the hit situation of the attack event on the attacker warning information provided by the honeypot to obtain the honeypot threat score of the corresponding attack source.

[0152] Table 2

[0153]

[0154] In step 104, a priori knowledge threat score of the attack source is determined based on the intelligence threat score and the honeypot threat score.

[0155] In a possible implementation, the intelligence threat score and the honeypot threat score may be weighted and summed to determine the prior knowledge threat score of the attack source. Specifically, the following may be performed: Figure 2 Steps shown:

[0156] In step 201, it is determined whether there is an intelligence knowledge base. If there is an intelligence knowledge base, in step 202, the intelligence threat score of the attack source is obtained, and then step 203 is executed; if there is no intelligence knowledge base, step 203 is directly executed.

[0157] In step 203, it is determined whether honeypot information is deployed in the environment. If honeypot information is deployed, in step 204, the honeypot threat score of the attack source is obtained, and then step 205 is executed. If honeypot information is not deployed, step 205 is directly executed.

[0158] In step 205, the intelligence threat score and the honeypot threat score are weighted and summed to determine the prior knowledge threat score of the attack source.

[0159] For example, S kn =α1*S ti +α2*S h Calculate the prior knowledge threat score of the attack source, where S kn is the prior knowledge threat score of the attack source, ranging from [0,5], S ti is the intelligence threat score of the attack source obtained in step 102, S h is the honeypot threat score of the attack source obtained in step 103. Where α1+α2=1, α1 and α2 are weighting coefficients, which can be determined according to empirical values, for example, α1=0.2, α2=0.8, or can be set according to actual usage, which is not limited in the embodiment of the present application. When there is no intelligence knowledge base, α1=0 is set, and when no honeypot information is deployed, α2=0 is set.

[0160] In step 206, the process of determining the prior knowledge threat score of the attack source ends.

[0161] Therefore, when determining the prior knowledge threat score of the attack source, not only the information provided by various threat intelligence sources is used, but also the information from honeypot-type security protection products. Since such products generally simulate the user's real services and ordinary users rarely access them, the attack sources in the alarm information they report are highly credible, thereby improving the accuracy of the prior knowledge threat score of the attack source.

[0162] In step 105, based on the multi-dimensional information, the attack information threat score of the attack source is determined, and the multi-dimensional information includes at least two of the following: the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, and the attack directionality. The attack directionality has a positive correlation with the number of attack events against the attack target.

[0163] Among them, the attack targets are various security protection devices in the network, such as: NIPS (Network Intrusion Prevention System, the next generation intrusion protection system), WAF (Web Application Firewall), NF (NSFOCUS, the next generation firewall), traffic probes, EDR (Endpoint Detection and Response, terminal protection response).

[0164] Using multiple information associated with the attack target for multi-dimensional comprehensive evaluation can avoid scoring the attack information threat of the attack source based on the number of attack events, thereby making the calculated attack information threat score more credible.

[0165] In a possible implementation, the embodiment of the present application can determine the attack information threat score of the attack source based on multi-dimensional information, which can be specifically performed as follows: Figure 3 Steps shown:

[0166] In step 301, based on the number of attack chain stages, attack directionality, and asset status of the attack target, the attack target threat score of the attack source is determined.

[0167] In a possible implementation, the embodiment of the present application determines the threat score of the attack target of the attack source based on the number of attack chain stages, attack directionality, and asset status of the attack target. Specifically, the following may be performed: Figure 4 Steps shown:

[0168] In step 401, based on the attack events in the attack source, the attack targets are extracted, and the attack target threat scores of the attack source are set to initial values.

[0169] In a possible implementation, an attack source may attack multiple attack targets, and multiple attack events may target one attack target. Therefore, the embodiment of the present application can obtain the attack events in the attack source and the attack target identifier corresponding to each attack event in the attack source; based on the attack target identifier corresponding to each attack event in the attack source, extract multiple attack targets corresponding to the attack event in the attack source, and the number of attack events included in each attack target. At the same time, the attack target threat score of the attack source can be set to an initial value. Among them, the initial value can be zero, or it can be the attack target threat score of the attack source calculated in the previous first specified period.

[0170] Exemplarily, the attack target is identified as the attack target IP. After classifying and counting the multiple attack events included in each attack source according to the attack target IP, there will be multiple attack targets, and each attack target includes corresponding multiple attack events. Then, the corresponding attack target threat score is calculated for each attack target using the attacker threat scoring method provided in this application.

[0171] In the embodiment of the present application, it is necessary to calculate the attack target threat scores for the multiple attack targets in the attack source respectively, and then determine the attack target threat score of the attack source based on the attack target threat scores of all attack targets. Therefore, it is necessary to determine whether the attack target traversal is completed in step 402. If completed, the determination process of the attack target threat score of the attack source is ended in step 406. If not completed, step 403 is executed.

[0172] In step 403, based on the number of attack chain stages, attack directionality, and asset status of the attack target, an attack target threat score of the attack target is determined.

[0173] In a possible implementation, the embodiment of the present application determines the attack target threat score of the attack target based on the number of attack chain stages, attack directionality, and asset status of the attack target. Specifically, the following may be performed: Figure 5 Steps shown:

[0174] In step 501, based on the number of attack chain stages included in the event against the attack target, the attack chain coverage threat score of the attack target is determined.

