APT defense system and defense method based on system elasticity

Abstract

The invention relates to the technical field of network security, and in particular relates to an APT defense system and an APT defense method based on system elasticity. In the defense method, data in a database is divided into key data and non-key data; distributing the key data to a plurality of physical locations, meanwhile, the key data is backed up and encrypted to form backup data, and thebackup data is physically isolated and stored; when the system detects an attack behavior, the completeness of the system is comprehensively detected, when the completeness detection of the system isnot passed, the physically isolated and stored backup data is decrypted and recovered, the decrypted and recovered backup data is used for reconstructing the system. According to the system and the method provided by the invention, the advantages of the attacker can be weakened by reconstructing the system when the system is subjected to the attack, and the condition that the system can operate normally and stably after being attacked is furthest ensured.

Description

technical field

[0001] The invention relates to the technical field of network security, in particular to an APT defense system based on system elasticity and a defense method thereof. Background technique

[0002] Advanced Persistent Threat (APT) is to use advanced and complex methods and technologies to conduct long-term and persistent cyber attacks on specific targets, thereby stealing key data of the target. The concept of APT attack was first proposed due to the "Stuxnet" virus attack on Iran's nuclear facilities in 2010, followed by exposure of a large number of government departments, institutions, and organizations. These incidents have different impacts on national security, business operations, social life and other aspects. For the field of information security and traditional network security defense, this is a huge threat.

[0003] Advanced Persistent Threat (Advanced Persistent Threat), where A-Advanced: Advanced means that the attacker has advanced attack mea...

Examples

Embodiment Construction

[0063] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments, but the protection scope of the present invention is not limited thereto.

[0064] Such as figure 1 As shown, the present invention utilizes the mutual response cooperation between the database server defense module and the terminal defense module, from the data distributed storage defense module, data security isolation module, probe real-time detection and monitoring module, terminal attack detection and event correlation analysis module , and the mutual coordination and cooperation of system integrity detection and adaptive heterogeneous reorganization modules to improve the redundancy of the system. When the system encounters an attack, the system reorganization can be used to weaken the advantage of the attacker, and to maximize the guarantee that the system will survive the attack. It can run normally and smoothly and reduce the i...

technical field

[0001] The invention relates to the technical field of network security, in particular to an APT defense system based on system elasticity and a defense method thereof. Background technique

[0002] Advanced Persistent Threat (APT) is to use advanced and complex methods and technologies to conduct long-term and persistent cyber attacks on specific targets, thereby stealing key data of the target. The concept of APT attack was first proposed due to the "Stuxnet" virus attack on Iran's nuclear facilities in 2010, followed by exposure of a large number of government departments, institutions, and organizations. These incidents have different impacts on national security, business operations, social life and other aspects. For the field of information security and traditional network security defense, this is a huge threat.

[0003] Advanced Persistent Threat (Advanced Persistent Threat), where A-Advanced: Advanced means that the attacker has advanced attack mea...

Examples

Embodiment Construction

[0063] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments, but the protection scope of the present invention is not limited thereto.

[0064] Such as figure 1 As shown, the present invention utilizes the mutual response cooperation between the database server defense module and the terminal defense module, from the data distributed storage defense module, data security isolation module, probe real-time detection and monitoring module, terminal attack detection and event correlation analysis module , and the mutual coordination and cooperation of system integrity detection and adaptive heterogeneous reorganization modules to improve the redundancy of the system. When the system encounters an attack, the system reorganization can be used to weaken the advantage of the attacker, and to maximize the guarantee that the system will survive the attack. It can run normally and smoothly and reduce the i...

Images