A comprehensive analysis method and system for threat warning information based on kill chain

Abstract

The present invention discloses a comprehensive analysis method and system of threat warning information based on kill chain, which relates to the field of data processing technology. The method includes: obtaining threat warning information, and performing data cleaning to obtain warning information to be extracted; performing threat behavior extraction to obtain a threat behavior set; obtaining a threat log set, and performing multi-dimensional feature extraction on the threat log set to obtain a threat log feature set; determining the killing stage to obtain an identified threat behavior set; constructing a kill chain model, performing threat behavior analysis, and obtaining multiple threat behavior chains; performing differentiated maintenance on the target network based on multiple threat behavior chains. The present invention solves the technical problems in the prior art that threat warning information is complicated, the utilization rate is low, and a reliable basis for network maintenance cannot be provided, and achieves the technical effect of improving the quality of warning information analysis and the effectiveness of network maintenance.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a kill chain-based threat warning information comprehensive analysis method and system. Background Art

[0002] With the continuous development of information technology, the network environment is becoming increasingly complex, and higher requirements are placed on network security. When the network is threatened, an alarm message will be generated. However, the alarm message is in a massive amount of data, which is not only numerous, but also the validity of the information cannot be guaranteed.

[0003] At present, in order to ensure the real-time nature of the information, the intrusion monitoring system does not conduct in-depth analysis of the information during the detection of the alarm information, resulting in a large amount of invalid alarm information, which hinders the maintenance of network security. The existing technology has the technical problem that the threat alarm information is complicated, the utilization rate is low, and it cannot provide a reliable basis for network maintenance. Summary of the invention

[0004] The present application provides a kill chain-based threat warning information comprehensive analysis method and system, which is used to solve the technical problems in the prior art that threat warning information is complicated, has low utilization rate, and cannot provide a reliable basis for network maintenance.

[0005] In view of the above problems, the present application provides a method and system for comprehensive analysis of threat warning information based on a kill chain.

[0006] In a first aspect of the present application, a method for comprehensive analysis of threat warning information based on a kill chain is provided, the method comprising:

[0007] Acquire threat warning information, and perform data cleaning on the threat warning information to obtain warning information to be extracted;

[0008] Extract threat behaviors from the alarm information to be extracted to obtain a threat behavior set;

[0009] Traversing the threat behavior set to extract logs from the target network to obtain a threat log set;

[0010] Performing multi-dimensional feature extraction on the threat log set to obtain a threat log feature set;

[0011] Determine the killing stage of the threat behavior set based on the threat log feature set to obtain an identified threat behavior set, wherein the identified threat behavior set has a killing stage identifier;

[0012] Constructing a kill chain model, inputting the identified threat behavior set into the kill chain model to perform threat behavior analysis, and obtaining multiple threat behavior chains;

[0013] The target network is maintained in a differentiated manner based on the multiple threat behavior chains.

[0014] A second aspect of the present application provides a comprehensive analysis system for threat warning information based on a kill chain, the system comprising:

[0015] A data cleaning module, the data cleaning module is used to obtain threat warning information, and perform data cleaning on the threat warning information to obtain warning information to be extracted;

[0016] A threat behavior acquisition module, the threat behavior acquisition module is used to extract threat behaviors from the alarm information to be extracted to obtain a threat behavior set;

[0017] A threat log set acquisition module, the threat log set acquisition module is used to traverse the threat behavior set to extract logs from the target network to obtain a threat log set;

[0018] A log feature value acquisition module, wherein the log feature value acquisition module is used to perform multi-dimensional feature extraction on the threat log set to obtain a threat log feature set;

[0019] an identified threat behavior obtaining module, the identified threat behavior obtaining module being used to determine a killing stage for the threat behavior set based on the threat log feature set, and obtain an identified threat behavior set, wherein the identified threat behavior set has a killing stage identifier;

[0020] A threat behavior chain acquisition module, the threat behavior chain acquisition module is used to build a kill chain model, input the identified threat behavior set into the kill chain model to perform threat behavior analysis, and obtain multiple threat behavior chains;

[0021] A differentiated maintenance module, wherein the differentiated maintenance module is used to perform differentiated maintenance on the target network based on the multiple threat behavior chains.