[0175] In one possible implementation, the attack chain can be defined using a seven-level attack chain. The associated attack chain stage needs to be defined in the attributes of the event. In the embodiment of the present application, the number of attack chain stages and the attack chain coverage threat score of the corresponding attack target can be first given, as shown in Table 3. Then, the number of attack chain stages can be obtained according to the attack chain stages distributed among all attack events against the attack target, and the corresponding attack chain coverage threat score can be found in Table 3 to obtain the attack chain coverage threat score of the corresponding attack target.

[0176] Table 3

[0177] Number of attack chain stages Single stage Two stages Three stages and above Attack Chain Coverage Threat Score 1 3 5

[0178] In step 502, based on the number of attack events against the attack target and the number of attack events against the attack source, a ratio of the number of attack events against the attack target to the number of attack events against the attack source is determined.

[0179] In one possible implementation, the embodiment of the present application uses the number of attack events against the attack target extracted in step 401 divided by the number of attack events of the attack source extracted in step 101 to obtain the ratio of the number of attack events against the attack target to the number of attack events against the attack source.

[0180] In step 503, based on the ratio of the number of attack events against the attack target to the number of attack events against the attack source, the attack event pointing threat score of the attack target is determined.

[0181] In a possible implementation manner, in an embodiment of the present application, a value range of the ratio of the number of attack events against the attack target to the number of attack events against the attack source and its corresponding attack event pointing threat score of the attack target can be first given, as shown in Table 4, and then the value range satisfied by the ratio of the number of attack events against the attack target to the number of attack events against the attack source can be determined, and the attack event pointing threat score of the corresponding attack target can be found in Table 4 to obtain the attack event pointing threat score of the corresponding attack target.

[0182] Table 4

[0183]

[0184] In step 504, the attack chain coverage threat score and the attack event pointing threat score are weighted and summed to determine the attack intention threat score of the attack target.

[0185] For example, S IN =β1*S td +β2*S tk Calculate the attack intention threat score of the attack target, where S IN S is the threat score of the attack intention of the attack target, with a value range of [1,5]. td is the attack event threat score obtained in step 503, S tkis the attack chain coverage threat score obtained in step 501. β1+β2=1, β1 and β2 are weighting coefficients, which can be determined according to empirical values, for example, β1=0.5, β2=0.5, or can be set according to actual usage, which is not limited in the embodiment of the present application.

[0186] In step 505, based on the asset status of the attack target, the asset status threat score of the attack target is determined; wherein the asset status of the attack target includes the compromise status, vulnerability value and asset value score of the attack target.

[0187] In a possible implementation, in the embodiment of the present application, the asset value of the attack target and the corresponding asset value score can be first given, as shown in Table 5, and the asset status of the attack target and the corresponding asset status threat score of the attack target can be given at the same time, as shown in Table 6. Then, the corresponding asset value score can be found in Table 5 according to the asset value of the attack target, and then the corresponding asset status threat score of the attack target can be found in Table 6 in combination with the loss status and vulnerability value of the attack target to obtain the corresponding asset status threat score of the attack target.

[0188] Table 5

[0189] The value of the target's assets secondary ordinary important key core Asset Value Rating 1 2 3 4 5

[0190] Table 6

[0191]

[0192] Among them, when the attack target has been lost, the asset status threat score of the attack target is 5. When the attack target has not been lost, it is calculated by the vulnerability value of the attack target. When the system has no access to vulnerability information, it can be calculated by the asset value of the attack target. The vulnerability score of the attack target is mainly calculated by the asset value of the attack target and the vulnerability information of the attack target. The vulnerability information includes: vulnerabilities, weak passwords, non-compliant items, etc. The specific calculation process of the vulnerability score of the attack target is not limited in the embodiment of this application.

[0193] In step 506, the attack intention threat score and the asset status threat score are weighted and summed to determine the attack target threat score of the attack target.

[0194] For example, S stt =γ1*S IN +γ2*S as Calculate the attack target threat score of the attack target, where S stt is the attack target threat score of the attack target, with a value range of (0,5], S IN is the attack intention threat score of the attack target obtained in step 504, Sas is the asset status threat score obtained in step 505. Wherein γ1+γ2=1, γ1 and γ2 are weighting coefficients, which can be determined according to empirical values, for example, γ1=0.7, γ2=0.3, or can be set according to actual usage, which is not limited in the embodiment of the present application.

[0195] An attack source includes multiple attack targets. Therefore, in the embodiment of the present application, the attack target threat score with the highest attack target threat score among all attack targets is used as the attack target threat score of the attack source. Therefore, in step 404, it is determined whether the attack target threat score of the attack source is less than the attack target threat score of the attack target. If the attack target threat score of the attack source is less than the attack target threat score of the attack target, then in step 405, the attack target threat score of the attack source is set to the attack target threat score of the attack target, and then step 402 is executed; if the attack target threat score of the attack source is greater than or equal to the attack target threat score of the attack target, the attack target threat score of the attack source remains unchanged, and step 402 is directly executed.

