Method and device carrying out path backtracking for system attack

Abstract

The invention relates to a method and a device carrying out path backtracking for system attack. The method comprises steps that, Netflow data, routing topology data and router information are acquired; a system attack safety event is acquired; on the basis of the system attack safety event and the acquired Netflow data, the routing topology data and the router information, path backtracking for the system attack is carried out by utilizing a breadth transversal method. Through the method, Internet attack emergency response processing efficiency can be effectively improved.

Description

technical field [0001] The present disclosure relates to the technical field of network and information security, and in particular, relates to a method and device for backtracking a system attack path. Background technique [0002] In order to cope with the increasingly rampant DDoS (Distributed Denial of Service, Distributed Denial of Service) attacks, it is necessary to monitor and analyze the attack traffic; currently there are three main methods of traffic monitoring and analysis: monitoring technology based on full mirroring of network traffic, based on SNMP (Simple Network Management Protocol, Simple Network Management Protocol) monitoring technology and Netflow-based monitoring technology. [0003] Through comparison, it is found that Netflow-based monitoring technology is more suitable for large networks. China Telecom has deployed a Netflow-based abnormal traffic monitoring system and attack traceability analysis system for real-time abnormal traffic attack monitor...

AI Technical Summary

Problems solved by technology

[0004] However, when the existing traceability system is applied to attack traceability and investigation on the live network, it relies more on the manual analysis of security experts, and cannot analyze the path of attack traffic, which seriously affects the processing time of attack response.

Images