[0022] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0023] This application obtains threat alarm information, cleans the threat alarm information, obtains the alarm information to be extracted, then extracts threat behavior from the alarm information to be extracted, obtains a threat behavior set, and then traverses the threat behavior set to extract logs from the target network to obtain a threat log set, then extracts multi-dimensional features from the threat log set to obtain a threat log feature set, determines the killing stage of the threat behavior set based on the threat log feature set, obtains an identified threat behavior set, wherein the identified threat behavior set has a killing stage identifier, then constructs a kill chain model, inputs the identified threat behavior set into the kill chain model for threat behavior analysis, obtains multiple threat behavior chains, and performs differentiated maintenance on the target network based on multiple threat behavior chains. The application achieves the technical effect of improving the utilization rate of alarm information, performing targeted maintenance on the network, and ensuring network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A schematic diagram of a comprehensive analysis method of threat warning information based on a kill chain provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of a process for obtaining a first threat covariance matrix in a comprehensive analysis method of threat warning information based on a kill chain provided in an embodiment of the present application;

[0027] Figure 3 A schematic diagram of a process of obtaining multiple threat behavior chains in a comprehensive analysis method of threat warning information based on a kill chain provided in an embodiment of the present application;

[0028] Figure 4 A schematic diagram of the structure of a kill chain-based threat warning information comprehensive analysis system provided in an embodiment of the present application.

[0029] Explanation of the reference numerals: data cleaning module 11 , threat behavior acquisition module 12 , threat log set acquisition module 13 , log feature value acquisition module 14 , identified threat behavior acquisition module 15 , threat behavior chain acquisition module 16 , differentiated maintenance module 17 . DETAILED DESCRIPTION

[0030] The present application provides a comprehensive analysis method for threat warning information based on a kill chain, which is used to solve the technical problems in the prior art that threat warning information is complicated, has low utilization rate, and cannot provide a reliable basis for network maintenance.

[0031] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] like Figure 1 As shown, the present application provides a method for comprehensive analysis of threat warning information based on a kill chain, the method comprising:

[0035] Step S100: Acquire threat warning information, and perform data cleaning on the threat warning information to obtain warning information to be extracted;

[0036] Further, such as Figure 2 As shown, step S100 in the embodiment of the present application also includes:

[0037] Step S110: extracting threat features from the threat warning information according to preset threat indicators to obtain a first threat feature data set;

[0038] Step S120: performing decentralized processing on the first threat feature data set to obtain a second threat feature data set;

[0039] Step S130: obtaining a first threat covariance matrix based on the second threat feature data set.

[0040] Furthermore, step S100 in the embodiment of the present application further includes:

[0041] Step S140: Calculating the first eigenvalue and the first eigenvector of the first threat covariance matrix using matrix operation rules;

[0042] Step S150: performing data dimensionality reduction based on the first eigenvalue and the first eigenvector to obtain a first dimensionality reduction threat feature data set;

[0043] Step S160: Obtain the alarm information to be extracted according to the first dimensionality reduction threat feature data set.

[0044] Specifically, the threat alarm information is based on the alarm data information identified and fed back by the intrusion detection system after the target network is attacked, including source IP address, destination IP address, alarm timestamp, alarm trigger detection rules, alarm type and other information. The data cleaning is to filter and reduce the invalid information in the threat alarm information to achieve the purpose of improving the information entropy of the threat alarm information. The alarm information to be extracted is the alarm information that needs to be processed after the threat alarm information is filtered.