[0196] Therefore, if the attack target threat score of the attack target is greater than the attack target threat score of the attack source, the attack target threat score of the attack target is assigned to the attack target threat score of the attack source; if the attack target threat score of the attack target is less than or equal to the attack target threat score of the attack source, the attack target threat score of the attack source remains unchanged, until all attack targets are traversed, and the attack target threat score of the attack source is finally determined.

[0197] In step 302, based on the attack chain stage level, the number of attack events, the threat level of the attack events, the confidence of the attack events and the attack results, the attack means threat score of the attack source is determined.

[0198] In a possible implementation, the embodiment of the present application determines the attack means threat score of the attack source based on the attack chain stage level, the number of attack events, the threat level of the attack event, the confidence of the attack event and the attack result. Specifically, the following can be performed: Figure 6 Steps shown:

[0199] In step 601, based on the highest attack chain stage level of the attack source, an attack chain stage threat score of the attack source is determined.

[0200] In a possible implementation, in an embodiment of the present application, the attack chain stage level and the corresponding attack chain stage threat score can be first given, as shown in Table 7, and then the highest attack chain stage level of the attack source can be obtained according to the attack chain stage of all attack events in the attack source, and the corresponding attack chain stage threat score can be found in Table 7 to obtain the attack chain stage threat score of the corresponding attack source.

[0201] Table 7

[0202]

[0203] In step 602, an attack event quantity threat score of an attack source is determined based on the attack event quantity.

[0204] In a possible implementation manner, the embodiment of the present application determines the attack event quantity threat score of the attack source based on the number of attack events, which can be specifically performed as follows: Figure 7 Steps shown:

[0205] In step 701, based on the number of attack events of the attack source and the number of attack events in a first specified period, a ratio of the number of attack events of the attack source to the number of attack events in the first specified period is determined.

[0206] In a possible implementation, the embodiment of the present application uses the number of attack events of the attack source extracted in step 101 divided by the number of attack events in the first specified period to obtain the ratio of the number of attack events of the attack source to the number of attack events in the first specified period.

[0207] In step 702, based on the ratio of the number of attack events of the attack source to the number of attack events in the first specified period, the attack event ratio threat score of the attack source is determined.

[0208] In a possible implementation manner, in an embodiment of the present application, a value range of the ratio of the number of attack events of the attack source to the number of attack events in the first specified period and its corresponding attack event proportion threat score can be first given, as shown in Table 8, and then the value range satisfied by the ratio of the number of attack events of the attack source to the number of attack events in the first specified period can be determined, and the corresponding attack event proportion threat score can be searched in Table 8 to obtain the attack event proportion threat score of the corresponding attack source.

[0209] Table 8

[0210]

[0211] In step 703, based on the number of attack events of the attack source, a threat score of the total number of attack events of the attack source is determined.

[0212] In a possible implementation, in an embodiment of the present application, a value range of the number of attack events of the attack source and a corresponding threat score of the total number of attack events can be first given, as shown in Table 9, and then the value range satisfied by the number of attack events of the attack source extracted in step 101 can be determined, and the corresponding threat score of the total number of attack events can be found in Table 9 to obtain the threat score of the total number of attack events of the corresponding attack source.

[0213] Table 9

[0214] Number of attack events by attack source Greater than 128 Greater than 64 Greater than 32 Greater than 16 other Total number of attack events Threat score 5 4 3 2 1

[0215] In step 704, the threat score of the attack event ratio and the threat score of the total number of attack events are weighted and summed to determine the threat score of the number of attack events of the attack source.

[0216] For example, S nc =δ1*S er +δ2*S en Calculate the threat score of the attack source, where S nc S is the threat score of the number of attack events of the attack source, with a value range of [1,5]. er is the attack event proportion threat score obtained in step 702, S en is the threat score of the total number of attack events obtained in step 703. Wherein δ1+δ2=1, δ1 and δ2 are weighting coefficients, which can be determined according to empirical values, for example, δ1=0.7, δ2=0.3, or can be set according to actual usage, which is not limited in the embodiment of the present application.

[0217] In step 603, based on the attack event threat level, the confidence of the attack event and the attack result, a threat score of the attack event threat level of the attack source is determined.

[0218] In a possible implementation, the embodiment of the present application determines the threat score of the attack event threat level of the attack source based on the threat level of the attack event, the confidence of the attack event, and the attack result. Specifically, the following steps can be performed: Figure 8 Steps shown:

[0219] In step 801, based on the highest attack event threat level of attack events with attack results of successful attacks and the average confidence score of attack events with attack results of successful attacks and the highest attack event threat level, the attack success event threat score of the attack source is determined.

[0220] In a possible implementation manner, in the embodiment of the present application, the attack event threat level and its corresponding attack event threat level benchmark score can be first given, as shown in Table 10, and the confidence level of the attack event and its corresponding confidence score can be given, as shown in Table 11, and then the corresponding attack event threat level benchmark score can be found in Table 10 according to the highest attack event threat level of the attack event whose attack result is a successful attack, and the confidence score of each attack event whose attack result is a successful attack and the highest attack event threat level can be found in Table 11, and then the average confidence score of all attack events whose attack results are successful attacks and the highest attack event threat level is calculated, and the attack event threat level benchmark score of the highest attack event threat level of the attack event whose attack result is a successful attack is added to the average confidence score of all attack events whose attack results are successful attacks and the highest attack event threat level, to obtain the attack success event threat score of the attack source.

