Advanced persistent threat detection method based on aggressive behavior analysis

Abstract

The invention provides an advanced persistent threat detection method based on aggressive behavior analysis. The advanced persistent threat detection method comprises the steps that 1, all system kernel program execution pipelines are taken over; 2, a network card is set to be in a confusion mode, network data packets are acquired, local port analysis behaviors are combined as characteristics, and a system gives an alarm if malicious operating instructions of network attack behaviors are contained; 3, all network channels are enumerated, and the system gives an alarm if the malicious operating instructions of the network attack behaviors are contained; 4, file operation is monitored, key information is judged, and the system gives an alarm if the requirements are not met; 5, captured software API information are submitted to an application layer from a kernel layer in a trans-boundary mode so as to be submitted to a behavior analysis engine, whether the behaviors are attack behaviors or not is judged, if so, an alarm is given, and if not, the step 2 repeated. The advanced persistent threat detection method can detect advanced persistent threats, is high in detection efficiency and more comprehensively analyzes the situations of the behaviors performing attacking at a system level.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an advanced persistent threat detection method based on attack behavior analysis. Background technique [0002] As the attacks in the network become more and more complex, their military and commercial impacts are also becoming wider and wider, and the complexity of the attacks makes advanced persistent detection more and more difficult. The development of this attack is specifically reflected in the fact that attackers continue to use Various attack methods, changing the existing attack methods, dormant for a long time after slowly and smoothly infiltrating the internal network, constantly obtaining relevant sensitive information in the network and trying to continue to elevate permissions until important sensitive information is obtained. For highly concealed attacks, it is necessary to discover and deal with them in a timely manner to protect the security of the main ...

AI Technical Summary

Problems solved by technology

Various studies have shown that although the malicious code used in advanced persistent threat attacks will continue to mutate, upgrade, and change, the frequency of change in the command channel mode that the malicious code finally builds is not high

Images