APT detection method and system based on invasion route

Abstract

The invention relates to an APT detection method and system based on an invasion route. The APT detection method based on the invasion route comprises the following steps: S1, carrying out knowledge base modeling on an invasion route area; S2, acquiring behavior data, i.e., acquiring host behavior data and acquiring network behavior data; S3, carrying out association analysis on results obtained through the behavior data acquisition; S4, preserving evidence, i.e., recovering attack risk behaviors for evidence preservation; and S5, presenting the evidence. The APT detection system based on the invasion route comprises an evidence presentation module, a behavior evidence association analysis module, a knowledge base module, an evidence preservation module, and an evidence collection module. The method and system provided by the invention has the beneficial effects that invasion by an APT attacker is intercepted at a source, so that preventive measures can be taken for the invasion route, and low-cost and highly-efficient construction can be achieved; an acquisition process is concealed and totally transparent, so that network loads are avoided; and evidence presentation is easy to use and can be simply operated.

Description

technical field [0001] The invention relates to the technical field of APT threat detection, in particular to an APT threat detection method and system based on an intrusion path. Background technique [0002] Finance and government are the main target industries of APT attacks, as high as 84% ​​and 77% respectively. Next is telecommunications with 66%, the military with 64%, industrial enterprises with 54%, and others with 14%. E-mail and social networking sites have become the main channels for hackers to launch APT attacks. Emails are used up to 68%, and social networking sites are used up to 65%. Email and social networking sites even surpass traditional hacking avenues such as viruses, malicious links, and phishing sites. [0003] Through this trend, we can see that with the popularity of social networks in recent years, traditional enterprise security protection methods have been unable to effectively control social networks, and email has always been the hardest hit...

AI Technical Summary

Problems solved by technology

[0004] The main reason why APT attacks make it difficult for the attackers to defend is that its unique attack methods and methods are difficult to detect

Images