Precise network attack detection and early warning platform

Abstract

The invention discloses a precise network attack detection and early warning platform. The precise network attack detection and early warning platform comprises a multi-engine sandbox subsystem, an auxiliary detection subsystem and a data analysis subsystem; the data analysis subsystem comprises a correlation analysis system and a big data architecture-based data analysis system, and the correlation analysis system comprises a sandbox intermediate result correlation module, an alarm rule correlation module, an alarm and flow correlation module and a flow modeling analysis module; the auxiliarydetection subsystem comprises an AV module and an IDS module, According to the platform, a layered defense structure is adopted to divide the system into an auxiliary detection subsystem system whichfocuses on known threat detection, a multi-engine sandbox detection subsystem which focuses on malicious behavior detection and a data analysis subsystem; for each stage of the APT attack, the accurate network attack detection and early warning platform can perform effective detection and timely early warning on the APT attack in the stages of single-point breakthrough, back door installation, secret channel establishment, data stealing and the like.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a precise network attack detection and early warning platform. Background technique [0002] Advanced persistent threat (Advanced Persistent Threat, referred to as APT) is a kind of network information system that can bypass various traditional security detection and protection measures, and steal the core data and various information of the network information system by means of careful camouflage, targeted attacks, long-term latency, and continuous penetration. Type of intelligence attacks. Facts have proved that traditional security devices are no longer able to resist complex and hidden APT attacks. [0003] The framework of the traditional security defense system generally includes: access control, security isolation, border detection / defense, terminal defense, network audit, access control, etc. The security products involved include: firewall, IDS / IPS, anti-virus...

AI Technical Summary

Problems solved by technology

However, according to the above analysis, due to the concealment and particularity of APT attacks, traditional security devices are usually unable to effectively detect the various stages of APT attacks, and cannot generate corresponding alarms. Security personnel spend a lot of energy on alarm logs Analysis is often futile

If the idea of ​​full-flow collection is adopted, on the one hand, storage is inconvenient, and the full-flow data generated every day will take up too much storage space, and organizations usually do not have enough resources to support long-term storage; on the other hand, full-flow data includes Structured data, unstructured data, covering multiple formats such as video, pictures, text, etc., cannot be formatted and retrieved directly, and security personnel cannot find valuable information from massive data

Images