Threat intelligence analysis system for attack tracing

Abstract

The invention discloses a threat intelligence analysis system for attack tracing. The system comprises an internal threat intelligence collection module, an external threat intelligence collection module and an attack tracing analysis module; the internal threat intelligence collection module comprises a security detection module and a security analysis module; the attack tracing analysis module comprises attacker tracing and attack host tracking; threat intelligence obtained by the internal threat intelligence collection module and the external threat intelligence collection module is uploaded to the attack tracing analysis module, the attack tracing analysis module performs attacker tracing and attack host tracking on the threat intelligence and feeds back the result to the security detection module and the security analysis module; and meanwhile, the result is performed with threat intelligence sharing and exchange with an external cooperation mechanism. The threat intelligence analysis system disclosed by the invention can not only singly and quickly accomplish threat intelligence analysis and detection, but also can provide prediction for the attacks of enterprises, the method is orientated to attack tracing, and the attack mode is analyzed from the source so as to better identify the identity of the attacker.

Description

technical field [0001] The invention relates to an attack source-oriented threat intelligence analysis system, which belongs to the technical field of network security. Background technique [0002] Threat intelligence is knowledge information that describes threats based on evidence, including threat-related context information (context), methods and mechanisms used by threats, threat-related indicators (indicators), attack impact, and countermeasures. Threat intelligence is used to describe security threats and provide decision-making suggestions to organizations or third parties. The purpose of threat intelligence is to provide all clues to restore and predict attacks that have not occurred, to learn as much as possible about attackers’ motives, tactics, tools, resources, and behavioral processes, and to establish an effective defense system. Threat intelligence generally consists of two parts: threat information and defense information. The threat information includes:...

AI Technical Summary

Problems solved by technology

[0006] The above method has certain limitations:

The above method uses a relatively simple whitelist method. First, the method of generating threat intelligence is relatively single, and the source of threat intelligence is not extensive enough. The rate of false negatives or false positives may be high, and the generalization of the method is poor.

Moreover, it only describes the method of generating threat intelligence, and does not form a complete threat intelligence analysis system

(2) The method of threat intelligence sharing is based on solving the current problems of lack of unified norms, low efficiency of intelligence sharing, and risk of leakage of intelligence due to information sharing between the automatic processing of network threat intelligence and cross-departmental information sharing.

Images