Data noise reduction method and device based on sample dimension, equipment and storage medium

Abstract

The invention belongs to the technical field of network security, and discloses a data noise reduction method and device based on sample dimensions, equipment and a storage medium. According to the method, sample features corresponding to all suspected test machine samples in a suspected test machine sample set are obtained, the sample features are matched with a sample organization rule, a corresponding sample family is obtained, and then the incidence relation between the sample family and an advanced threat behavior body is obtained; and performing noise reduction processing on the suspected test machine sample set according to the association relationship. According to the method, the sample features of the suspected test machine samples are matched with the sample organization rules to obtain the corresponding sample family, so that the suspected test machine sample set can be quickly de-noised according to the incidence relation between the sample family and the advanced threat behavior body; and the samples with relatively low possibility that the suspected test machine samples are test machine samples are cleared, so that the loss of computing resources is reduced, the sample analysis speed is increased, and the sample analysis difficulty is reduced.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a sample dimension-based data noise reduction method, device, equipment and storage medium. Background technique [0002] In the process of testing and confronting advanced threat (Advanced Persistent Threat, APT) actors and security terminal products, advanced threat actors install the terminal product in a virtual environment in most cases, and test their malicious tools against security terminals Product capabilities to evaluate the feasibility of the next attack launch. [0003] During the confrontation process, advanced threat behaviors will continue to expose their own habitual characteristics. Therefore, a knowledge base can be formed by extracting and marking such logs, and using multi-dimensional methods to quickly correlate and confirm past or ongoing test confrontation activities to achieve Quickly identify advanced threat actors and predict their nex...

AI Technical Summary

Problems solved by technology

[0006] The main purpose of the present invention is to provide a data noise reduction method, device, equipment and storage medium based on sample dimensions, aiming to solve the technical problem of how to perform data noise reduction on captured samples of suspected testing machines to exclude noise samples

Images