System and method for detecting APT attacks based on DNS log analysis

Abstract

A system for detecting APT attacks based on DNS log analysis comprises a DNS query log recording module, a log analysis module and an attack detection module. Detection of the APT attacks is achieved through the detection system. A method for detecting the APT attacks based on DNS log analysis includes the steps that firstly, DNS query requests are collected through the DNS query log recording module, and then DNS query logs are formed; secondly, pattern matching is conducted on the DNS query logs and SSH login attempt information through the log analysis module, and computing time density, the coverage area and time correlation are analyzed; thirdly, the SSH login attempt information is grouped according to a source IP address; fourthly, the attack detection module judges whether the attacks happen or not and determines the types of the attacks according to the result of the log analysis module. The method is in a lightweight class attack detection mode, consumed resources are far smaller than resources required for analyzing whole network flow, the log analysis mode is adopted, a network does not need to be monitored in real time, and therefore the network is hardly affected.

Description

technical field [0001] The invention relates to a detection system and method for high persistent attacks in the field of computer network security, in particular to an APT attack detection system and method based on DNS log analysis for SSH scanning and password blasting. Background technique [0002] Computer network has become an important facility for sharing resources and information, and the widespread use of the network has led to new social, ethical and political issues. APT (Advanced Persistent Threat, Advanced Persistent Threat) is a network attack and intrusion against customers launched by hackers for the purpose of stealing core data. It is a long-planned "malicious commercial espionage threat". This kind of behavior is often operated and planned for a long time, and has a high degree of concealment. The attack method of APT is to hide oneself and steal data in a long-term, planned and organized manner for specific objects. This behavior of stealing data and co...

AI Technical Summary

Problems solved by technology

However, for analyzing potential threats from massive data, the above defense measures have loopholes, and it is difficult to analyze all massive data, which may miss potential APT attacks

Images