[0045] Specifically, the preset threat index is an index for evaluating the information entropy contained in the threat warning information, including the number of characters, character types, etc. The first threat feature data set is obtained by extracting the threat feature of the threat warning information according to the preset threat index. Among them, the first threat feature data set is a data set reflecting the amount of effective information contained in the threat warning information. The decentralized processing of the first threat feature data set is to calculate the average value of each feature in the first threat feature data set, and then obtain all samples, and subtract the mean of each feature from its own, so as to obtain a new feature value, thereby eliminating the dimensional differences between the features, and obtaining the second threat feature data set. The second threat feature data set is operated by the covariance formula to obtain the first threat covariance matrix.

[0046] Specifically, the matrix operation rule is a commonly used operation rule for solving eigenvalues ​​and eigenvectors of a matrix. By performing matrix operations, the eigenvalues ​​and eigenvectors corresponding to the first threat covariance matrix are obtained, and each eigenvalue corresponds to an eigenvector. After obtaining the first eigenvector, the largest first m eigenvalues ​​and the eigenvectors corresponding thereto are selected, and the original features in the first threat feature data set are projected onto the selected eigenvectors, thereby obtaining the first reduced dimension threat data feature set after the dimensionality reduction. The corresponding threat alarm information is obtained with the first reduced dimension threat feature data set, and is set as the alarm information to be extracted. The principal component analysis method is used to clean and reduce the dimensionality of the threat information, thereby eliminating redundant data and reducing the amount of alarm information to be analyzed.

[0047] Step S200: extracting threat behaviors from the alarm information to be extracted to obtain a threat behavior set;

[0048] Specifically, from the alarm information to be extracted, threat behaviors are extracted using alarm nodes and alarm types as indexes, thereby obtaining the threat behavior set, which is an information set that specifically describes the threat situation of the target network being attacked, reflecting the specific situation of the threat.

[0049] Step S300: traversing the threat behavior set to extract logs from the target network to obtain a threat log set;

[0050] Furthermore, step S300 of the embodiment of the present application further includes:

[0051] Step S310: collecting logs of ports involved in the threat behavior set according to a preset perception window to obtain an initialization log set;

[0052] Step S320: collecting indicators of the initialization log set according to preset dimensional indicators to obtain multiple abnormal indicator values, wherein the preset dimensional indicators include periodic indicators, trend indicators and stability indicators.

[0053] Furthermore, step S300 of the embodiment of the present application further includes:

[0054] Step S330: determining a main part of the initialization log set according to the multiple abnormal indicator values, wherein the main part is a main aspect of the target network being threatened;

[0055] Step S340: construct the threat log set according to the main part.

[0056] Specifically, the threat log set is obtained by extracting the work log generated by the target network according to the timestamp information, source IP address and destination IP address corresponding to the threat behavior set. The threat log set reflects information such as the device status of the target network before and after the attack and the changes in network signals. The preset perception window is a time period obtained by averaging the length of the time period before and after the target network is affected by different types of attacks. Logs are collected from ports according to the time period corresponding to the preset perception window, thereby narrowing the scope of log collection and reducing the amount of data that needs to be analyzed. The initialization log set is a data set obtained after collecting information on the attack situation of the target network within a preset time period.

[0057] Specifically, the preset dimension indicators are indicators for performing a multi-dimensional evaluation on the initialization log set and analyzing the network and network equipment operation information contained in the log, including periodic indicators, trend indicators and stability indicators. Among them, the periodic indicator is an indicator for analyzing the time periods of two attacks reflected in the log. The trend indicator is an indicator for analyzing data with obvious development trends in the log. The stability indicator is an indicator for analyzing the degree of fluctuation of the network and network equipment operation data in the log.

[0058] Specifically, the data indicator values ​​of each set in the initialization log set are collected according to the preset dimension indicators, so as to obtain the multiple abnormal indicator values. Among them, the multiple abnormal indicator values ​​quantify the amount of information contained in the data in the initialization log set. The multiple abnormal indicator values ​​are screened according to the preset abnormal indicator values ​​to determine the main information in the initialization log set that can reflect the threat situation, that is, the main part, and set the main part as the threat log set. Thereby achieving the technical effect of reducing the dimensionality of the log and further reducing the amount of data analysis.

