APT firewall

Abstract

The invention relates to the field of information security, and specifically, the invention relates to an APT firewall system. An extranet interface module 101, an abnormal flow detection module 102, an intranet interface module 103, an abnormal association module 104, a retrospective evaluation module 105 and a host program monitoring module 106 are integrated in the system for detecting the flow of an extranet and an intranet in real time, monitoring the program process in real time and further decomposing and identifying abnormal flow and abnormal behaviors containing APT threats so as to locate the APT threat level, intercept the APT communication, clear the APT Trojan program and eliminate the threat attacks and the potential safety hazards.

Description

technical field [0001] The patent of the present invention relates to the field of information security, in particular, the present invention relates to an APT firewall system. Background technique [0002] APT is the abbreviation of Advanced Persistent Threat in English, that is, advanced persistent threat. [0003] An APT attack is a persistent attack launched against a specific target using various attack methods. The purpose of APT attack is very clear. APT is a network attack and intrusion behavior launched by hackers for the purpose of stealing core data. It is a long-planned "malicious espionage threat". This kind of behavior is often operated and planned for a long time, and has a high degree of concealment. APT's attack method is to hide itself and steal data in a long-term, planned and organized manner for specific objects. [0004] The general process of an APT attack is as follows: First, the attacker collects user-related information through various means, in...

AI Technical Summary

Problems solved by technology

[0005] Traditional firewalls can do nothing about this, and there is no suitable solution to APT attacks. Therefore, a firewall system for APT attacks is very necessary

Images