A serial dispersed hidden threat intrusion attack detection method and a serial dispersed hidden threat intrusion attack detection system

Abstract

The invention discloses a serial dispersed hidden threat intrusion attack detection method and system, and the method comprises the steps: detecting the unknown abnormal flow in the network flow through the research on an extensible application recognition technology and a hidden threat analysis detection technology. According to the extensible application identification technology, on the basis of a deep packet detection technology, the category of application layer identification is extended, different applications are evaluated from various dimensions, more information in network traffic ismined, and the deep application layer identification capability is provided. The distributed hidden intrusion threat analysis system is deployed in a network in a gateway mode, a series mode or a bypass mode, collects and analyzes the current network flow, timely finds an activity trace of a malicious file at the boundary of the network, and provides real-time security alarm, threat positioning and execution actions.

Description

technical field [0001] The invention discloses a method and system for detecting serial decentralized and concealed threat intrusion attacks, which belong to the technical field of network security defense. Background technique [0002] With the widespread popularity of various attack methods against industrialized information systems and the occurrence of more unknown attack events, traditional security technologies are mainly faced with the following difficulties: [0003] Most of the new threats emerging in the network are based on 0day vulnerabilities without vulnerability characteristics. Attack tools are changing with each passing day, and customized tools have appeared. For defenders, it is impossible to obtain attack samples through detection methods based on known threats. [0004] Among the most common threats are: [0005] APT (Advanced Persistent Threat), advanced persistent threat. It refers to the attack form in which organizations or small groups use advance...

AI Technical Summary

Problems solved by technology

[0003] Most of the new threats emerging in the network are based on 0day vulnerabilities without vulnerability characteristics. Attack tools are changing with each passing day, and customized tools have appeared. For defenders, it is impossible to obtain attack samples through detection methods based on known threats.

Images