A method for locating intrusion infected areas based on computer timing dependent network

Abstract

The invention discloses an invading infection region positioning method based on a computer time sequence dependence network. The method includes the steps of constructing the complete object time sequence dependence network according to an access record, collected in a computer system, of all processes to computer objects; pruning the complete time sequence dependence network, and extracting an object time sequence dependence sub-network related to invading; constructing a Bayesian network according to the object time sequence dependence sub-network; carrying out probabilistic reasoning through the Bayesian network, calculating and quantizing the possibility that other unknown objects in the system suffer from invading infection, and obtaining an invading infection region of the computer system. The method has the advantages that the time-information-combined object dependence network is constructed, and the time sequence dependence relation among the objects and the characteristic that the object infection state is changed along with the time change can be more accurately described; a probabilistic reasoning method is provided for positioning the invading infection region.

Description

technical field [0001] The invention relates to the field of computer security, in particular to a method for locating an intrusion infection area based on a computer timing dependent network. Background technique [0002] With the advancement of social informatization, the application of computers has penetrated into all aspects of people's lives. However, the subsequent computer-related security problems also seriously affect people's production and life. Although there are endless security protection measures for computer systems, computer systems are still inevitably invaded and destroyed by attackers. Therefore, after the computer system is invaded and destroyed, it is very important to quickly and accurately locate the infected area of ​​the intrusion. At the same time, this also provides an important basis for intrusion recovery and system vulnerability repair. [0003] Most of the existing methods and technologies are based on causal analysis, which establishes the...

AI Technical Summary

Problems solved by technology

In reality, due to the explosion of information dependencies caused by the complexity of information flow in the computer, it is very difficult to accurately locate the source of intrusion.

In addition, even with byte-level fine-grained information flow tracking technology, it is difficult to establish accurate information dependencies. For example, technologies related to dynamic taint analysis may miss some information dependencies due to the problem of "taint bleaching". Pollution" problem will cause false positives of information dependencies

Images