Threat information integration system and method for industrial environment

Abstract

The invention discloses a threat information integration system and method for an industrial environment. The threat information integration system collects original threat information data from at least one external threat information source and converts the original threat information data to be in a standard format, performs clustering analysis on the threat information data in the standard format by utilizing a non-supervised machine learning algorithm, verifies obtained threat information data clusters, classifies the threat information data clusters according to calculation characteristics of target network assets, and converts all the data in the threat information data clusters in a corresponding category of a target network to be in a data format operable for a target network security operation center. A security management system has more pertinence in the aspects of threat detection and event response; only the threat information data conforming to the target network characteristics can be converted to be in the data format operable for the target network security operation center, so that the working efficiency of the security operation center during use of external threat information is greatly improved.

Description

technical field [0001] The invention relates to the technical field of industrial control security, in particular to a threat intelligence integration system and method in an industrial environment. Background technique [0002] The frequency and complexity of cyber attacks continue to increase. For those enterprises or organizations with sensitive data and important systems, how to protect these sensitive data and system security is a major challenge they face. The perpetrators of these attacks may be a single autonomous attacker or well-resourced professional teams that are part of a criminal organization or have state-backed support. Threat actors can be persistent, motivated, and flexible, and they use a variety of attack modes to compromise systems, disrupt services, commit financial fraud, and disclose or steal intellectual property and other sensitive information. Given the risks these threats present, it is increasingly important for organizations to share cyber thr...

AI Technical Summary

Problems solved by technology

[0006] however despite the clear benefits of sharing threat intelligence, certain challenges remain

Images