[0221] Table 10

[0222] Threat Level of Attack slight generally Larger major Particularly important Attack incident threat level benchmark score 0 1 2 3 4

[0223] Table 11

[0224] Confidence level Low confidence Confidence High confidence Confidence score 0.1 0.5 1

[0225] For example, if there are 10 successful attack events in the attack source, of which the threat level of 2 attack events is general, the threat level of 5 attack events is large, and the threat level of 3 attack events is major, then the highest attack event threat level of the successful attack events is major, and the corresponding attack event threat level benchmark score is 3 found in Table 10; the confidence levels of these 3 attack events are medium, medium, and high, respectively, and the confidence scores of these 3 attack events are 0.5, 0.5, and 1 found in Table 11, respectively, and the average confidence score of these 3 attack events is calculated to be 2 / 3, then the threat score of the successful attack event of the attack source is the attack event threat level benchmark score plus the average confidence score of the 3 attack events, that is, 3+(2 / 3).

[0226] In step 802, the attack event threat score of the attack source is determined based on the highest attack event threat level of the attack events in the attack source and the average confidence score of the attack events with the highest attack event threat level.

[0227] In a possible implementation manner, in the embodiment of the present application, the corresponding attack event threat level benchmark score can be found in Table 10 based on the highest attack event threat level of all attack events in the attack source, and the confidence score of each attack event with the highest attack event threat level can be found in Table 11, and then the average confidence score of all attack events with the highest attack event threat level is calculated, and the attack event threat level benchmark score of the highest attack event threat level of the attack event is added to the average confidence score of all attack events with the highest attack event threat level to obtain the attack event threat score of the attack source.

[0228] For example, if there are 10 attack events in the attack source, of which the threat level of 2 attack events is general, the threat level of 5 attack events is large, and the threat level of 3 attack events is major, then the highest attack event threat level of the attack events in the attack source is major, and the corresponding attack event threat level benchmark score is 3 found in Table 10; the confidence levels of these 3 attack events are medium, medium, and high, respectively, and the confidence scores of these 3 attack events are 0.1, 0.5, and 1, respectively, and the average confidence score of these 3 attack events is calculated to be 1.6 / 3, then the attack event threat score of the attack source is the attack event threat level benchmark score plus the average confidence score of these 3 attack events, that is, 3+(1.6 / 3).

[0229] In step 803, the threat score of the attack success event and the threat score of the attack event are weighted and summed to determine the threat score of the attack event threat level of the attack source.

[0230] For example, S et =ε1*S set +ε2*S tet Calculate the threat level of the attack source, where S et is the threat level score of the attack source, with a value range of (0,5], S set is the threat score of the attack success event of the attack source obtained in step 801, S tet is the attack event threat score of the attack source obtained in step 802. Wherein ε1+ε2=1, ε1 and ε2 are weighting coefficients, which can be determined according to empirical values, for example, ε1=0.5, ε2=0.5, or can be set according to actual usage, which is not limited in the embodiment of the present application.

[0231] In step 604, the threat score of the attack chain stage, the threat score of the number of attack events, and the threat score of the threat degree of the attack events are weighted and summed to determine the threat score of the attack means of the attack source.

[0232] For example, S m=θ1*S kcs +θ2*S et +θ3*S nc Calculate the threat score of the attack source, where S m is the threat score of the attack source, with a value range of (0,5], S kcs is the attack chain stage threat score obtained in step 601, S et is the threat level score of the attack event of the attack source obtained in step 803, S nc is the threat score of the number of attack events of the attack source obtained in step 704. Wherein θ1+θ2+θ3=1, θ1, θ2 and θ3 are weighting coefficients, which can be determined according to empirical values, for example, θ1=1 / 3, θ2=1 / 3, θ3=1 / 3, or can be set according to actual usage, which is not limited in the embodiment of the present application.

[0233] In step 303, the attack target threat score and the attack means threat score are weighted and summed to determine the attack information threat score of the attack source.

[0234] For example, S ai =μ1*S tt +μ2*S m Calculate the attack information threat score of the attack source, where S ai is the attack information threat score of the attack source, with a value range of (0,5], S tt For passing Figure 4 The attack target threat score of the attack source obtained in the steps shown, S m is the attack means threat score of the attack source obtained in step 803. Wherein μ1+μ2=1, μ1 and μ2 are weighting coefficients, which can be determined according to empirical values, for example, μ1=0.5, μ2=0.5, or can be set according to actual usage, which is not limited in the embodiment of the present application.

[0235] Therefore, by conducting a comprehensive evaluation based on information from multiple dimensions, the attacker threat score of the attack source can be determined, which can improve the accuracy of the attacker threat score.

[0236] In step 106, an attacker threat score of the attack source is determined based on the prior knowledge threat score and the attack information threat score.

