Rule-based detection method of ATP attack behavior

Abstract

The invention relates to the field of APT detection, and aims at providing a rule-based detection method of an ATP attack behavior. The rule-based detection method of the ATP attack behavior comprises the following steps: defining grammar used for creating an APT attack scene rule; creating the APT attack scene rule, and constituting an APT attack scene knowledge base; dispatching a rule analysis module to analyze and load the APT attack scene rule by an analysis module; collecting full flow of an application layer protocol by a collection module to obtain flow data; screening data; analyzing important alarm; identifying a behavior; and constituting processing of ATP attack behavior failure. With regard to the ATP attack behavior, multiple attach exposure points always exist in the entire attach process, backtracking association is carried out on related flow by the rule-based detection method provided by the invention on this basis, the traditional situation of matching features based on a single time point is changed, and association analysis is carried out on the data of a long time window to identify the complete attack intention of an attacker.

Description

technical field [0001] The invention relates to the field of APT (Advanced Persistent Threat, Advanced Persistent Threat) detection, in particular to a method for detecting APT attack behavior based on rules. Background technique [0002] An APT attack is a new type of attack and threat that is organized, has a specific target, is highly concealed, has great destructive power, and lasts for a long time. Its main features are: [0003] Strong ability to conceal a single attack source: In order to evade traditional detection systems, APT pays more attention to the concealment of dynamic behavior and static files. For example, avoiding the detection of network behavior through covert channels and encrypted channels, or preventing malicious code files from being identified by forging legal signatures, which brings great difficulties to traditional signature-based detection. [0004] There are many attack methods and the attack duration is long: APT attacks are divided into mult...

AI Technical Summary

Problems solved by technology

[0005] Based on the above characteristics reflected in APT attacks, it is difficult for the traditional defense methods based on real-time detection and real-time blocking to play an effective role

Images