Advanced threat tracing method and system

Abstract

The invention provides an advanced threat tracing method and system. The method comprises the following steps: acquiring an advanced threat tracing feature by statically and dynamically analyzing an advanced threat sample, and generating an advanced threat tracing packet; resolving the advanced threat tracing packet through a client; detecting files in a system by using the tracing feature; judging whether advanced threats exist or not; and tracing the files in which the threats exist. Through adoption of the method and the system, the defect that the advanced threats cannot be detected effectively in the prior art is overcome; the system information security is maintained more effectively; attacks are defended; attacks or further attacks to the system caused by potential advanced threats are prevented; and the advanced threats are effectively prevented from attacking or making a large scale of attacks to other equipment by taking a specified terminal as a spring board. Thus, rapid and effective whole-network advanced threat detection is realized.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a method and system for tracing advanced threats. Background technique [0002] Today's network threats have risen to the level of national strategy, and network attacks have also changed from malicious attacks against the public without a clear purpose to advanced threat attacks with specific goals for the purpose of launching information warfare. Because traditional anti-malware software uses a blacklist mechanism and relies on simple signature scanning technology as the core technology, advanced threats are a combination of a series of dynamic attack behaviors, which cannot be detected by signature technology, and many advanced threats use System vulnerabilities and other technologies make traditional security software unable to defend. Contents of the invention [0003] Aiming at the deficiencies and defects of the above-mentioned existing technologies...

AI Technical Summary

Problems solved by technology

Because traditional anti-malware software uses a blacklist mechanism and relies on simple signature scanning technology as the core technology, advanced threats are a combination of a series of dynamic attack behaviors, which cannot be detected by signature technology, and many advanced threats use System vulnerabilities and other technologies, which make traditional security software unable to defend

Images