APT attack behavior analysis and detection method and device based on cascade attack chain model

Abstract

The invention belongs to the technical field of network security, in particular to an APT attack behavior analysis and detection method and device based on a cascaded attack chain model, and the method comprises the steps: collecting multi-source heterogeneous network data, representing an attack process through the recursive structure of a plurality of sub-attack chains, forming an attack chain overall structure in a sub-attack chain cascading mode, and constructing the cascaded attack chain model; and based on the cascade attack chain model, analyzing and detecting APT attack behaviors in the network, and reconstructing an APT attack scene. According to the method, the limitation of the prior art is overcome, the APT attack behavior is effectively recognized and analyzed, the defect thatan existing analysis method excessively depends on manual analysis is overcome, the accuracy of attack behavior detection is improved, and the method can be conveniently applied to actual analysis.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to an APT attack behavior analysis and detection method and device based on a cascade attack chain model. Background technique [0002] In the current network environment, in the current network environment, network attacks emerge in an endless stream, and network attacks are becoming increasingly complex, persistent, and concealed. main threat. Due to the advanced nature, persistence and unknown nature of APT attacks, the existing detection methods are gradually difficult to deal with, and it is difficult for people to detect them at the beginning of the attack. Very low yield. Therefore, intrusion detection has always been a hot issue in the field of network security research, and the attack chain model is a description model of attack behavior that has been studied more in intrusion detection. Specifically, the attack chain model is a general attack behavior descripti...

AI Technical Summary

Problems solved by technology

[0004] To this end, the present invention provides a method and device for analyzing and detecting APT attack behaviors based on the cascaded attack chain model, which overcomes the limitations of the prior art, effectively identifies and analyzes APT attack behaviors, and makes up for excessive manual analysis in existing analysis methods. Dependent defects, improve the accuracy of attack behavior detection, and facilitate the application in actual analysis

Images