Host-oriented suspicious network connection identification method

Abstract

The invention discloses a host-oriented suspicious network connection identification method. The host-oriented suspicious network connection identification method comprises the steps of: (A), determining various network connection characteristics used for realizing network connection type clustering, and constructing a multi-dimensional space based on the network connection characteristics, so that each network connection is mapped into one point in the multi-dimensional space; and (B), collecting all in and out network flow of an appointed host within a unit time period, mapping all network connections in the flows to the points in the multi-dimensional space constructed in the step (A) one by one, clustering the mapped points to obtain multiple sub-types composed of the points corresponding to the network connections, and judging that all the network connections corresponding to the sub-types, the point number of which is less than the appointed threshold value, as suspicious network connections. By means of the host-oriented suspicious network connection identification method disclosed by the invention, the suspicious network connections are continuously tracked, so that detection and continuous tracking of all kinds of APT attacks can be realized.

Description

technical field [0001] The invention belongs to the field of methods for identifying abnormal network traffic, and in particular relates to a host-oriented method for identifying suspicious network connections. Background technique [0002] At present, APT (Advanced Persistent Threat) attack has become an important attack method that seriously threatens the security of information systems. It has the characteristics of rapid changes and no obvious attack characteristics. Attackers can use it to steal and tamper with information systems. and destruction purposes. The detection of APT attacks is a current difficulty. [0003] At present, many APT attack detection methods use malicious code detection, that is, to detect APT attacks by detecting the spread of malicious code in APT attacks. Detection of code propagation can lead to false negatives. [0004] Although APT attacks have no obvious attack characteristics, we found through research on existing APT attacks that an AP...

AI Technical Summary

Problems solved by technology

[0003] At present, many APT attack detection methods use malicious code detection, that is, to detect APT attacks by detecting the spread of malicious code in APT attacks. However, many APT attacks use methods such as social engineering to implant Trojan horses. Detection of code propagation can lead to false negatives

[0004] Although APT attacks have no obvious attack characteristics, we have found through research on existing APT attacks that an APT attack often Causes a lot of suspicious network connections