APT heuristic detection method and system based on abnormal component association

Abstract

The invention provides an APT heuristic detection method and system based on abnormal component association. The method includes the steps of monitoring all startup processes in the system; recordingcall relations and component environment information of all components and buffering the call relations and the component environment information into a cache knowledge base; recording call relationsand component environment information of components newly acquired by the system; matching the call relations and the component environment information of the newly-acquired components with the cacheknowledge base, and determining whether the components in the system are abnormal based on matching rules; if yes, making an alarm to users and performing risk prompting, or else storing the call relations and the component environment information of the newly-acquired components into the cache knowledge base. The invention further provides a corresponding system and a storage medium. Through themethod, detect modularization, engineering, high concealment and complex APT attacks can be effectively detected.

Description

Technical field [0001] The invention relates to the technical field of computer network security, in particular to an APT heuristic detection method and system based on abnormal component association. Background technique [0002] APT attacks are an advanced sustainable threat. APT attacks have extremely high concealment, pertinence, and complexity. More and more functions are implemented in a componentized and modular manner. Component generally refers to an independent individual that can complete a function or part of a function, including but not limited to executable programs, dynamic link libraries, etc. Component-based functions require association calls between components. Component association refers to the relationship formed between components to achieve functions, including but not limited to dynamic link library methods, process call methods, etc. The attack behavior of delivering attack payloads in batches. The batch time span of such attack delivery components is ...

AI Technical Summary

Problems solved by technology

[0003] Based on the above-mentioned problems, the present invention proposes an APT heuristic detection method and system based on abnormal component association, and determines whether the component is abnormal through the component association relationship, and solves the complex attack method that cannot detect APT in the traditional method

Images