CN110489611B - Intelligent clue analysis method and system - Google Patents

Abstract

The invention provides an intelligent clue analysis method and system, relating to the technical field of network space security, comprising the following steps: extracting alarm data provided by a third-party platform from an alarm library; extracting at least one preset rule from a rule base; matching the alarm data with at least one preset rule to obtain target alarm data; processing the target alarm data to obtain a preliminary clue; judging whether a case corresponding to the preliminary clue exists in a preset case library or not based on a preset clue matching rule; if yes, checking the case state of the case; and if the case state is in progress, the preliminary clues are extended to a case clue library of the case to obtain case clues of case updating. The target alarm data, the preliminary clues and the case clues in the invention improve the richness of the clues and greatly solve the problems of manpower and time, thereby reducing the difficulty of investigating, investigating and analyzing the clues.

Description

An intelligent clue analysis method and system

technical field

The invention relates to the technical field of network space security, in particular to an intelligent clue analysis method and system.

Background technique

With the continuous improvement of our country's informatization level, there are more and more crimes involving the field of computer information, which have a greater impact on people. However, with a large amount of alarm data, it is difficult to quickly find common points manually, and it is difficult to detect and investigate cases in a short time.

According to the existing APT, SOC and other collection tools, a large amount of alarm data can be collected, and some analysis models, such as DGA analysis, WEBSHELL analysis, targeted WEB attack detection analysis, etc., are used to analyze the rules of these models. The alarm data are respectively aggregated to generate associated attack relationships (referred to as preliminary clues). However, these preliminary clues are too scattered to be directly applied to the case, and manual analysis is required to verify whether it is the same case.

A large amount of data comparison and analysis in the prior art is done manually, which is time-consuming and labor-intensive, and the search cycle is relatively long. During the search time, hackers may commit crimes again, causing economic losses or inconvenience to others.

Contents of the invention

The purpose of the present invention is to provide an intelligent clue analysis method and system to increase the richness of clues, greatly solve the problem of manpower and time, thereby reducing the difficulty of investigation and analysis of clues.

An intelligent clue analysis method provided by the present invention includes: extracting alarm data provided by a third-party platform from an alarm library; extracting at least one preset rule from a rule library; combining the alarm data with the at least one Matching preset rules to obtain target alarm data; processing the target alarm data to obtain preliminary clues; judging whether there is a case corresponding to the preliminary clues in the preset case database based on preset clue matching rules; if so, Then check the case status of the case; if the case status is in progress, expand the preliminary clue to the case clue database of the case to obtain the updated case clue of the case.

Further, the method further includes: if it does not exist, generating a case corresponding to the preliminary clue in the preset case database, and expanding the preliminary clue as a case clue into the case clue database of the case or, if the state of the case is detected or abandoned, then generate a case corresponding to the preliminary clue in the preset case database, and expand the preliminary clue as a case clue to the case of the case in the clue library.

Further, the method includes: the preliminary clue is composed of at least one attack chain, wherein each attack chain is determined by at least one target alarm data.

Further, the third-party platform includes one or more of SOC, APT, and G01.

An intelligent clue analysis system provided by the present invention includes: a first extraction module, a second extraction module, a preliminary clue module and a case clue module; the first extraction module is used to extract third-party The alarm data provided by the platform; the second extraction module is used to extract at least one preset rule from the rule base; the preliminary clue module establishes connections with the first extraction module and the second extraction module respectively, and uses Matching the alarm data with the at least one preset rule to obtain target alarm data; processing the target alarm data to obtain preliminary clues; the case clue module is used to The matching rule judges whether there is a case corresponding to the preliminary clue in the preset case database; if it exists, check the case status of the case; if the case status is in progress, extend the preliminary clue to all In the case clue storehouse of the above-mentioned case, obtain the case clue of described case update.

Further, the preset rules include fixed rules and custom rules, and the rule base includes a fixed rule base and a custom rule base; the fixed rule base is used to store the fixed rules; the custom rule base , which stores the custom rule.