[0059] Step S400: performing multi-dimensional feature extraction on the threat log set to obtain a threat log feature set;

[0060] Step S500: determining a killing stage for the threat behavior set based on the threat log feature set to obtain an identified threat behavior set, wherein the identified threat behavior set has a killing stage identifier;

[0061] Specifically, by extracting the log features of the threat log set, the stage of the target network being attacked reflected in the log is analyzed to determine the stage of the attack on the network by the threat behavior set in the kill chain. The log features include log time series, log time count features, etc. The kill stage is determined based on the time contained in the log and the feature vector of the occurrence of the log event. Then, the threat behavior set is identified according to the kill stage, thereby obtaining the identified threat behavior set that can reflect the attack process.

[0062] Step S600: constructing a kill chain model, inputting the identified threat behavior set into the kill chain model to perform threat behavior analysis, and obtaining multiple threat behavior chains;

[0063] Further, such as Figure 3 As shown, step S600 of the embodiment of the present application also includes:

[0064] Step S610: Building a kill chain model based on the reconnaissance and tracking, weapon construction, payload delivery, vulnerability exploitation, installation and implantation, command and control, and target achievement stages;

[0065] Step S620: inputting the identified threat behavior set into the kill chain model for cluster analysis to obtain a plurality of identified threat clusters;

[0066] Step S630: Serializing the multiple identified threat clusters based on the threat log feature set to obtain the multiple threat behavior chains.

[0067] Specifically, the kill chain model uses the kill phase identifier in the set of identified threat behaviors as the sequence arrangement basis, combines the identifier of the set of identified threat behaviors for analysis, and determines the sequence chain belonging to the same supply. The reconnaissance and tracking stage is the stage in which the external attack source identifies and tracks information to the target network. The weapon construction stage is the stage in which the external attack source constructs an intrusion installation package. The payload delivery stage is the stage in which the external attack source has prepared the weapon and transmits the installation package to the target network. The vulnerability exploitation stage is the stage in which the firewall vulnerability of the target network is identified and the installation package is transmitted to the target network through the vulnerability. The installation implantation stage is the stage in which the information in the installation package is embedded into the data in the target network by implanting the installation package in the target network. The command control stage is the stage in which the target network is intruded and controlled by the commands in the installation package. The target achievement stage is the stage in which the attack on the target network is completed.

[0068] Specifically, by taking the reconnaissance and tracking, weapon construction, payload delivery, vulnerability exploitation, installation and implantation, command control, and target achievement stages as leaf nodes, cluster analysis is performed on the threat behaviors in the identified threat behavior set, thereby obtaining the multiple identified threat clusters. The multiple identified threat clusters are clusters obtained by aggregating behaviors belonging to the same stage in the identified threat behavior set, and each identified threat cluster corresponds to an attack stage. Furthermore, based on the attack information in the threat log feature set, the threat behaviors belonging to the same attack source are determined, and arranged according to the kill chain, thereby obtaining the multiple threat behavior chains.

[0069] Step S700: Performing differentiated maintenance on the target network based on the multiple threat behavior chains.

[0070] Furthermore, step S700 of the embodiment of the present application further includes:

[0071] Step S710: Generate a threat assessment model from three dimensions: threat degree, threat severity and asset value;

[0072] Step S720: The threat assessment model is:

[0073] TV=(αTD)*(δTS)*(εAV)

[0074] Among them, α is the weight of threat degree in the threat situation analysis process, TD is the threat degree, δ is the weight of threat severity in the threat situation analysis process, TS is the threat severity, ε is the weight of asset value in the threat situation analysis process, AV is the asset value, and TV is the threat situation assessment value;

[0075] Step S730: using the threat assessment model to perform threat situation assessment on the multiple threat behavior chains to obtain multiple threat situation assessment values;

[0076] Step S740: Determine an order for performing differentiated maintenance based on the multiple threat situation assessment values.

