Sample homology analysis method based on dynamic behavior chain and dynamic characteristics

Abstract

The invention provides a sample homology analysis method based on a dynamic behavior chain and dynamic characteristics. The method comprises the following steps: 1, collecting and sorting attack samples; 2, classifying the training sample set; 3, putting the training sample set into a sandbox for operation; 4, sorting the samples to generate a dynamic behavior chain; 5, training a homologous analysis decision tree model by using a behavior chain extracted from the training data set; 6, extracting a behavior chain and sample IOCs information; 7, enabling the test data set to judge the APT organization to which the test data set belongs or the malicious family and type to which the test data set belongs through the decision tree model; 8, subjecting the test data set to fuzzy matching with IOCs information through a knowledge base, and obtaining homologous information; 9, obtaining a final homologous analysis conclusion. According to the method, the effect of carrying out sample homologous analysis based on the dynamic behavior chain and the dynamic characteristics on the malicious samples starting from the dynamic behavior is achieved, and the practical problems of single sample characteristic, low manual analysis efficiency, high investment and the like caused by a traditional homologous analysis means are solved.

Description

[0001] 1. Technical field [0002] The invention provides a sample homologous analysis method based on dynamic behavior chains and dynamic features, which relates to a malicious sample homologous analysis technology and belongs to the technical field of network security. [0003] 2. Background technology [0004] Facing the increasingly frequent Advanced Persistent Threat-APT incidents targeting the government, military industry, aerospace, energy, education, medical care, high-tech units and enterprises, as well as the increasing number of APT organizations, there are endless attack samples It is becoming more and more important to carry out correlation and homology analysis from samples to organizations, from samples to events and then to criminal organizations behind the scenes. It can not only contribute to the defense of APT attacks, but also to trace the source of attacks Analysis provides strong data support. [0005] Now, the same-origin analysis of APT organizations h...

AI Technical Summary

Problems solved by technology

However, the current mainstream homology analysis technology cannot meet the requirements in terms of recognition ability, response time and work efficiency.

Images