网络安全管理威胁事件资讯数据

安全管理-日志分析与审计： 威胁事件资讯库为日志分析提供关键参考，结合日志数据，快速识别异常行为和可疑活动，支持深入调查。 安全管理-态势感知： 安全管理平台利用威胁事件资讯库实时感知威胁态势，通过关联分析和预警，为团队提供及时响应建议。 网络基础架构安全-防火墙： 防火墙集成威胁事件资讯库，深度检测网络流量，对比特征以准确识别并拦截恶意流量，提升防护能力。 端点安全-终端防病毒： 防病毒软件利用资讯库实时更新病毒库和策略，快速检测清除与资讯库中已知威胁相关的恶意软件。 端点安全-终端安全管理： 安全管理软件结合资讯库监控终端应用、进程和文件，识别异常行为，确保合规与安全。 端点安全-EDR： EDR系统利用资讯库精准识别终端异常和潜在威胁，深度分析数据并快速响应处置安全事件。 端点安全-主机/服务器加固： 威胁事件资讯库为主机/服务器加固提供参考，分析攻击模式，采取加固措施增强防护能力。 物联网安全-车联网安全： 车联网安全领域，资讯库收集分析相关威胁事件，了解安全风险和漏洞，制定防护措施保护车辆和乘客。数据采集：通过事件采集系统获取网络安全攻击相关事件，内容包括但不限于攻击事件名称、事件类型、相关域名情报，相关hash情报等。

数据清洗：对采集到的数据进行结构化转换和标准化处理，清洗不必要的字段，并进行多维信息的聚合。以更好地满足后续对威胁事件资讯进行数据分析和生产的需求。

数据加工：
利用AI大模型、LSTM+CRF算法等技术进行自然语言处理和安全文章分析，分析摘要内容，提取相关IOC、黑客组织、恶意家族、攻击事件等威胁情报关键信息。

Security Management - Log Analysis and Auditing: The threat event knowledge base offers critical references for log analysis. Combined with log data, it enables rapid identification of abnormal behaviors and suspicious activities, and supports in-depth investigations.
Security Management - Situation Awareness: The security management platform leverages the threat event knowledge base to perceive threat situations in real time, and provides timely response suggestions for the team via correlation analysis and early warning.
Network Infrastructure Security - Firewall: The firewall integrates the threat event knowledge base to perform in-depth detection of network traffic, compare feature signatures to accurately identify and block malicious traffic, thereby enhancing protection capabilities.
Endpoint Security - Endpoint Antivirus: The antivirus software utilizes the knowledge base to update virus databases and policies in real time, and quickly detects and eliminates malicious software associated with known threats in the knowledge base.
Endpoint Security - Endpoint Security Management: The security management software combines the knowledge base to monitor terminal applications, processes and files, identifies abnormal behaviors, and ensures compliance and security.
Endpoint Security - EDR: The EDR system makes use of the knowledge base to accurately identify terminal anomalies and potential threats, conducts in-depth data analysis, and quickly responds to and handles security incidents.
Endpoint Security - Host/Server Hardening: The threat event knowledge base provides references for host/server hardening, analyzes attack patterns, and adopts hardening measures to strengthen protection capabilities.
IoT Security - Internet of Vehicles (IoV) Security: In the field of IoV security, the knowledge base collects and analyzes relevant threat events to understand security risks and vulnerabilities, and formulates protective measures to safeguard vehicles and passengers.

Data Collection: Obtain network security attack-related events through an event collection system. The content includes but is not limited to attack event names, event types, relevant domain intelligence, relevant hash intelligence, and other related information.

Data Cleaning: Perform structured conversion and standardization processing on the collected data, remove unnecessary fields, and aggregate multi-dimensional information, so as to better meet the requirements of subsequent data analysis and production of threat event intelligence.

Data Processing: Use technologies such as AI Large Language Models (LLM) and LSTM+CRF algorithms to conduct natural language processing and security article analysis, analyze abstract content, and extract key threat intelligence information including relevant Indicators of Compromise (IOCs), hacker organizations, malicious families, attack events, and other related threat intelligence.

搜集汇总

数据集介绍

特点

该数据集由杭州安恒信息技术股份有限公司提供，包含501条网络安全威胁事件资讯数据，每日更新。数据涵盖事件名称、类型、描述、相关域名情报等关键信息，适用于安全管理、网络基础架构安全、端点安全等多个应用场景。