Apt event attack organization homology analysis method and apparatus

Abstract

The invention discloses an apt event attack organization homology analysis method and apparatus. The method comprises the following steps: obtaining a mail to be analyzed and extracting metadata comprising sender information, receiver addressor information, addressee information, a theme, a text or an appendix; analyzing the metadata and obtaining correlation behavior feature information; comparing the behavior feature information with preset conditions, and based on comparison results, setting weights; calculating a weight sum, and when the weight sum is higher than a preset threshold, consuming that an event is a suspected apt event, and storing the event into an apt event behavior database; and analyzing each apt event in the apt event behavior database by use of a cluster algorithm, and determining an apt event whose similarity is higher than a preset value is initiated by a homologous attack organization. According to the technical scheme provided by the invention, the apt event can be effectively identified, and classified division of attack organizations of the apt event can be realized.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a homology analysis method and device for an apt event attack organization. Background technique [0002] APT (Advanced Persistent Threat) ------ advanced persistent threat is an attack form that uses advanced attack methods to carry out long-term and persistent network attacks on specific targets. [0003] In view of the increasingly severe APT attack incidents, APT attacks have long been planned and organized for specific objects to collect a large amount of accurate information about user business processes and target system usage, and widely use 0day vulnerabilities, covert communication, signature spoofing, social engineering The intrusion of computer science and other attack methods poses a great threat to the security of information systems. Therefore, the effective discovery of APT attacks and further discovery of their attacking organizations has become the...

AI Technical Summary

Problems solved by technology

[0004] In APT attacks, the proportion of incidents preceded by emails is far greater than other methods, and for an attack organization, in order to balance costs and benefits, it may be difficult for the attack organization to launch attacks against different specific targets. Continuing to use the same or similar attack method, infection method or malicious code, etc.

Images