APT threat identification method

Abstract

The invention discloses an APT threat identification method. The method comprises the steps of establishing a normal data behavior model; establishing an APT attack life cycle simulation model; and establishing a threat visualization association analysis data behavior model. Through establishment of a normal data behavior model, periodical association analysis is carried out on log data of varioussources so as to find abnormal data, suspicious APT attack behaviors and the like. An APT attack behavior and an attack path can be simulated by establishing an APT attack life cycle simulation model, and suspicious APT attack actions can be found in advance. And the danger degree is judged according to the actual action after the device is actually operated. A comprehensive data real-time correlation analysis platform based on the Zunyi power supply bureau network environment is developed, and APT attack visualization in the user environment is achieved through a static analysis module, a dynamic analysis module and a behavior detection correlation analysis module.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an APT threat identification method. Background technique [0002] APT (Advanced Persistent Threat) -------- advanced persistent threat. It refers to the attack form in which organizations (especially governments) or small groups use advanced attack methods to carry out long-term and continuous network attacks on specific targets. The principle of APT attack is more advanced and advanced than other attack forms. Its advanced nature is mainly reflected in the fact that APT needs to accurately collect the business process and target system of the attack object before launching an attack. During the collection process, the attack It will actively dig out the vulnerabilities of the trusted system and application program of the attacked object, and form the C&C network required by the attacker based on these vulnerabilities. This behavior does not take any actions that may t...

AI Technical Summary

Problems solved by technology

However, for threats lurking in the analysis of massive data, the above defense measures have loopholes, and it is difficult to analyze all massive data, so lurking APT attacks may be missed

Images