[0077] Specifically, the target network is maintained with intensity and resource allocation according to the multiple threat behavior chains. The threat assessment model is a functional model for assessing the attack situation of the threat behavior chain on the target network. The multiple threat situation assessment values ​​reflect the attack threat levels of the multiple threat behavior chains. Furthermore, network maintenance is performed in descending order according to the size of the multiple threat situation assessment values.

[0078] In summary, the embodiments of the present application have at least the following technical effects:

[0079] The present application cleans invalid information and duplicate information in threat alarm information to eliminate redundant data and obtain the alarm information to be extracted, and then analyzes the threat behavior contained in the information and extracts the log information of the target network according to the timestamp corresponding to the threat behavior, and then analyzes the log and extracts features to obtain a threat log feature set, based on which the stage of the threat is determined, and uses the kill-damage model to analyze the identified threat behavior, thereby determining multiple threat behavior chains, serializing the attacks, and improving the processing and maintenance efficiency, and then performing differentiated maintenance according to the multiple threat behavior chains, thereby achieving the technical effect of improving the comprehensive utilization of alarm information and ensuring network security.

[0080] Embodiment 2

[0081] Based on the same inventive concept as the kill chain-based threat warning information comprehensive analysis method in the aforementioned embodiment, Figure 4 As shown, the present application provides a comprehensive analysis system of threat warning information based on the kill chain, and the system and method embodiments in the embodiments of the present application are based on the same inventive concept. The system includes:

[0082] A data cleaning module 11, the data cleaning module 11 is used to obtain threat warning information, and perform data cleaning on the threat warning information to obtain warning information to be extracted;

[0083] A threat behavior acquisition module 12, wherein the threat behavior acquisition module 12 is used to extract threat behaviors from the alarm information to be extracted to obtain a threat behavior set;

[0084] A threat log set acquisition module 13, wherein the threat log set acquisition module 13 is used to traverse the threat behavior set to extract logs from the target network to obtain a threat log set;

[0085] A log feature value obtaining module 14, wherein the log feature value obtaining module 14 is used to perform multi-dimensional feature extraction on the threat log set to obtain a threat log feature set;

[0086] An identified threat behavior obtaining module 15, the identified threat behavior obtaining module 15 is used to determine the killing stage of the threat behavior set based on the threat log feature set to obtain an identified threat behavior set, wherein the identified threat behavior set has a killing stage identifier;

[0087] A threat behavior chain acquisition module 16, wherein the threat behavior chain acquisition module 16 is used to construct a kill chain model, input the identified threat behavior set into the kill chain model to perform threat behavior analysis, and obtain multiple threat behavior chains;

[0088] A differentiated maintenance module 17, wherein the differentiated maintenance module 17 is used to perform differentiated maintenance on the target network based on the multiple threat behavior chains.

[0089] Furthermore, the system also includes:

[0090] A threat feature extraction unit, the threat feature extraction unit is used to extract threat features from the threat warning information according to a preset threat indicator to obtain a first threat feature data set;

[0091] A decentralized processing unit, wherein the decentralized processing unit is used to perform decentralized processing on the first threat feature data set to obtain a second threat feature data set;

[0092] A covariance matrix obtaining unit is used to obtain a first threat covariance matrix based on the second threat feature data set.

[0093] Furthermore, the system also includes:

[0094] An eigenvalue calculation unit, the eigenvalue calculation unit is used to calculate a first eigenvalue and a first eigenvector of the first threat covariance matrix using a matrix operation rule;

[0095] A data dimension reduction unit, wherein the data dimension reduction unit is used to perform data dimension reduction based on the first eigenvalue and the first eigenvector to obtain a first dimensionality reduction threat feature data set;

[0096] The alarm information to be extracted obtaining unit is used to obtain the alarm information to be extracted according to the first dimensionality reduction threat feature data set.