Further, the fixed rules include: DGA analysis, WEBSHELL analysis, C&C remote connection analysis, targeted WEB attack detection analysis, SMB remote overflow attack event, one sentence WEB backdoor blasting, SSH brute force cracking, RDP brute force cracking, FTP brute force One or more of cracks.

Further, the custom rule includes one or more of the following fields: rule name, effective start and end time, device type, threat type, data source, usage scenario, attack source configuration, and attack target configuration.

Further, the attack source configuration includes: one or more of attack source, intelligence matching, feature similarity judgment, attack threshold, and attack feature.

Further, the attack target configuration includes: one or more of the attack target, whether intelligence matches, attack target domain name, attack times threshold, and attack target industry.

An intelligent clue analysis method and system provided by the present invention includes: extracting the alarm data provided by the third-party platform from the alarm library; extracting at least one preset rule from the rule library; combining the alarm data with at least one preset rule Match to obtain the target alarm data; process the target alarm data to obtain preliminary clues; judge whether there is a case corresponding to the preliminary clue in the preset case database based on the preset clue matching rules; if there is, check the case status of the case; if If the case status is in progress, the preliminary clues are expanded to the case clue database of the case to obtain updated case clues. The target alarm data, preliminary clues and case clues in the present invention improve the richness of clues, analyze the existing alarm data into preliminary clues, and then automatically convert preliminary clues into high-level available case clues, which greatly solves the problem of manpower and The problem of time, thus reducing the difficulty of investigation and analysis of clues.

Description of drawings

In order to more clearly illustrate the specific implementation of the present invention or the technical solutions in the prior art, the following will briefly introduce the accompanying drawings that need to be used in the specific implementation or description of the prior art. Obviously, the accompanying drawings in the following description The drawings show some implementations of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

Fig. 1 is a flow chart of an intelligent clue analysis method provided by an embodiment of the present invention;

Fig. 2 is the preliminary clue diagram provided by the embodiment of the present invention;

Fig. 3 is the clue diagram of the case provided by the embodiment of the present invention;

FIG. 4 is a flowchart of another intelligent clue analysis method provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an intelligent clue analysis system provided by an embodiment of the present invention.

icon:

11-first extraction module; 12-second extraction module; 13-preliminary clue module; 14-case clue module.

detailed description

The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

A large amount of data comparison and analysis in the prior art is done manually, which is time-consuming and labor-intensive, and the search cycle is relatively long. During the search time, hackers may commit crimes again, causing economic losses or inconvenience to others. Based on this, an intelligent clue analysis method and system provided by the embodiments of the present invention can improve the richness of clues through target alarm data, preliminary clues and case clues, wherein the existing alarm data is analyzed into preliminary clues, and then the Preliminary clues are automatically converted into high-level and available case clues, which greatly solves the problem of manpower and time, thereby reducing the difficulty of investigation and analysis of clues.

In order to facilitate the understanding of this embodiment, an intelligent clue analysis method disclosed in the embodiment of the present invention is first introduced in detail.

Embodiment one:

Referring to FIG. 1, an embodiment of the present invention provides an intelligent clue analysis method, wherein the method includes the following steps:

Step S101, extract the alarm data provided by the third-party platform from the alarm library.

In the embodiment of the present invention, the third-party platform includes one or more of SOC, APT, and G01. APT can refer to advanced persistent threats, which are targeted attacks in essence. APT uses advanced attack methods to carry out long-term continuous network attacks on attack targets. Compared with other attack forms, APT’s attack forms are more advanced and advanced. Target system for precise collection. The alarm data provided by the third-party platform can correspond to different cases. For example, the alarm data of Article 1-10 corresponds to Case A, the alarm data of Article 11-15 corresponds to Case B, and the alarm data of Article 16-100 corresponds to Case C.

