Intranet attack early warning method and device and storage medium

Abstract

The invention discloses an intranet attack early warning method. The method at least comprises the following steps: obtaining intranet attack event data regularly according to a first preset time interval; preprocessing the intranet attack event data to obtain a transaction data set, and storing the transaction data set in a database; generating an association rule from the transaction data according to an Apriori algorithm, storing the association rule in a database, and automatically updating the association rule; acquiring real-time attack event data regularly according to a second preset time interval, and preprocessing the real-time attack event data to obtain preprocessed data; matching the preprocessed data with the antecedent of the association rule through an exception analyzer toobtain a predicted unknown attack; and displaying the unknown attack and the association rule on a Web interface. According to the method, real-time prediction of the intranet attack event can be accurately realized, so that decision support can be provided for network information management personnel, and attack behaviors can be effectively prevented.

Description

technical field [0001] The invention relates to the technical field of network early warning, in particular to an intranet attack early warning method, device and storage medium. Background technique [0002] At present, the information network of power companies has basically invested in necessary security systems, such as IDS, IPS, firewall and other systems, which can effectively solve some internal network security problems, such as the interception of network attacks and virus defense. However, a large amount of log data generated during the operation of these systems has not been fully utilized, and network information management personnel cannot intuitively, effectively, and factually check the current situation of network information systems being attacked in the first place. Therefore, making full use of a large amount of log data to establish a situational awareness model can pre-perceive and effectively prevent various attacks, so as to provide analysis and decisi...

AI Technical Summary

Problems solved by technology

[0004] At present, power companies use manual analysis methods for a large number of logs generated by firewalls, IDS, IPS and other systems. Manual analysis of abstract log data will cause a heavy workload for network information management personnel, and the analysis of attack behaviors is shallow and cannot be intuitively analyzed. expression, leading to low work efficiency of network information management personnel, making log analysis not fully utilized, and consuming a large amount of human resources of the enterprise

In addition, manual analysis data is not real-time, and attack events cannot be accurately analyzed, which will cause huge losses to network system resources, and corresponding measures cannot be effectively taken in real time to protect network system resources

Images