Captured host automatic judgment method and device, electronic equipment and memory medium

Abstract

The invention relates to the technical field of network security and discloses a captured host automatic judgment method and device, electronic equipment and a memory medium. The method comprises thesteps of generating security incidents according to logs output by security equipment, wherein the security incidents are incidents which describe activities of attackers, and the security incidents comprise destination IP addresses and attack phases; aggregating the security incidents with the same destination IP address, and obtaining attack chains of hosts corresponding to the destination IP address according to the attack phases of the aggregated security incidents; searching the security incidents of which source IP addresses are the IP addresses of the hosts, and correcting the attack chains according to the searched security incidents; and judging whether the hosts are captured or not according to the corrected attack chains. According to the technical scheme provided by the embodiment of the invention, a function of automatically judging whether the hosts are captured or not is realized, the problem that judgment of whether the hosts are captured or not must depend on a safetyengineer is solved, the captured hosts are alarmed timely, and losses resulting from the fact that the hosts are captured are reduced.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method, device, electronic equipment and storage medium for automatically judging a compromised host. Background technique [0002] When the security device monitors network activities, it will generate a large number of logs, but for ordinary users who have network status monitoring, these logs have a huge amount of data and unclear meanings, and cannot intuitively tell users what happened. Therefore, most of the methods for judging whether a host has been compromised are manually judged by security engineers, which requires human resources and has high requirements for the professionalism of human resources, and there is also the possibility of serious losses if the judgment is not timely. Contents of the invention [0003] Embodiments of the present invention provide a method, device, electronic device and storage medium for automatically determining whether a hos...

AI Technical Summary

Problems solved by technology

[0003] Embodiments of the present invention provide a method, device, electronic device and storage medium for automatically determining whether a host has been compromised, so as to solve the problem in the prior art that it is impossible to automatically determine whether a host has been compromised

Images