Looking for breakthrough ideas for innovation challenges? Try Patsnap Eureka!

Method and device for tracking apt organization, storage medium, electronic device

An organization, IP address technology, applied in the field of network security, can solve the problems of network attack defense lag, no solution found, etc., to achieve the effect of improving the ability of analysis, tracking and positioning

Active Publication Date: 2021-11-23
BEIJING QIANXIN TECH
View PDF8 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

At present, there is no plan to obtain threat intelligence in advance when these attacks occur in a small area, and carry out early warning and defense on a large scale
Defenses leading to cyberattacks lag
[0005] For the above-mentioned problems existing in related technologies, no effective solution has been found yet

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Method and device for tracking apt organization, storage medium, electronic device
  • Method and device for tracking apt organization, storage medium, electronic device
  • Method and device for tracking apt organization, storage medium, electronic device

Examples

Experimental program
Comparison scheme
Effect test

Embodiment 1

[0029] The method embodiment provided in Embodiment 1 of the present application may be executed on a server or a similar computing device. Take running on the server as an example, figure 1 It is a block diagram of the hardware structure of the tracking server of an APT organization in the embodiment of the present invention. Such as figure 1 As shown, the server 10 may include one or more ( figure 1Only one is shown in ) processor 102 (processor 102 may include but not limited to processing devices such as microprocessor MCU or programmable logic device FPGA) and memory 104 for storing data. Optionally, the above-mentioned server can also be A transmission device 106 for communication functions and an input and output device 108 are included. Those of ordinary skill in the art can understand that, figure 1 The shown structure is only for illustration, and it does not limit the structure of the above server. For example, server 10 may also include figure 1 more or fewer...

Embodiment 2

[0058] In this embodiment, there is also provided a tracking device for an APT organization, which may be a server, and the device is used to implement the above-mentioned embodiments and preferred implementation modes, and those that have already been described will not be repeated. As used below, the term "module" may be a combination of software and / or hardware that realizes a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementations in hardware, or a combination of software and hardware are also possible and contemplated.

[0059] Figure 5 is a structural block diagram of the tracking device of the APT organization according to the embodiment of the present invention, which can be applied in the server, such as Figure 5 As shown, the device includes: a determination module 50, a tracking module 52, and a judging module 54, wherein,

[0060] Determining module 50, for determining the assoc...

Embodiment 3

[0069] An embodiment of the present invention also provides a storage medium, in which a computer program is stored, wherein the computer program is set to execute the steps in any one of the above method embodiments when running.

[0070] Optionally, in this embodiment, the above-mentioned storage medium may be configured to store a computer program for performing the following steps:

[0071] S1, determining the associated IP address of the malicious sample;

[0072] S2, tracking the associated IP address and domain name information associated with the associated IP address;

[0073] S3. Determine whether the malicious sample is an attack sample delivered by an advanced persistent threat (APT) organization according to the associated IP address and / or the domain name information.

[0074] Optionally, in this embodiment, the above-mentioned storage medium may include but not limited to: U disk, read-only memory (Read-Only Memory, ROM for short), random access memory (Random ...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The present invention provides a tracking method and device, a storage medium, and an electronic device for an APT organization, wherein the method includes: determining an associated IP address of a malicious sample; tracking the associated IP address, and the associated IP address Domain name information: judging whether the malicious sample is an attack sample delivered by an advanced persistent threat (APT) organization according to the associated IP address and / or the domain name information. The invention solves the technical problem in the related art that the APT organization cannot be tracked according to malicious samples.

Description

technical field [0001] The present invention relates to the field of network security, in particular to an APT organization tracking method and device, a storage medium, and an electronic device. Background technique [0002] A network attack is an attack on an electronic device by a hacker or a Trojan horse, which causes huge losses to users by stealing files. [0003] When tracking and discovering advanced persistent threat (Advanced Persistent Threat, APT) groups, context analysis is mainly based on malicious files, phishing emails and other attacks in network transmission. Attackers use malicious programs to intrude and control networks and information systems to steal sensitive data and damage systems and network environments. It is urgent to improve the detection rate and batch analysis capabilities of malicious samples spread in enterprise networks. [0004] In related technologies, in the field of computer security, network attacks are becoming more and more special...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Patents(China)
IPC IPC(8): H04L29/06H04L9/06
CPCH04L9/0643H04L63/1441
Inventor 白敏黄朝文
Owner BEIJING QIANXIN TECH
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Patsnap Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Patsnap Eureka Blog
Learn More
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic, Popular Technical Reports.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap|About US| Contact US: help@patsnap.com