The invention discloses a
network attack attribution analysis and responsibility determination method based on
causal reasoning, and belongs to the technical field of
network security. According to the method, multi-source heterogeneous data are integrated through
data acquisition and preprocessing, a causal graph is constructed to mine a potential causal relationship, a causal path of an
attack behavior is defined and dynamically updated, attribution analysis is performed by using a
causal reasoning algorithm, the intention and ability of an attacker are clarified, the responsibility proportion is evaluated in combination with laws and regulations, and a report is output. And meanwhile, an analysis result is displayed through a
visual tool, and the model is optimized based on
user feedback. The method is suitable for the fields of enterprise
network security protection,
cloud service provider security operation, national
network security supervision and the like, advanced persistent threats can be effectively dealt with, the
interpretability and legal applicability of analysis results are improved, and scientific basis and
technical support are provided for responsibility confirmation and
risk control of network security events.