[0237] In a possible implementation, the embodiment of the present application determines the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score, which can be specifically performed as follows: Fig. 9 Steps shown:

[0238] In step 901, it is determined whether there is prior knowledge; if there is prior knowledge, then in step 902, the prior knowledge threat score and the attack information threat score are weighted and summed to determine the attacker threat score of the attack source in the first specified period, and then step 904 is executed; if there is no prior knowledge, then in step 903, the attacker threat score of the attack source in the first specified period is set to the attack information threat score, and then step 904 is executed.

[0239] Exemplarily, the prior knowledge threat score and the attack information threat score are weighted and summed to determine the attacker threat score of the attack source in the first specified period, which can be calculated using T s =σ1*S kn +σ2*S ai Calculate the attack information threat score of the attack source in the first specified period, where T s is the attack information threat score of the attack source in the first specified period, with a value range of (0,5], S kn is the prior knowledge threat score of the attack source obtained in step 205, S ai is the attack information threat score of the attack source obtained in step 303. Wherein σ1+σ2=1, σ1 and σ2 are weighting coefficients, which can be determined according to empirical values, for example, σ1=0.2, σ2=0.8, or can be set according to actual usage, which is not limited in the embodiment of the present application.

[0240] In step 904, the attacker threat score of the attack source of a specified number of second specified periods is weightedly summed to determine the attacker threat score of the attack source; wherein the second specified period includes multiple first specified periods; wherein the attacker threat score of the attack source of the last first specified period in the second specified period is used as the attacker threat score of the attack source of the second specified period.

[0241] For example, you can use Calculate the attacker threat score of the attack source, where n represents the nth second specified period; i represents the i-th second specified period; T n Indicates the attacker threat score of the attack source, with a value range of (0,5]; T di represents the attacker threat score of the attack source in the i-th second specified period; where T d Indicates the last attacker threat score T of the attack source in the first specified period obtained by using step 902 or step 903 in the second specified period s. For example, if n is set to 7 days, the second specified period can be expressed as 1 day, and the first specified period can be expressed as 1 hour, so there are 7 second specified periods in total, and one second specified period includes 24 first specified periods. In step 902 or step 903, the attacker threat score of the attack source for each hour is calculated. The attacker threat score of the attack source calculated in the last hour of each day is used as the attacker threat score of the attack source for that day. If the calculation is only up to the 5th hour on that day, the attacker threat score of the attack source in the fifth hour is used as the attacker threat score of the attack source for that day. Then use Calculates the attacker threat score of the attack source for the past 7 days.

[0242] In step 905, the determination of the attacker threat score of the attack source ends.

[0243] Thus, the attacker threat score of the first specified period is calculated by prior knowledge information and attack information, and the attacker threat score of the second specified period is obtained by using the attacker threat score of the first specified period, and then the attacker threat score of multiple second specified periods is weighted to obtain the attacker threat score of the attack source.

[0244] Based on the description above, the present application discloses an attacker threat scoring method, which determines the intelligence threat score of the attack source by the intelligence type of the attack event hit based on the attack source; and determines the honeypot threat score of the attack source based on the attack event of the attack source hitting the attacker warning information provided by the honeypot; determines the prior knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score; then determines the attack information threat score of the attack source based on the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, the attack directionality and other dimensional information, and finally determines the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score. The present application conducts a comprehensive evaluation through multiple dimensional information, so that the attacker threat score of the attack source can be accurately evaluated from more dimensions, and the accuracy of the attacker threat score can be improved. Using the generated attacker threat score, many attackers can be prioritized and high-threat attackers can be determined, so that users can quickly discover high-threat sources and quickly dispose of high-threat sources through security protection tools, thereby improving security protection capabilities.

[0245] like Fig.10As shown, based on the same inventive concept as the above-mentioned attacker threat scoring method, the embodiment of the present application also provides an attacker threat scoring device, including: an attack source extraction module 1001, an intelligence threat score determination module 1002, a honeypot threat score determination module 1003, a priori knowledge threat score determination module 1004, an attack information threat score determination module 1005, and an attacker threat score determination module 1006, wherein:

[0246] An attack source extraction module 1001, configured to extract an attack source based on attack events in a first specified period;

[0247] An intelligence threat score determination module 1002, configured to determine an intelligence threat score of the attack source based on the intelligence type hit by the attack event of the attack source; and

[0248] A honeypot threat score determination module 1003 is used to determine the honeypot threat score of the attack source based on the hit situation of the attack event of the attack source on the attacker warning information provided by the honeypot;

[0249] A priori knowledge threat score determination module 1004, configured to determine the priori knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score;

[0250] The attack information threat score determination module 1005 is used to determine the attack information threat score of the attack source based on multi-dimensional information, wherein the multi-dimensional information includes at least two of the following: the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, and the attack directionality, wherein the attack directionality has a positive correlation with the number of attack events against the attack target;

[0251] The attacker threat score determination module 1006 is configured to determine the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score.

[0252] In a possible implementation, the determination of the prior knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score is performed, and the prior knowledge threat score determination module 1004 is specifically used to:

[0253] The intelligence threat score and the honeypot threat score are weighted and summed to determine the prior knowledge threat score of the attack source.