Step S102, extracting at least one preset rule from the rule base;

In the embodiment of the present invention, the preset rules include fixed rules and custom rules, wherein the fixed rules include but are not limited to: DGA analysis, WEBSHELL analysis, C&C remote connection analysis, targeted WEB attack detection analysis, SMB remote overflow attack Events, one-sentence WEB backdoor blasting, SSH brute force cracking, RDP brute force cracking, FTP brute force cracking. Custom rules can be added in a custom way, where a custom rule has multiple fields, and the fields of a custom rule include but are not limited to: rule name, effective start and end time, device type, threat type, data source, usage scenario, attack source configuration and attack target configuration.

Step S103, matching the alarm data with at least one preset rule to obtain target alarm data;

In the embodiment of the present invention, the alarm data includes target alarm data matching the preset rules and invalid alarm data irrelevant to the preset rules. It should be noted that the target alarm data is data that matches successfully and is valid alarm data. In the embodiment of the present invention, the alarm data matching at least one preset rule can be manually and manually screened, or the matching can be realized through a third-party service software or platform with Python analysis, which will not be repeated here.

Step S104, processing the target alarm data to obtain preliminary clues;

The processing in this embodiment includes cluster analysis, that is, the target alarm data is automatically converted into preliminary clues of a case after cluster analysis. Cluster analysis refers to classifying the target alarm data, concretizing the preliminary clues, and obtaining preliminary clues associated with the same case. The number of preliminary clues can be 0. Referring to Fig. 2, the present embodiment provides a preliminary clue diagram corresponding to preliminary clues. The preliminary clue diagram shows 3 attack targets and 1 attack source. The information between the attack source and any attack target is an attack chain. A chain consists of multiple alarm data. Therefore, the preliminary clue consists of at least one attack chain, wherein each attack chain is determined by at least one target alarm data. The target alert data on each attack chain has the same or similar characteristics.

Step S105, based on the preset clue matching rule, it is judged whether there is a case corresponding to the preliminary clue in the preset case database.

In the embodiment of the present invention, the preset clue matching rules include but not limited to: IP address of unit assets, website information and unit information. The cases in the preset case database are established by the clue analysis method of this embodiment, see step S107 and step S109 of this embodiment for details. The default case database can be an empty set. Specifically, when the clue analysis method in this embodiment is run for the first time, no case has been filed before, so there is no case in the default case database. With the sequential execution of each step in this embodiment, continuous case filing operations can be performed, so the preset case database can also contain multiple cases. In this embodiment, there is no limitation on the number of cases that can be stored in the preset case database. In addition, this embodiment can also display the cases in the default case database on the client, so that relevant personnel can process the cases in the preset case database. Cases are graded.

Step S106, if it exists, check the case status of the case.

In the embodiment of the present invention, all the cases in the default case database have their own case status, and the case status includes but not limited to ongoing, detected and abandoned. Among them, in progress is also referred to as filing a case.

Step S108, if the case status is in progress, expand the preliminary clues to the case clue database of the case to obtain updated case clues.

In the embodiment of the present invention, the preliminary clues with the IP address of the same unit asset are associated with the case, and then the existing case clues and preliminary clues of the above-mentioned case in the case clue database together form the updated case clues. In practical applications, by matching the IP address of the attack target and the IP address of the attack source, it is confirmed whether the preliminary clues are the same case, and the website attacks of the same case under the same unit are grouped into case clues. A company or department is regarded as a unit for case clues, and each website under the same unit can involve multiple preliminary clues, and one preliminary clue can involve multiple websites. Referring to Figure 3, the case clues correspond to the case clue diagram, and the case clues are more real and effective than the preliminary clues.

An intelligent clue analysis method provided by an embodiment of the present invention includes: extracting the alarm data provided by the third-party platform from the alarm library; extracting at least one preset rule from the rule library; comparing the alarm data with at least one preset rule Match to obtain the target alarm data; process the target alarm data to obtain preliminary clues; judge whether there is a case corresponding to the preliminary clue in the preset case database based on the preset clue matching rules; if there is, check the case status of the case; if If the case status is in progress, the preliminary clues are expanded to the case clue database of the case to obtain updated case clues. The target alarm data, preliminary clues and case clues in the embodiment of the present invention increase the richness of clues, analyze the existing alarm data into preliminary clues, and then automatically convert the preliminary clues into high-level available case clues, which greatly solves the problem Manpower and time issues, thus reducing the difficulty of investigation and analysis of clues.