[0097] Furthermore, the system also includes:

[0098] An initialization log acquisition unit, the initialization log acquisition unit is used to collect logs for the ports involved in the threat behavior set according to a preset perception window to obtain an initialization log set;

[0099] An abnormal indicator value obtaining unit is used to collect indicators of the initialization log set according to preset dimensional indicators to obtain multiple abnormal indicator values, wherein the preset dimensional indicators include periodic indicators, trend indicators and stability indicators.

[0100] Furthermore, the system also includes:

[0101] A main part determination unit, the main part determination unit is used to determine the main part of the initialization log set according to the multiple abnormal indicator values, wherein the main part is the main aspect of the target network being threatened;

[0102] A threat log construction unit is configured to construct the threat log set according to the main part.

[0103] Furthermore, the system also includes:

[0104] A model building unit, the model building unit is used to build a kill chain model based on reconnaissance and tracking, weapon construction, payload delivery, vulnerability exploitation, installation and implantation, command and control, and target achievement stages;

[0105] A cluster analysis unit, the cluster analysis unit being configured to obtain a plurality of identified threat clusters by inputting the identified threat behavior set into the kill chain model for cluster analysis;

[0106] A serialization processing unit is used to perform serialization processing on the multiple identified threat clusters based on the threat log feature set to obtain the multiple threat behavior chains.

[0107] Furthermore, the system also includes:

[0108] An assessment model generation unit, the assessment model generation unit is used to generate a threat assessment model from three dimensions: threat degree, threat severity and asset value;

[0109] An assessment model setting unit, wherein the threat assessment model used by the assessment model setting unit is:

[0110] TV=(αTD)*(δTS)*(εAV)

[0111] Among them, α is the weight of threat degree in the threat situation analysis process, TD is the threat degree, δ is the weight of threat severity in the threat situation analysis process, TS is the threat severity, ε is the weight of asset value in the threat situation analysis process, AV is the asset value, and TV is the threat situation assessment value;

[0112] A situation assessment value obtaining unit, the situation assessment value obtaining unit is used to perform threat situation assessment on the plurality of threat behavior chains using the threat assessment model to obtain a plurality of threat situation assessment values;

[0113] A differentiated maintenance sequence determination unit is used to determine the sequence of performing differentiated maintenance based on the multiple threat situation assessment values.

[0114] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0115] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0116] This specification and drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.

Claims

1. A comprehensive analysis method of threat warning information based on kill chain, characterized in that: The method comprises: Acquire threat warning information, and perform data cleaning on the threat warning information to obtain warning information to be extracted; Extract threat behaviors from the alarm information to be extracted to obtain a threat behavior set; Traversing the threat behavior set to extract logs from the target network to obtain a threat log set; Performing multi-dimensional feature extraction on the threat log set to obtain a threat log feature set; Determine the killing stage of the threat behavior set based on the threat log feature set to obtain an identified threat behavior set, wherein the identified threat behavior set has a killing stage identifier; Constructing a kill chain model, inputting the identified threat behavior set into the kill chain model to perform threat behavior analysis, and obtaining multiple threat behavior chains; Performing differentiated maintenance on the target network based on the multiple threat behavior chains; The method further comprises: Construct a kill chain model based on reconnaissance and tracking, weapon construction, payload delivery, vulnerability exploitation, installation and implantation, command and control, and target achievement stages; The identified threat behavior set is input into the kill chain model for cluster analysis to obtain a plurality of identified threat clusters; Serializing the plurality of identified threat clusters based on the threat log feature set to obtain the plurality of threat behavior chains; Generate a threat assessment model based on three dimensions: threat level, threat severity, and asset value; The threat assessment model is: TV=(αTD)*(δTS)*(εAV) Among them, α is the weight of threat degree in the threat situation analysis process, TD is the threat degree, δ is the weight of threat severity in the threat situation analysis process, TS is the threat severity, ε is the weight of asset value in the threat situation analysis process, AV is the asset value, and TV is the threat situation assessment value; Using the threat assessment model to perform threat situation assessment on the multiple threat behavior chains to obtain multiple threat situation assessment values; An order for performing differentiated maintenance is determined based on the multiple threat situation assessment values.