[0254] In a possible implementation manner, the attack information threat score of the attack source is determined based on the multi-dimensional information, and the attack information threat score determination module 1005 specifically includes:

[0255] an attack target threat score determination unit, configured to determine an attack target threat score of the attack source based on the number of attack chain stages, the attack directionality, and the asset status of the attack target;

[0256] an attack means threat score determination unit, configured to determine the attack means threat score of the attack source based on the attack chain stage level, the number of attack events, the attack event threat level, the confidence level of the attack event, and the attack result;

[0257] The attack information threat score determination unit is used to perform a weighted summation of the attack target threat score and the attack means threat score to determine the attack information threat score of the attack source.

[0258] In a possible implementation, the step of determining the attack target threat score of the attack source based on the number of attack chain stages, the attack directionality, and the asset status of the attack target is performed, and the attack target threat score determination unit is specifically configured to:

[0259] Extracting attack targets based on attack events in the attack source, and setting the threat score of the attack target of the attack source to an initial value;

[0260] Determining an attack target threat score of the attack target based on the number of attack chain stages, the attack directionality, and the asset status of the attack target;

[0261] If the attack target threat score of the attack source is less than the attack target threat score of the attack target, then the attack target threat score of the attack source is set to the attack target threat score of the attack target;

[0262] If the attack target threat score of the attack source is greater than or equal to the attack target threat score of the attack target, the attack target threat score of the attack source remains unchanged.

[0263] In a possible implementation, the step of determining the attack target threat score of the attack target based on the number of attack chain stages, the attack directionality, and the asset status of the attack target is performed, and the attack target threat score determination unit is specifically configured to:

[0264] Determining an attack chain coverage threat score of the attack target based on the number of attack chain stages included in the event against the attack target;

[0265] Determining a ratio of the number of attack events against the attack target to the number of attack events at the attack source based on the number of attack events against the attack target and the number of attack events at the attack source;

[0266] Determining a threat score of the attack events directed to the attack target based on a ratio of the number of attack events directed to the attack target to the number of attack events of the attack source;

[0267] The attack chain coverage threat score and the attack event pointing threat score are weighted and summed to determine the attack intention threat score of the attack target;

[0268] Based on the asset status of the attack target, determine the asset status threat score of the attack target; wherein the asset status of the attack target includes the compromise status, vulnerability value and asset value score of the attack target;

[0269] The attack intention threat score and the asset status threat score are weighted and summed to determine the attack target threat score of the attack target.

[0270] In a possible implementation, the step of determining the attack means threat score of the attack source based on the attack chain stage level, the number of attack events, the threat level of the attack event, the confidence of the attack event, and the attack result is performed, and the attack means threat score determination unit is specifically used to:

[0271] Determining an attack chain stage threat score of the attack source based on the highest attack chain stage level of the attack source;

[0272] Determine a threat score of the number of attack events of the attack source based on the number of attack events;

[0273] Determining a threat score of the attack event threat level of the attack source based on the threat level of the attack event, the confidence of the attack event and the attack result;

[0274] The attack means threat score of the attack source is determined by weighted summing the attack chain stage threat score, the attack event quantity threat score and the attack event threat degree threat score.

[0275] In a possible implementation manner, the determining of the attack event quantity threat score of the attack source based on the attack event quantity is performed, and the attack means threat score determining unit is specifically configured to:

[0276] Determine, based on the number of attack events of the attack source and the number of attack events in the first specified period, a ratio of the number of attack events of the attack source to the number of attack events in the first specified period;

[0277] Determining a threat score of the attack event ratio of the attack source based on a ratio of the number of attack events of the attack source to the number of attack events in the first specified period;

[0278] Determine a threat score for the total number of attack events of the attack source based on the number of attack events of the attack source;

[0279] The threat score of the attack event proportion and the threat score of the total number of attack events are weighted and summed to determine the threat score of the number of attack events of the attack source.

[0280] In a possible implementation, the step of determining the threat score of the attack event threat level of the attack source based on the threat level of the attack event, the confidence of the attack event, and the attack result, the attack means threat score determination unit is specifically configured to:

[0281] Determine the attack success event threat score of the attack source based on the highest attack event threat level of the attack events whose attack results are successful attacks and the average confidence score of the attack events whose attack results are successful attacks and whose attack event threat levels are the highest;

[0282] Determine the attack event threat score of the attack source based on the highest attack event threat level of the attack events in the attack source and the average confidence score of the attack events with the highest attack event threat level;

[0283] The threat score of the attack success event and the threat score of the attack event are weighted and summed to determine the threat score of the attack event threat level of the attack source.

[0284] In a possible implementation, the attacker threat score of the attack source is determined based on the prior knowledge threat score and the attack information threat score. The attacker threat score determination module 1006 is specifically configured to:

[0285] If there is prior knowledge, a weighted sum of the prior knowledge threat score and the attack information threat score is taken to determine the attacker threat score of the attack source in the first specified period;

[0286] If there is no prior knowledge, setting the attacker threat score of the attack source in the first specified period as the attack information threat score;

[0287] The attacker threat score of the attack source of a specified number of second specified periods is weightedly summed to determine the attacker threat score of the attack source; wherein the second specified period includes multiple first specified periods; wherein the attacker threat score of the attack source of the last of the first specified periods in the second specified period is used as the attacker threat score of the attack source of the second specified period.

