Network attack monitoring method and device based on big data

Abstract

The invention discloses a network attack monitoring method based on big data. The method comprises the following steps: collecting safety-related data in ultra space-time range of an information system; searching threat basis data related to a network safety threat clue from the safety-related data according to the network safety threat clue; identifying and describing high-level network safety threat according to a threat model and an association analysis model based on the threat basis data. The invention discloses a network attack monitoring device based on big data, the device comprises ahost resource data collection module, a network data collection module, a thread data searching module and a threat identification module. Through the monitoring method disclosed by the invention, thedata in the ultra space-time range can be collected, and the data processing, transmission, integration and analysis can be performed by using the big data platform, thereby discovering the high-level continuity threat with long attack continuing time and good concealing, and the limitation that the current safety monitoring measure only can discover the APT attack discrete clues is overcome.

Description

technical field [0001] The invention belongs to the technical field of big data and relates to big data security analysis, in particular how to collect data and use big data means to solve the monitoring and identification problems of advanced network security threats (such as APT attacks). Background technique [0002] As cyberspace security attacks and defenses gradually rise to the national or regional level, there are more and more cyber attacks that are organized and supported by national or regional backgrounds, and these attacks are clearly directed at a country's key information infrastructure and important information. System, enterprise-level network information system has become the primary target of advanced persistent threats (APT attacks). In recent years, APT attacks have shown the characteristics of long time span, high degree of concealment, strong attack capabilities and support resources. The existing network security monitoring or situational awareness sy...

AI Technical Summary

Problems solved by technology

At present, the existing security monitoring methods are difficult to discover the potential correlation between various security events in different locations and in different time periods, and can only find discrete or local clues of APT attacks, which requires a lot of manual analysis and intervention, so it cannot be described efficiently The whole picture of APT attack

Images