In an embodiment of the present invention, referring to FIG. 4, the method further includes the following steps:

Step S107, if it does not exist, generate a case corresponding to the preliminary clue in the preset case database, and expand the preliminary clue as a case clue into the case clue database of the case.

In the embodiment of the present invention, if the case corresponding to the preliminary clue does not exist in the preset case database, a case corresponding to the preliminary clue is automatically generated in the preset case database, and the case is a newly added case. In addition, the preliminary clue can be displayed on the client terminal as the case clue of the case, so that relevant personnel can judge whether to open the case, and confirm the case status of the case.

Step S109, if the state of the case is solved or abandoned, generate a case corresponding to the preliminary clue in the preset case database, and expand the preliminary clue as a case clue to the case of the case in the clue library.

In the embodiment of the present invention, each case has a case status, and whether the case exists or not and the case status when the case exists both determine the specific operation on the preliminary clues matching the case. For example, if a case exists and the case status is in progress or on file, the preliminary clues will be automatically expanded to the existing case clues of the case to form a new case clue, and the new case clue will be displayed on the client, so that relevant The personnel reconfirms the case status of the case; when the case exists and the case status is detected or abandoned, the preliminary clues will not be effective for the case, and a new case can be automatically generated and displayed on the client , so that relevant personnel can confirm whether the new case is filed and the corresponding status.

For example, multiple FTP alarm data can match FTP brute-force cracking rules to generate preliminary FTP brute-force cracking clues, and generate FTP brute-force cracking attack case clues for a website through preset clue matching rules. FTP brute-force cracking case clues on this website or other websites, the initial clues of FTP brute-force cracking cases will be automatically expanded to a certain unit’s brute-force cracking case clues, and displayed on the client to enable relevant personnel to confirm whether the incident is true and valid, and whether the case is filed .

When expanding the line, if there are 5 initial clues involved in the existing case clues of a certain case, there are 5 attack chains. In the existing case clues, instead of creating a new case clue, that is, as long as the case is not over, the case clues will continue to accumulate attack chains, making the case clues more accurate. Real-time line expansion can greatly improve the real-time effectiveness of case clues and reduce the difficulty of investigation and analysis of clues.

The embodiments of the present invention can improve the accuracy and richness of clues, obtain clues more quickly, reduce manpower input, and reduce analysis time. Therefore, the embodiment of the present invention can help units and websites know the attack as early as possible, avoid losses or help the police to investigate cases.

Embodiment two:

Referring to Fig. 5, an embodiment of the present invention provides an intelligent clue analysis system, which includes: a first extraction module 11, a second extraction module 12, a preliminary clue module 13 and a case clue module 14;

The first extraction module 11 is used to extract the alarm data provided by the third-party platform from the alarm library;

The second extraction module 12 is used to extract at least one preset rule from the rule base;

The preliminary clue module 13 establishes connections with the first extraction module 11 and the second extraction module 12 respectively, and is used to match the alarm data with at least one preset rule to obtain the target alarm data; it is also used to process the target alarm data to obtain preliminary leads;

The case lead module 14 is used to judge whether there is a case corresponding to the preliminary lead in the preset case storehouse based on the preset lead matching rule; if it exists, then check the case status of the case; Link to the case clue database of the case to obtain the updated case clues of the case.

In the embodiment of the present invention, the intelligent clue analysis system provided by this embodiment matches various preset rules in the rule base on the basis of obtaining alarm data such as APT, and finally analyzes various case clues. In this embodiment, multiple target alarm data are automatically aggregated and analyzed into preliminary clues, and then a case clue of a case is formed from the preliminary clues, which is convenient for investigation work.