[0288] In a possible implementation manner, the attack source is extracted based on the attack events in the first specified period, and the attack source extraction module 1001 is specifically configured to:

[0289] Acquire attack events in the first specified period and attack source identifiers corresponding to each attack event in the first specified period;

[0290] Based on the attack source identifier corresponding to each attack event in the first specified period, multiple attack sources corresponding to the attack event in the first specified period and the number of attack events included in each attack source are extracted.

[0291] In a possible implementation manner, the step of extracting the attack target based on the attack event in the attack source, the attack target threat score determination unit is specifically configured to:

[0292] Acquire attack events in the attack source and attack target identifiers corresponding to each attack event in the attack source;

[0293] Based on the attack target identifier corresponding to each attack event in the attack source, multiple attack targets corresponding to the attack event in the attack source and the number of attack events included in each attack target are extracted.

[0294] The attacker threat scoring device provided in the embodiment of the present application adopts the same inventive concept as the above-mentioned attacker threat scoring method and can achieve the same beneficial effects, which will not be described in detail here.

[0295] Based on the same inventive concept as the above attacker threat scoring method, the present application embodiment also provides an electronic device. Fig.11 The electronic device 110 according to this embodiment of the present application is described. Fig.11 The electronic device 110 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0296] like Fig.11 As shown, the electronic device 110 is in the form of a general electronic device. The components of the electronic device 110 may include but are not limited to: the at least one processor 111, the at least one memory 112, and a bus 113 connecting different system components (including the memory 112 and the processor 111).

[0297] Bus 113 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0298] The memory 112 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1121 and / or a cache memory 1122 , and may further include a read-only memory (ROM) 1123 .

[0299] Memory 112 may also include a program / utility 1125 having a set (at least one) of program modules 1124, such program modules 1124 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0300] The electronic device 110 may also communicate with one or more external devices 114 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 110, and / or may communicate with any device that enables the electronic device 110 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 115. Furthermore, the electronic device 110 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 116. As shown, the network adapter 116 communicates with other modules for the electronic device 110 via a bus 113. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 110, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0301] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 112 including instructions, and the instructions can be executed by the processor 111 to complete the above attacker threat score. Optionally, the storage medium can be a non-transitory computer-readable storage medium, for example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a tape, a floppy disk, an optical data storage device, etc.

[0302] In an exemplary embodiment, a computer program product is further provided, including a computer program, and when the computer program is executed by the processor 111, any method of the attacker threat scoring method provided in the present application is implemented.

[0303] In an exemplary embodiment, various aspects of an attacker threat scoring method provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of the attacker threat scoring method according to various exemplary embodiments of the present application described above in this specification.

[0304] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0305] The program product for the attacker threat scoring method of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on an electronic device. However, the program product of the present application is not limited to this. In this document, the readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0306] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein readable program code is carried. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0307] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0308] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or entirely on the remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0309] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0310] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0311] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0312] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable image scaling device to produce a machine, so that the instructions executed by the processor of the computer or other programmable image scaling device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0313] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable image scaling device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, the instruction device being implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0314] These computer program instructions may also be loaded onto a computer or other programmable image scaling device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0315] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0316] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for scoring an attacker's threat, characterized in that: The method comprises: Extracting attack sources based on attack events in a first specified period; Determining an intelligence threat score of the attack source based on the intelligence type hit by the attack event of the attack source; and Determine the honeypot threat score of the attack source based on the hit status of the attack event of the attack source on the attacker warning information provided by the honeypot; Determining a priori knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score; Determine the attack information threat score of the attack source based on the multi-dimensional information, wherein the multi-dimensional information includes at least two of the following: the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, and the attack directionality, wherein the attack directionality has a positive correlation with the number of attack events against the attack target; An attacker threat score of the attack source is determined based on the prior knowledge threat score and the attack information threat score.

2. The method according to claim 1, characterized in that The determining the prior knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score specifically includes: The intelligence threat score and the honeypot threat score are weighted and summed to determine the prior knowledge threat score of the attack source.

3. The method according to claim 1, characterized in that Determining the attack information threat score of the attack source based on the multi-dimensional information specifically includes: Determining an attack target threat score of the attack source based on the number of attack chain stages, the attack directionality, and the asset status of the attack target; Determine the attack means threat score of the attack source based on the attack chain stage level, the number of attack events, the threat level of the attack events, the confidence of the attack events and the attack result; The attack target threat score and the attack means threat score are weighted and summed to determine the attack information threat score of the attack source.

4. The method according to claim 3, characterized in that Determining the attack target threat score of the attack source based on the number of attack chain stages, the attack directionality, and the asset status of the attack target specifically includes: Extracting attack targets based on attack events in the attack source, and setting the threat score of the attack target of the attack source to an initial value; Determining an attack target threat score of the attack target based on the number of attack chain stages, the attack directionality, and the asset status of the attack target; If the attack target threat score of the attack source is less than the attack target threat score of the attack target, then the attack target threat score of the attack source is set to the attack target threat score of the attack target; If the attack target threat score of the attack source is greater than or equal to the attack target threat score of the attack target, the attack target threat score of the attack source remains unchanged.

