Real-time detection method and system based on threat behavior

Abstract

The embodiment of the invention provides a real-time detection method and system based on threat behaviors, and is applied to the technical field of computer security management. Application semantics are selected according to occurrence scenes of threat events, and a semantic rule template or a semantic rule configuration file is formed through sorting and combination according to analysis strategies of the threat events. And generating a semantic rule object tree according to the semantic rule template or the semantic rule configuration file, wherein the semantic rule object tree comprises nodes corresponding to application semantics in the semantic rule template. And finally, according to the semantic rule object tree, generating a directed acyclic graph used for checking a target behavior feature log corresponding to the threat event step by step. When the threat event is changed, the semantic rule template or the semantic rule configuration file can be redefined to generate a new semantic rule object tree, and the directed acyclic graph is updated to detect the target behavior feature log corresponding to the changed threat event in real time, so that the problem that the static network analysis of the threat event lacks timeliness is solved.

Description

technical field [0001] The present application relates to the technical field of computer security management, and in particular, to a real-time detection method and system based on threat behavior. Background technique [0002] With the in-depth application of new-generation IT technologies such as cloud computing and big data in various industries, the IT scale and complexity of government and enterprise institutions have continued to increase, and the scale of various data such as network traffic and logs has also increased. A large amount of network data is mixed with threat data, threatening the security of government and enterprise networks. Therefore, it is necessary to filter the data to obtain the relevant data of the threat event, and to protect the threat event in time. [0003] For network security protection, the document (CN108924084B) mentions that related technologies are mainly divided into two categories: "traditional risk assessment methods" and "modern r...

AI Technical Summary

Problems solved by technology

[0004] This application provides a real-time detection method and system based on threat behavior to solve the problem of lack of timeliness in static network threat analysis methods

Images