A kind of intelligent clue analysis system provided by the present invention comprises: a first extraction module 11, a second extraction module 12, a preliminary clue module 13 and a case clue module 14; the first extraction module 11 is used to extract the first The alarm data provided by the three-party platform; the second extraction module 12 is used to extract at least one preset rule from the rule base; the preliminary clue module 13 is connected with the first extraction module 11 and the second extraction module 12 respectively, and is used for alarming The data is matched with at least one preset rule to obtain the target alarm data; it is also used to process the target alarm data to obtain preliminary clues; the case clue module 14 is used to judge whether there is The case corresponding to the preliminary clue; if it exists, check the case status of the case; if the case status is in progress, expand the preliminary clue to the case clue database of the case to obtain the updated case clue. The target alarm data, preliminary clues and case clues in the embodiment of the present invention increase the richness of clues, analyze the existing alarm data into preliminary clues, and then automatically convert the preliminary clues into high-level available case clues, which greatly solves the problem Manpower and time issues, thus reducing the difficulty of investigation and analysis of clues.

Further, the intelligent clue analysis system also includes:

The first generation module, if it does not exist, generates a case corresponding to the preliminary clue in the preset case database, and expands the preliminary clue as a case clue into the case clue database of the case;

or,

The second generation module, if the state of the case is detected or abandoned, then generate a case corresponding to the preliminary clue in the preset case database, and expand the preliminary clue as a case clue to the case in the case clue database.

Further, the preset rules include fixed rules and custom rules, and the rule base includes fixed rule bases and custom rule bases;

In the embodiment of the present invention, the fixed rule base is used to store fixed rules; the custom rule base is used to store custom rules.

Further, the fixed rules include: DGA analysis, WEBSHELL analysis, C&C remote connection analysis, targeted WEB attack detection analysis, SMB remote overflow attack event, one sentence WEB backdoor blasting, SSH brute force cracking, RDP brute force cracking, FTP brute force cracking one or more of .

Further, the custom rule includes one or more of the following fields: rule name, effective start and end time, device type, threat type, data source, usage scenario, attack source configuration, and attack target configuration.

Further, the configuration of the attack source includes: one or more of the attack source, whether intelligence matches, whether feature similarity judgment, attack threshold, and attack feature.

Further, the configuration of the attack target includes: one or more of the attack target, whether the intelligence matches, the domain name of the attack target, the threshold of attack times, and the industry of the attack target.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or part of code that includes one or more Executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified function or action , or may be implemented by a combination of dedicated hardware and computer instructions.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In addition, in the description of the embodiments of the present invention, unless otherwise specified and limited, the terms "installation", "connection" and "connection" should be interpreted in a broad sense, for example, it can be a fixed connection or a detachable connection , or integrally connected; may be mechanically connected, may also be electrically connected; may be directly connected, may also be indirectly connected through an intermediary, and may be internal communication between two components. Those of ordinary skill in the art can understand the specific meanings of the above terms in the present invention in specific situations.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

The computer program product of the intelligent clue analysis method provided by the embodiments of the present invention includes a computer-readable storage medium storing program codes, and the instructions included in the program codes can be used to execute the methods described in the foregoing method embodiments, specifically For implementation, reference may be made to the method embodiments, which will not be repeated here.

In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" etc. The indicated orientation or positional relationship is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the referred device or element must have a specific orientation, or in a specific orientation. construction and operation, therefore, should not be construed as limiting the invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and should not be construed as indicating or implying relative importance.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (9)

1. An intelligent cue analysis method, comprising:

extracting alarm data provided by a third-party platform from an alarm library;

extracting at least one preset rule from a rule base;

matching the alarm data with the at least one preset rule to obtain target alarm data; the target alarm data is alarm data successfully matched with the at least one preset rule;

processing the target alarm data to obtain a preliminary clue; the preliminary clue consists of at least one attack chain, wherein each attack chain is determined by at least one target alarm data; the information between the attack source and any attack target is an attack chain;

judging whether a case corresponding to the preliminary clue exists in a preset case library or not based on a preset clue matching rule; the preset clue matching rule comprises the following steps: IP address, website information and unit information of the unit assets;

