Internal apt attack detection and early warning system of power system based on network architecture

Abstract

The invention provides an electric power system interior APT attack detection and pre-warning system based on network architecture. The system comprises a user terminal monitoring sub-system, a server monitoring sub-system and a cloud platform management sub-system. According to the characteristic that APT attacks are all pervasive, the APT attack detection and pre-warning system containing a user terminal and a system server is designed. The detection and pre-warning system has the common network security management function, meanwhile conducts analysis of exceptions on logs and events, and excavates and repairs loopholes of the system, after a network system is suffered from the APT attacks, data of attacked equipment can be quickly restored, and the system assists security managers in reversely tracking an attack source.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a detection and early warning system for APT attacks. Background technique [0002] Advanced persistent threat (Advanced Persistent Threat, APT) is a complex, multi-faceted, long-term and persistent cyber attack against a specific organization. It is a type of cybercrime for commercial and political purposes. It has the characteristics of long-term operation and planning, and high concealment. [0003] According to the intrusion method, APT attacks are divided into two types: one is to attack the company's public server, and then use the server as a springboard to attack the company's internal network. This type of attack is called external APT attack; the other is to attack the company's employees. This type of attack is known as an internal APT attack, which is more difficult to prevent and more concealed. [0004] APT attacks have been discovered many times in r...

AI Technical Summary

Problems solved by technology

[0007] (2) The attacker launches an infection attack on the home computer, personal computer and other computers that can access the Internet of the relevant staff of the nuclear power plant, and further infects the U disk of the relevant personnel

[0015] At present, there are still many problems in the network information security of electric power enterprises: insufficient construction of information organization, imperfect security legal system, lagging information management, dependence on foreign countries for software and hardware, and weak security awareness, etc.

These problems have increased the difficulty for power companies to deal with APT attacks

Images