Security defense method, device and electronic equipment for advanced persistent threats

Abstract

The embodiment of the invention provides a security defense method and device for advanced persistent threats and electronic equipment, and the method comprises the steps: building countermeasure models of an attack party and a defense party in the attack process based on the characteristics of the attack party and the defense party of the advanced persistent threats in the attack process; utilizing an income model of an asymmetric information game to carry out formalized description on the asymmetry of the information acquired by the attacking and defending parties in the attack process; based on the adversarial model and the income model of the asymmetric information game, predicting the traffic probability of the advanced persistent threat for each feasible attack path through forward solving; and based on the passing probability, obtaining an optimal defense strategy for the advanced persistent threat so as to carry out security defense. According to the embodiment of the invention, advanced persistent threats can be detected and defended more comprehensively, accurately and effectively, so that the data information security of a user can be ensured more effectively.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of network security, and more specifically, relate to a security defense method, device and electronic equipment for advanced persistent threats (Advanced Persistent Threat, APT). Background technique [0002] At present, the threat of network attack and information theft has seriously affected the data and information security of computer network and communication network space. Among the many current security threats, there is a new type of attack with a very long duration, called advanced persistent threat attack APT. APT attacks have the characteristics of strong targeting, high concealment, multi-dimensional methods, and not easy to be detected. [0003] Some of the existing network security technologies still rely on means such as firewalls, intrusion detection and anti-virus software, which are static and one-sided passive defenses. These passive defense technologies are attack...

AI Technical Summary

Problems solved by technology

However, since these active protection technologies mainly detect and analyze the attack event itself, when faced with organized, targeted, and highly concealed APT attacks, they often lose their defensive performance due to the difficulty of effective detection, and cannot guarantee user data. information security

Images