A network attack tracing analysis method and system based on timeline

The timeline-based network attack tracing method and system efficiently reconstructs attack paths and identifies attacker profiles by analyzing file system information and event logs, addressing the inefficiencies of current methods and improving network security measures.

CN114969739BActive Publication Date: 2025-03-28北京中睿天下信息技术有限公司
1 Cites 0 Cited by

Patent Information

Application Number
CN202210617864.2
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2022-06-01
Publication Date
2025-03-28
Estimated Expiration
2042-06-01

AI Technical Summary

Technical Problem

Current methods for network attack tracing and attribution are inefficient and lack the ability to reconstruct hacker paths, relying on manual analysis that is time-consuming and lacks intelligence, failing to effectively track and counter network threats.

Method used

A timeline-based network attack tracing method and system that collects and analyzes file system information and Windows event logs to reconstruct attack paths and identify attacker profiles by correlating file creation times, names, paths, and attributes, adjusting time segments as needed to derive attack clues.

Benefits of technology

Enables precise attribution of network attacks by reconstructing attack paths and creating comprehensive attacker profiles, enhancing the efficiency and intelligence of network security measures.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The present application discloses a network attack source tracing analysis method and system based on timeline. The method first obtains the file system related information of the attacking user; then reads the windows event log related data of the host device to obtain the suspicious period of the network attack, and determines the file system related information in the suspicious period as the suspicious file related information; finally, the suspicious file related information associated with the suspicious period is analyzed to obtain the attacker's attack path clues. The tracing technology based on the advantages of the timeline of the present invention can locate and trace back the attacker's operations within a specific time period, connect the attacker's attack clues through time, and comprehensively trace the security incidents, helping the security team to understand the attacker's intentions and take appropriate countermeasures.
Need to check novelty before this filing date? Find Prior Art