A method and device for identifying advanced persistent threat attacks

Abstract

The invention discloses an advanced persistent threat attack recognition method. An APT attack comprises a first stage, a second stage and a third stage. The advanced persistent threat attack recognition method comprises the steps that an attack event is detected; the detected attack event is recorded, and APT attack stage classified recording is performed according to the characteristics of the attack event; and when the recording includes the attack event of the third stage, the attack event of the third stage is correlated with the attack event of the first stage and the second stage suffered by the attacked object, and the attack event is confirmed to be the APT attack event when the correlated attack event has an external source. The invention also discloses an advanced persistent threat attack recognition device.

Description

technical field [0001] The invention relates to network security defense technology, in particular to a method and device for identifying advanced persistent threat attacks. Background technique [0002] Facing the increasingly severe network security situation, how to continuously improve the defense capabilities against network attacks, and how to detect and quickly and effectively deal with network attacks are the core issues that organizations and enterprise IT departments are concerned about. With the development of virtualization and cloud computing technologies, the degree of virtualization of large data centers is getting higher and higher, and network boundaries are becoming increasingly blurred. At the same time, advanced persistent threat (Advanced Persistent Threat, APT) attacks have become the focus of public attention. APT attacks are also known as "target-specific" attacks. New types of attacks; APT attacks use various advanced attack methods and social engin...

AI Technical Summary

Problems solved by technology

[0005] However, the discovery and judgment of attack behavior by the existing network security protection detection system is based on known security vulnerabilities and defects, known Trojan horse behaviors and characteristics, and for Trojan horse behaviors using unknown or deformed security vulnerabilities and defects, positions or deformations and features, unknown attack behaviors, and APT attacks with unknown encrypted content are difficult to achieve security protection detection

Images