A Sample Homology Analysis Method Based on Dynamic Behavior Chain and Dynamic Features

Abstract

The present invention provides a sample homology analysis method based on dynamic behavior chains and dynamic features. The steps are as follows: 1: Collect and organize attack samples; 2: Classify and process the training sample set; 3: Put the training sample set into sandbox operation; 4: Sort the samples to generate a dynamic behavior chain; 5: Use the behavior chain extracted from the training data set to train the same-origin analysis decision tree model; 6: Extract the behavior chain and sample IOCs information; 7: Test the data set through the decision tree The model judges the APT organization it belongs to, or the malicious family and type it belongs to; 8: the test data set fuzzily matches the IOCs information through the knowledge base, and obtains the homology information; 9: draws the final homology analysis conclusion; the present invention achieves the goal of starting from dynamic behavior , the effect of sample homology analysis based on dynamic behavior chains and dynamic characteristics on malicious samples solves the practical problems of single sample characteristics caused by traditional homology analysis methods, low efficiency of manual analysis and large investment.

Description

[0001] 1. Technical field [0002] The invention provides a sample homologous analysis method based on dynamic behavior chains and dynamic features, which relates to a malicious sample homologous analysis technology and belongs to the technical field of network security. [0003] 2. Background technology [0004] Facing the increasingly frequent Advanced Persistent Threat-APT incidents targeting the government, military industry, aerospace, energy, education, medical care, high-tech units and enterprises, as well as the increasing number of APT organizations, there are endless attack samples It is becoming more and more important to carry out correlation and homology analysis from samples to organizations, from samples to events and then to criminal organizations behind the scenes. It can not only contribute to the defense of APT attacks, but also to trace the source of attacks Analysis provides strong data support. [0005] Now, the same-origin analysis of APT organizations h...

AI Technical Summary

Problems solved by technology

However, the current mainstream homology analysis technology cannot meet the requirements in terms of recognition ability, response time and work efficiency.

Images