2. The method according to claim 1, characterized in that The method comprises: Extract threat features from the threat warning information according to preset threat indicators to obtain a first threat feature data set; Decentralizing the first threat feature data set to obtain a second threat feature data set; A first threat covariance matrix is ​​obtained based on the second threat feature data set.

3. The method according to claim 2, characterized in that The method comprises: Calculating a first eigenvalue and a first eigenvector of the first threat covariance matrix using a matrix operation rule; Performing data dimensionality reduction based on the first eigenvalue and the first eigenvector to obtain a first dimensionality reduction threat feature data set; The alarm information to be extracted is obtained according to the first dimensionality reduction threat feature data set.

4. The method according to claim 1, characterized in that The method comprises: Collecting logs of ports involved in the threat behavior set according to a preset perception window to obtain an initialization log set; Indicators are collected for the initialization log set according to preset dimensional indicators to obtain multiple abnormal indicator values, wherein the preset dimensional indicators include periodic indicators, trend indicators and stability indicators.

5. The method according to claim 4, characterized in that The method comprises: Determine a main part of the initialization log set according to the multiple abnormal indicator values, wherein the main part is a main aspect of the target network being threatened; The threat log set is constructed according to the main parts.

6. A comprehensive analysis system of threat warning information based on kill chain, characterized in that: The system comprises: A data cleaning module, the data cleaning module is used to obtain threat warning information, and perform data cleaning on the threat warning information to obtain warning information to be extracted; A threat behavior acquisition module, the threat behavior acquisition module is used to extract threat behaviors from the alarm information to be extracted to obtain a threat behavior set; A threat log set acquisition module, the threat log set acquisition module is used to traverse the threat behavior set to extract logs from the target network to obtain a threat log set; A log feature value acquisition module, wherein the log feature value acquisition module is used to perform multi-dimensional feature extraction on the threat log set to obtain a threat log feature set; an identified threat behavior obtaining module, the identified threat behavior obtaining module being used to determine a killing stage for the threat behavior set based on the threat log feature set, and obtain an identified threat behavior set, wherein the identified threat behavior set has a killing stage identifier; A threat behavior chain acquisition module, the threat behavior chain acquisition module is used to build a kill chain model, input the identified threat behavior set into the kill chain model to perform threat behavior analysis, and obtain multiple threat behavior chains; A differentiated maintenance module, the differentiated maintenance module is used to perform differentiated maintenance on the target network based on the multiple threat behavior chains; The system further comprises: A model building unit, the model building unit is used to build a kill chain model based on reconnaissance and tracking, weapon construction, payload delivery, vulnerability exploitation, installation and implantation, command and control, and target achievement stages; A cluster analysis unit, the cluster analysis unit being configured to obtain a plurality of identified threat clusters by inputting the identified threat behavior set into the kill chain model for cluster analysis; A serialization processing unit, the serialization processing unit is used to perform serialization processing on the multiple identified threat clusters based on the threat log feature set to obtain the multiple threat behavior chains; An assessment model generation unit, the assessment model generation unit is used to generate a threat assessment model from three dimensions: threat degree, threat severity and asset value; An assessment model setting unit, wherein the threat assessment model used by the assessment model setting unit is: TV=(αTD)*(δTS)*(εAV) Among them, α is the weight of threat degree in the threat situation analysis process, TD is the threat degree, δ is the weight of threat severity in the threat situation analysis process, TS is the threat severity, ε is the weight of asset value in the threat situation analysis process, AV is the asset value, and TV is the threat situation assessment value; A situation assessment value obtaining unit, the situation assessment value obtaining unit is used to perform threat situation assessment on the plurality of threat behavior chains using the threat assessment model to obtain a plurality of threat situation assessment values; A differentiated maintenance sequence determination unit is used to determine the sequence of performing differentiated maintenance based on the multiple threat situation assessment values.

Images