US 2025/0159008 A1 · FULL-SCENE CYBERSECURITY THREAT-RELATED ANALYSIS METHOD AND SYSTEM THEREOF

Full-scene cybersecurity threat-related analysis method and system thereof

AssigneesInformation and Communication Branch of State Grid Henan Electric Power Corporation, State Grid Henan Electric Power Company, Beijing University of Posts and Telecommunications

InventorsFangfang Dang, Lijing Yan, Shuai Li, Shaoyong Guo, Ying Yang, Dingding Li, Hao Wang, Qidi Jiao, Zhiying Wang

Life of this patent

Estimating the term…

Abstract

A full-scene cybersecurity threat-related analysis method and a system thereof include: obtaining cybersecurity-related data, wherein the cybersecurity-related data includes network flow values at a plurality of predetermined time points within a predetermined time length and a network log of the predetermined time length; extracting a network flow chronological feature of the network flow values at the plurality of predetermined time points; extracting a log semantics feature of the network log; fusing the network flow chronological feature and the log semantics feature to obtain a network flow-log semantics cross-fusion feature; and determining a mode of attacker's behaviors based on the network flow-log semantics cross-fusion feature. Thus, it is possible to intelligently identify a mode of attacker's behaviors and detect a potential threat in the network.

Claims10

Dependent claims

A full-scene cybersecurity threat-related analysis method, comprising the steps of:

obtaining cybersecurity-related data, including network flow values at a plurality of predetermined time points within a predetermined time length and a network log of said predetermined time length;
extracting a network flow chronological feature of said network flow values at said plurality of predetermined time points;
extracting a log semantics feature of said network log;
fusing said network flow chronological feature and said log semantics feature to obtain a network flow-log semantics cross-fusion feature;
and
determining a mode of attacker's behaviors based on said network flow-log semantics cross-fusion feature.

3 more elements

A full-scene cybersecurity threat-related analysis system, comprising:

a cybersecurity-related data obtaining module used to obtain cybersecurity-related data, wherein the cybersecurity-related data includes network flow values at a plurality of predetermined time points within a predetermined time length and a network log of the predetermined time length;
a network flow chronological feature extracting module used to extract a network flow chronological feature of said network flow values at said plurality of predetermined time points;
a log semantics feature extracting module used to extract a log semantics feature of said network log;
a feature fusing module used to fuse said network flow chronological feature and said log semantics feature, so as to obtain a network flow-log semantics cross-fusion feature;
and
an attacker's behavior mode determining module used to determine a mode of attacker's behaviors based on said network flow-log semantics cross-fusion feature.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application

18/942,758Filed 10 Nov 2024

Priority

CN 202311496634.610 Nov 2023

Published

15 May 2025

Term ends

Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis
Y02D 30/50
Reducing energy consumption in communication networks: in wire-line communication networks, e.g. low power modes or reduced link rate