APT multi-dimensional detection and defense system and method

Abstract

The invention provides an APT multi-dimensional detection and defense system and method. The system comprises two or more detection modules and a dimension expansion module, wherein the detection modules are allocated to all dimensions and used for detecting objects to be detected in the current dimensions, recording behaviors of the objects to be detected and detection results, screening out dimension detection expansion information according to preset screening rules and transmitting the dimension detection expansion information to the dimension expansion module; the dimension expansion module acquires dimension detection expansion information transmitted by the detection modules, performs projection association on the dimension detection expansion information according to preset dimension association rules to generate detection rules and screening rules available to other dimensions, and transmits detection rules and screening rules to the detection modules in corresponding dimensions. The invention further provides the corresponding detection and defense method. By means of the APT multi-dimensional detection and defense system and method, the detection and defense system can be updated automatically to obtain detectability of other dimensions.

Description

technical field [0001] The invention relates to the field of network security, in particular to a system and method for multi-dimensional detection and defense against APT. Background technique [0002] APT attack is a kind of high-level network attack. Specifically, it is a continuous attack behavior carried out by unauthorized individuals and groups using various attack methods and advanced attack methods on the victim target for a long time. The common purpose of APT attack is to destroy the victim target. system, stealing victim information, classic APT incidents include Stuxnet, Duqu, Flame, etc. [0003] According to the analysis of typical APT events, the attackers often have rich economic, technical, intelligence and other resources, and can effectively break through the defense of the security system. After analyzing the recent typical events, an APT event starts from attacking and enters the victim system. The span of discovery by the victim often ranges from seve...

AI Technical Summary

Problems solved by technology

[0007] The invention provides a system and method for multi-dimensional detection and defense against APT, which solves the problem that the traditional security defense system can only detect a single dimension at a single time point or time period, and cannot perform comprehensive detection, so that the defense detection system can realize Self-updating to gain detection capabilities in other dimensions

Images