“…For example, "Stuxnet virus" attacking Bushehr nuclear power plant in Iran, "Aurora attack" against Google mail server, "BlackEnergy" attack against Ukrainian power grid, etc. Although the information security personnel of the enterprise have deployed a large number of security devices in the network, some attacks will still bypass all protective measures and go straight to the enterprise, resulting in the leakage, damage or tampering of important data assets [1]. Therefore, it is necessary to find the threats hidden in the network in time through technical means, quickly find the malicious behaviors in the threats as soon as possible, accurately locate the target and the source of the attack, and judge and trace the intrusion path and attacker background, so as to solve the security threats in the enterprise network from the source and reduce the losses caused by the security threats to the enterprise as much as possible [2].…”