Advanced persistent threat trapping system and method

Abstract

The invention provides an advanced persistent threat trapping system and method. The system comprises an application-type honeypot, an application data capture module and an application client proxy module. According to the system provided by the invention, the application data capture module is deployed in a switch, a security data filtering product or a background audit system, suspicious data or flows are directed to the application client proxy module, and the application client proxy module sends the data to the application-type honeypot. The application-type honeypot is close to a real service system server, and can effectively confuse attackers. Long-term availability of the application-type honeypot in the system facilitates the analysis and evidence discovery of advanced persistent threats, and the application-type honeypot can share the threats of the normal service server system at the same time.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to an advanced sustainable threat trapping system and method. Background technique [0002] Advanced sustainable threats are based on traditional attack threats, further upgraded to targeted attacks, attacks that can be latent for a long time, and most of them threaten important units such as enterprises, governments, military or factories. The current main method of countering advanced persistent threat attacks is to automatically analyze and determine unknown malicious code, and assume that the source of capture is on key servers and gateways, but the problem is that unknown programs cannot be fully captured, and for Intranet attackers cannot be detected. In addition, due to the tracking and analysis of unknown programs in the actual business server, the cost is high and it is difficult to implement. Passively detect unknown malicious code, but cannot actively obtain sus...

AI Technical Summary

Problems solved by technology

The current main method of countering advanced persistent threat attacks is to automatically analyze and determine unknown malicious code, and assume that the source of capture is on key servers and gateways, but the problem is that unknown programs cannot be fully captured, and for Intranet attackers are undetectable

And due to the tracking and analysis of unknown programs in the actual business server, the cost is high and it is difficult to implement

Passively detect unknown malicious code, but cannot actively obtain suspicious data

Images