Abstract: An attack detection and source tracing method includes acquiring entities in a target network environment and interaction event information between the entities and constructing a network event graph with the entities and the interaction event information; determining a graph embedding vector of each interaction event information in the network event graph as feature information based on a preset attack feature recognition model and determining an attack event in the network event graph according to the feature information; determining dependencies between the attack event and remaining interaction event information in the network event graph and searching for a corresponding interaction event information as source tracing information of the attack event according to the dependencies.

Abstract: Provided are an active defense system and method for an unknown threat. The system includes an intelligent threat early-warning module (10), an unknown threat detection module (20) and a self-adaption defense processing module (30). The intelligent threat early-warning module (10) is configured to perform threat prediction on a power grid situation data set collected from a power information network in real time to obtain threat early-warning information and send the information to the unknown threat detection module (20). The unknown threat detection module (20) is configured to perform threat detection and analysis on collected unknown threat network data when receiving the threat early-warning information to generate a threat analysis report and send the report to the self-adaption defense processing module (30). The self-adaption defense processing module (30) is configured to trigger a defense processing operation corresponding to a preset threat defense strategy according to the threat analysis report.

Abstract: An attack detection and source tracing method includes acquiring entities in a target network environment and interaction event information between the entities and constructing a network event graph with the entities and the interaction event information; determining a graph embedding vector of each interaction event information in the network event graph as feature information based on a preset attack feature recognition model and determining an attack event in the network event graph according to the feature information; determining dependencies between the attack event and remaining interaction event information in the network event graph and searching for a corresponding interaction event information as source tracing information of the attack event according to the dependencies.

Abstract: Provided are an active defense system and method for an unknown threat. The system includes an intelligent threat early-warning module (10), an unknown threat detection module (20) and a self-adaption defense processing module (30). The intelligent threat early-warning module (10) is configured to perform threat prediction on a power grid situation data set collected from a power information network in real time to obtain threat early-warning information and send the information to the unknown threat detection module (20). The unknown threat detection module (20) is configured to perform threat detection and analysis on collected unknown threat network data when receiving the threat early-warning information to generate a threat analysis report and send the report to the self-adaption defense processing module (30). The self-adaption defense processing module (30) is configured to trigger a defense processing operation corresponding to a preset threat defense strategy according to the threat analysis report.