Attack link based website backdoor use event identifying method

Abstract

The invention relates to an attack link based website backdoor use event identifying method. Background logs are analyzed. If attack behaviors are determined, normal access log data is abandoned and logs relating to the attack behaviors are kept. At the same time, the attack behaviors are identified and the attack types are classified and combined. Latitudes of IPs carried by the attack behaviorsand the attack types are acquired. The attack behaviors are divided into a plurality of phases. If the attack behaviors include at least three phases, whether the attack behaviors contain website backdoor access behaviors or not is detected. If the attack behaviors include at least three phases and the attack behaviors contain website backdoor access behaviors, website intrusion success is judgedand identification on the website backdoor use event and the server intrusion is implemented. According to the invention, judgment is made on influence caused by attack and complete intrusion analysisis formed. Attack behaviors from different sources are confirmed and classified and the original attack behavior validness is ensured. Further mining and attack chain analysis are performed, attack analysis difficulty is reduced and attack analysis efficiency is improved. Abnormal intrusion can be found quickly and safety response capability is improved.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegram communication, and in particular to an attack chain-based website backdoor utilization event identification method that can analyze the impact on intrusion events. Background technique [0002] Backdoor programs generally refer to program methods that bypass security controls to gain access to programs or systems. During the development phase of software, programmers often create backdoors in the software so that defects in the program design can be modified, but if these backdoors are known to others, or if the backdoors are not removed before the software is released, then it becomes a It is easy to be attacked by hackers as loopholes. [0003] Attacks can be detected. Traditional IDS (Intrusion Detection Systems, Intrusion Detection System) products rely on signatures to detect attack behaviors, but they can only detect a single attack...

AI Technical Summary

Problems solved by technology

Traditional IDS (Intrusion Detection Systems, Intrusion Detection System) products rely on signatures to detect attack behaviors, but they can only detect a single attack behavior, and cannot further correlate the attack to determine the impact of the attack

SOC (Security Operations Center, Security Management Center) product is a further security management analysis platform based on intrusion detection. It can analyze based on various attack logs and can correlate some attack behaviors, but it still depends on the IP latitude. However, it is impossible to judge the attack stage, and it is difficult to determine a truly successful website intrusion event

Images