Method and device for researching and judging security alarm threats

Abstract

The invention discloses a security alarm threat research and judgment method and device, belonging to the technical field of network security. The method includes: constructing a network security intelligence knowledge graph based on historical intelligence database data, forming a security alarm correlation subgraph of security alarm data on this basis, performing entity threat coefficient calculation on the security alarm correlation subgraph, and obtaining the information of each threat entity element. The entity threat coefficient comprehensively calculates the security alarm threat degree of the security alarm data. The present invention applies the knowledge map technology to the field of threat intelligence, builds a network security intelligence knowledge map based on historical intelligence database data, and makes full use of the historical threat behavior of threat entity elements in the threat research and judgment of security alarms, making the judgment results more accurate.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for researching and judging security alarm threats. Background technique [0002] The threat analysis and judgment of security alarms is to analyze the threat degree and authenticity of the alarms captured by the monitoring operation and maintenance system. The threat analysis and judgment of security alarms is based on the analysis of data such as black and white lists, sensitive operations, and network behaviors, and the threat source subject that triggers the alarm is identified and risk analyzed. Through the analysis of multiple dimensions of security alarms, the threat analysis of network behaviors is realized. [0003] At present, security alarm threat analysis is based on artificial intelligence algorithms such as neural network and deep learning to conduct threat analysis on network behavior itself, capture network communication behavior, reso...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the present invention provides a method and device for researching and judging security alarm threats, the main purpose of which is to solve the problem of insufficient utilization of historical intelligence data in existing security alarm threat research and judgment in the prior art, and propose a method based on correlation reasoning Security alarm threat analysis method

Images