Method and device for establishing threat activity topological graph and storage equipment

Abstract

The embodiment of the invention discloses a method and a device for establishing a threat activity topological graph and storage equipment. The method and the device are used for solving the problem that the process of threat activity of an attacker cannot be accurately restored due to the fact that analysis on threat activity of a network space stays in fuzzy evaluation based on network assets and an influence range in the prior art. The method comprises the steps of performing stage classification on a target threat activity based on a network space threat framework; in combination with a threat activity relationship, inferring related threat activities of all stages before and / or after the stage where the target threat activity is located; establishing a sequential association relationship between the target threat activity and the related threat activity; obtaining a topological graph of a plurality of complete threatening activities according to the sequential incidence relation;and assessing the influence range of each complete threat activity according to each topological graph, comparing the influence range with the actual network asset influence range, and determining thecomplete threat activity topological graph of the target threat activity.

Description

technical field [0001] The embodiments of the present invention relate to the field of network security, and in particular to a method, device and storage device for establishing a threat activity topology map. Background technique [0002] The analysis of cyberspace threat activities in the existing technology is based on fuzzy assessment based on network assets and scope of influence, without combining the context analysis of threat activities, nor analyzing the purpose of threat activities and the methods of attackers. Therefore, the existing analysis of threat activities does not start from the perspective of the attacker, and it is impossible to know why the target threat exists, what is the prerequisite for the existence of the target threat, and what is the attack method of the attacker. Contents of the invention [0003] Based on the above existing problems, the embodiment of the present invention provides a method, device and storage device for establishing a thre...

AI Technical Summary

Problems solved by technology

[0003] Based on the above existing problems, the embodiment of the present invention provides a method, device and storage device for establishing a threat activity topology map, so as to solve the problem that the analysis of cyberspace threat activities in the prior art stays in the fuzzy assessment based on network assets and scope of influence , unable to accurately restore the problem of the attacker's threat activity process

Images