Threat intelligence-based network threat identification method and identification system

Abstract

The invention relates to a threat intelligence-based network threat identification method and identification system. The method includes: after the detection module is started, loading all the threatinformation updated by the information updating module to the local; acquiring the collected and analyzed audit data, matching the audit data with data in a threat intelligence library, analyzing andacquiring threat event information based on risk data through an analysis and display module if the audit data is successfully matched with the data in the threat intelligence library, acquiring and analyzing associated information of possible lost host events, and counting, analyzing and displaying the relationship between the events. According to the invention, the threat condition of the wholenetwork is analyzed and displayed from two perspectives of threat event information and a lost host event; a collapsed host is determined, targeted attacks are accurately recognized, correlation analysis and display are carried out on the threats, the efficiency of processing network attack events is improved, the false alarm rate is low, potential threats can be found, tracing and post-processingof the threat events are greatly facilitated, attacks possibly occurring in the future are predicted, and therefore truly valuable attack events are deeply analyzed and found.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegram communication, and in particular to a network threat identification method and identification system based on threat intelligence characterized by protocols. Background technique [0002] With the continuous emergence of new threats and network attacks such as APT, malicious mining, and ransomware viruses, the number continues to rise, and network threats are rapidly evolving viciously. At the same time, the means and channels of network attacks are also diversified. Higher requirements are put forward for the analysis and processing capabilities of network security personnel, and enterprises and organizations increasingly need to rely on sufficient, efficient, and accurate security threat intelligence as a support in the process of preventing external attacks to help them better discover and address these new threats. [0003] Threat inte...

AI Technical Summary

Problems solved by technology

[0006] The present invention solves the simple matching of threat intelligence existing in the prior art, and there is no correlation analysis between threat situations, which is inconvenient for network attack traceability analysis and inconvenient viewing of threats on the entire network from a global perspective, which in turn leads to inaccurate judgments to a great extent problem, providing an optimized threat intelligence-based network threat identification method and identification system

Images