Detecting method, terminal device, server and system of APT (Advanced Persistent Threat) attack

Abstract

The invention discloses a detecting method, a terminal device, a server and a system of an APT (Advanced Persistent Threat) attack relating to the technique field of information security, mainly aiming at detecting the APT attack rapidly and accurately. The main technical solution of the invention comprises that the terminal device records attribute information of a preset file in a local area network; the attribute information of the preset file comprises identification information, time information, source information and circulation object information; whether the preset file is a grey file is confirmed according to the attribute information; the grey file is neither stored in the white list of the preset file nor in the black list of the preset file; if it is confirmed that the preset file is the grey file, whether the grey file triggers a preset abnormal behavior rule is determined; if it is confirmed that the grey file triggers the preset abnormal behavior rule, abnormal alarm information that the grey file triggers the preset abnormal behavior rule is sent to the server; and the abnormal alarm information comprises the identification information of the terminal device. The invention is mainly applied in the detecting process of the APT attack.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to an APT attack detection method, a terminal device, a server and a system. Background technique [0002] With the continuous development of computer technology, the degree of informatization of human society is getting higher and higher, and the whole society is more and more dependent on computer information. At the same time, threats to the security of computer files are also increasing, and Advanced Persistent Threat (APT) has become one of the most serious threats in the field of information security, and it is a persistent network attack. [0003] The principle of APT attack is more advanced and advanced than other attack forms. Its advanced nature is mainly reflected in the fact that APT needs to accurately collect the business process and target system of the attack object before launching the attack. During the collection process, this attack will actively di...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the present invention provides an APT attack detection method, terminal equipment, server and system, the main purpose of which is to solve the problem of manual detection of APT attacks, which cannot detect APT attacks quickly and accurately, and may miss latent APT attacks , therefore, may seriously threaten the security of computer data information

Images