5. The method according to claim 4, characterized in that Determining the attack target threat score of the attack target based on the number of attack chain stages, the attack directionality, and the asset status of the attack target specifically includes: Determining an attack chain coverage threat score of the attack target based on the number of attack chain stages included in the event against the attack target; Determining a ratio of the number of attack events against the attack target to the number of attack events at the attack source based on the number of attack events against the attack target and the number of attack events at the attack source; Determining a threat score of the attack events directed to the attack target based on a ratio of the number of attack events directed to the attack target to the number of attack events of the attack source; The attack chain coverage threat score and the attack event pointing threat score are weighted and summed to determine the attack intention threat score of the attack target; Based on the asset status of the attack target, determine the asset status threat score of the attack target; wherein the asset status of the attack target includes the compromise status, vulnerability value and asset value score of the attack target; The attack intention threat score and the asset status threat score are weighted and summed to determine the attack target threat score of the attack target.

6. The method according to claim 3, characterized in that Determining the attack means threat score of the attack source based on the attack chain stage level, the number of attack events, the threat level of the attack events, the confidence of the attack events and the attack results specifically includes: Determining an attack chain stage threat score of the attack source based on the highest attack chain stage level of the attack source; Determine a threat score of the number of attack events of the attack source based on the number of attack events; Determining a threat score of the attack event threat level of the attack source based on the threat level of the attack event, the confidence of the attack event and the attack result; The attack means threat score of the attack source is determined by weighted summing the attack chain stage threat score, the attack event quantity threat score and the attack event threat degree threat score.

7. The method according to claim 6, characterized in that Determining the attack event quantity threat score of the attack source based on the attack event quantity specifically includes: Determine, based on the number of attack events of the attack source and the number of attack events in the first specified period, a ratio of the number of attack events of the attack source to the number of attack events in the first specified period; Determining a threat score of the attack event ratio of the attack source based on a ratio of the number of attack events of the attack source to the number of attack events in the first specified period; Determine a threat score for the total number of attack events of the attack source based on the number of attack events of the attack source; The threat score of the number of attack events of the attack source is determined by weighted summing the threat score of the attack event proportion and the threat score of the total number of attack events.

8. The method according to claim 6, characterized in that The determining of the threat score of the attack event threat level of the attack source based on the threat level of the attack event, the confidence of the attack event and the attack result specifically includes: Determine the attack success event threat score of the attack source based on the highest attack event threat level of the attack events whose attack results are successful attacks and the average confidence score of the attack events whose attack results are successful attacks and whose attack event threat levels are the highest; Determine the attack event threat score of the attack source based on the highest attack event threat level of the attack events in the attack source and the average confidence score of the attack events with the highest attack event threat level; The threat score of the attack success event and the threat score of the attack event are weighted and summed to determine the threat score of the attack event threat level of the attack source.

9. The method according to claim 1, characterized in that: The determining the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score specifically includes: If there is prior knowledge, a weighted sum of the prior knowledge threat score and the attack information threat score is taken to determine the attacker threat score of the attack source in the first specified period; If there is no prior knowledge, setting the attacker threat score of the attack source in the first specified period as the attack information threat score; The attacker threat score of the attack source of a specified number of second specified periods is weightedly summed to determine the attacker threat score of the attack source; wherein the second specified period includes multiple first specified periods; wherein the attacker threat score of the attack source of the last of the first specified periods in the second specified period is used as the attacker threat score of the attack source of the second specified period.

10. The method according to claim 1, characterized in that The extracting the attack source based on the attack events in the first specified period specifically includes: Acquire attack events in the first specified period and attack source identifiers corresponding to each attack event in the first specified period; Based on the attack source identifier corresponding to each attack event in the first specified period, multiple attack sources corresponding to the attack event in the first specified period and the number of attack events included in each attack source are extracted.

11. The method according to claim 4, characterized in that The extracting the attack target based on the attack event in the attack source specifically includes: Acquire attack events in the attack source and attack target identifiers corresponding to each attack event in the attack source; Based on the attack target identifier corresponding to each attack event in the attack source, multiple attack targets corresponding to the attack event in the attack source and the number of attack events included in each attack target are extracted.

12. An attacker threat scoring device, characterized in that: The device comprises: An attack source extraction module, used to extract an attack source based on attack events in a first specified period; an intelligence threat score determination module, configured to determine the intelligence threat score of the attack source based on the intelligence type hit by the attack event of the attack source; and A honeypot threat score determination module, configured to determine a honeypot threat score of the attack source based on a hit condition of the attack event of the attack source on the attacker warning information provided by the honeypot; A priori knowledge threat score determination module, used to determine the priori knowledge threat score of the attack source based on the intelligence threat score and the honeypot threat score; an attack information threat score determination module, configured to determine the attack information threat score of the attack source based on multi-dimensional information, wherein the multi-dimensional information includes at least two of the following: the number of attack events, the number of attack chain stages, the attack chain stage level, the attack event threat level, the confidence of the attack event, the attack result, the asset status of the attack target, and the attack directivity, wherein the attack directivity has a positive correlation with the number of attack events against the attack target; The attacker threat score determination module is used to determine the attacker threat score of the attack source based on the prior knowledge threat score and the attack information threat score.

13. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the attacker threat scoring method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the attacker threat scoring method according to any one of claims 1 to 11.

Images