if the situation exists, the preliminary clue is used as a case clue of the case and is displayed on a client, so that related personnel can view the case state of the case through the client and carry out confirmation operation on the case state of the case;

if the case state is in progress, the preliminary clues are expanded to a case clue library of the case to obtain case clues updated by the case;

the step of expanding the preliminary clue to a case clue library of the case to obtain the case clue of the case update comprises the following steps: associating the preliminary clue with the case, and then combining the existing case clue of the case in the case clue library with the preliminary clue to form a case clue for updating the case;

the method further comprises the following steps:

displaying the cases in the preset case library on the client, so that the related personnel can process the cases in the preset case library through the client; wherein, processing the case in the preset case library at least comprises: modifying the case state and/or deleting the case and/or grading the case.

2. The method of claim 1, further comprising:

if not, generating a case corresponding to the preliminary clue in the preset case library, and extending the preliminary clue serving as a case clue to a case clue library of the case;

or the like, or, alternatively,

and if the case state is detected or abandoned, generating a case corresponding to the preliminary clue in the preset case library, and using the preliminary clue as a case clue to expand the case clue to the case clue library of the case.

3. The cue analysis method of claim 1 wherein the third party platform comprises one or more of SOC, APT, G01.

4. An intelligent cue analysis system, comprising: the system comprises a first extraction module, a second extraction module, a preliminary clue module and a case clue module;

the first extraction module is used for extracting the alarm data provided by the third-party platform from the alarm library;

the second extraction module is used for extracting at least one preset rule from the rule base;

the preliminary clue module is respectively connected with the first extraction module and the second extraction module and is used for matching the alarm data with the at least one preset rule to obtain target alarm data; the target alarm data is alarm data successfully matched with the at least one preset rule; the system is also used for processing the target alarm data to obtain a preliminary clue; the preliminary clue consists of at least one attack chain, wherein each attack chain is determined by at least one target alarm data; the information between the attack source and any attack target is an attack chain;

the case clue module is used for judging whether cases corresponding to the preliminary clues exist in a preset case library or not based on a preset clue matching rule; if the case exists, the preliminary clue is used as a case clue of the case and is displayed on a client side, so that related personnel can view the case state of the case through the client side and carry out confirmation operation on the case state of the case; if the case state is in progress, the preliminary clue is expanded to a case clue library of the case to obtain a case clue of the case update; the preset clue matching rule comprises the following steps: IP address, website information and unit information of the unit asset;

the case thread module is further configured to: associating the preliminary clue with the case, and then combining the existing case clue of the case in the case clue library with the preliminary clue to form a case clue for updating the case;

the case thread module is further configured to: displaying the cases in the preset case library on the client, so that related personnel can process the cases in the preset case library through the client; wherein, processing the cases in the preset case library at least comprises: modifying the case status and/or deleting the case and/or grading the case.

5. The cue analysis system of claim 4 wherein the pre-set rules comprise fixed rules and custom rules, and wherein the rule base comprises a fixed rule base and a custom rule base;

the fixed rule base is used for storing the fixed rules;

and the custom rule base is used for storing the custom rule.

6. The cue analysis system of claim 5 wherein the fixed rule comprises: DGA analysis, WEBSHELL analysis, C & C remote loop analysis, targeted WEB attack detection analysis, SMB remote overflow attack event, one-sentence WEB backdoor blasting, SSH brute force cracking, RDP brute force cracking and FTP brute force cracking.

7. The cue analysis system of claim 5 wherein the custom rule comprises one or more of the following fields: rule name, effective start-stop time, device type, threat type, data source, usage scenario, attack source configuration, and attack target configuration.

8. The cue analysis system of claim 7 wherein the attack source configuration comprises: attack source, whether intelligence is matched, whether feature similarity is judged, attack threshold and attack features.

9. The cue analysis system of claim 8 wherein the attack target configuration comprises: attack target, whether intelligence is matched, attack target domain name, attack frequency threshold and one or more of attack target industry.

Images