An attack path reconstruction method based on similarity computation

Abstract

The invention discloses an attack path reconstruction method based on similarity calculation, the invention forms an attack event by integrating multiple attacks in an attack event, Then by forming amultiple attack steps into an attack path, the originally complex network attack process is clarified and organized effectively, which helps to accurately detect the attack behavior, track the attacksource and find the weak links of the network system.

Description

technical field [0001] The invention relates to an attack path reconstruction method based on similarity calculation. Background technique [0002] With the rapid development of Web technology, network attacks are increasing day by day. Cyber ​​attacks pose a great threat to national security and social order. Network security situational analysis reflects current situational threats by detecting attack alerts from different security devices. Threat situation analysis must consider the following two questions. In the first case, a single attack in multiple logging devices can result in a large number of repeated attack alerts. The second is that cyber attacks are becoming more and more complex. Attack behavior can include multiple attack steps, and each attack step can generate alarms on different devices. In order to accurately detect attack behaviors, track attack sources, and discover weak links in network systems, it is necessary to integrate attack alerts and recons...

AI Technical Summary

Problems solved by technology

[0003] In order to solve the technical problem of insufficient real-time processing of network threats due to the relatively backward analysis methods for network attacks in complex situations, the present invention provides an attack path reconstruction method based on similarity calculation

Images