Intelligent association analysis method and intelligent association analysis device for security events

Abstract

The invention relates to an intelligent association analysis method and an intelligent association analysis device for security events. The intelligent association analysis method comprises the steps of decomposing the attribute characteristic of a security event which is acquired in real time and standardizing the attribute characteristic values; and traversing an offline generated unified inference structure by means of the standardized attribute characteristic value, thereby determining an attack type. The intelligent association analysis method and the intelligent association analysis device improve association analysis efficiency.

Description

technical field [0001] The present disclosure relates to the field of network security, in particular, to a method and device for intelligent correlation analysis of security events. Background technique [0002] In today's increasingly severe network security situation, network security management has become an important part of network operations. SOC (Security Operations Centre, Security Operations Center) is a technical support platform for comprehensive analysis of network and security equipment and systems, and for centralized management and monitoring of security events. The SOC collects security logs generated by devices and systems in the network, analyzes and processes them, and finds out the current security threats and potential security risks of the network, so as to issue early warnings in time to avoid heavy losses on the network. Among the large amount of security event information collected by the SOC from the network, many of them do not have real threats,...

AI Technical Summary

Problems solved by technology

The "reasoning machine" correlation analysis engine will not miss any security events and any information carried by security events, and the analysis accuracy is high. However, because the SOC's analysis of network-wide security events involves multiple devices, Inference engine" association analysis engine needs to build a large number of attack models, the analysis is fine and complex, and it needs to take up a lot of computing space and time costs, resulting in low analysis efficiency

There are a large number of security events in the telecommunications network environment, and the efficiency of the low-efficiency reasoning machine correlation analysis engine cannot support

Images