Method and system for defense against APT attacks

Abstract

The application provides a method and system for defense against advanced persistent threat APT attacks. The method for defense against the advanced persistent threat APT attacks comprises the following steps: obtaining communication data in a network; performing association analysis on the communication data, and screening out the threat data in the communication data according to the results ofthe association analysis; mapping each piece of threat data to a corresponding APT attack stage separately, wherein the APT attack stage is defined according to the kill chain model; and performing defense on the network entity related to each piece of threat data according to the defense strategy corresponding to the plurality of APT attack stages. According to the method and system for defense against the advanced persistent threat APT attacks, the threat data is mapped to the corresponding APT attack stage, and corresponding defense strategies are taken for different APT attack stages, therefore, the APT attack processing is more targeted, and the APT attacks can be detected and defended more effectively.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method and system for defending against APT attacks. Background technique [0002] APT (Advanced Persistent Threat, Advanced Persistent Threat) is usually launched by professional hacker organizations and state-level hackers to launch targeted attacks on governments, energy, finance, and enterprises. APT attacks often have a complete and well-planned attack process. [0003] The characteristics of APT attacks are: [0004] 1) The purpose of attack is becoming more and more clear, and the scope of attack is becoming more and more focused. The field of attack has expanded from simple computer networks to industrial control systems, and it is increasingly targeting large enterprises, national infrastructure, and key equipment. [0005] 2) Attack behavior is difficult to detect. Because APT attacks generally use 0day vulnerabilities, new Trojan horses, and phi...

AI Technical Summary

Problems solved by technology

[0005] 2) Attack behavior is difficult to detect

[0007] In view of the above characteristics of APT attacks, the traditional network security defense mechanism is difficult to play a role in the confrontation with APT, and the research and implementation of a comprehensive defense model to deal with APT attacks is imminent

Images