APT attack behavior analysis and detection method and device based on cascade attack chain model

Abstract

The invention belongs to the technical field of network security, and in particular relates to a method and device for analyzing and detecting APT attack behaviors based on a cascaded attack chain model. During the attack process, the overall structure of the attack chain is formed through the cascading form of sub-attack chains, and the cascading attack chain model is constructed; based on the cascading attack chain model, the APT attack behavior in the network is analyzed and detected, and the APT attack scene is reconstructed. The present invention overcomes the limitations of the prior art, effectively identifies and analyzes APT attack behaviors, makes up for the defect of excessive reliance on manual analysis in existing analysis methods, improves the accuracy of attack behavior detection, and facilitates application in actual analysis.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to an APT attack behavior analysis and detection method and device based on a cascade attack chain model. Background technique [0002] In the current network environment, in the current network environment, network attacks emerge in an endless stream, and network attacks are becoming increasingly complex, persistent, and concealed. main threat. Due to the advanced nature, persistence and unknown nature of APT attacks, the existing detection methods are gradually difficult to deal with, and it is difficult for people to detect them at the beginning of the attack. Very low yield. Therefore, intrusion detection has always been a hot issue in the field of network security research, and the attack chain model is a description model of attack behavior that has been studied more in intrusion detection. Specifically, the attack chain model is a general attack behavior descripti...

AI Technical Summary

Problems solved by technology

[0004] To this end, the present invention provides a method and device for analyzing and detecting APT attack behaviors based on the cascaded attack chain model, which overcomes the limitations of the prior art, effectively identifies and analyzes APT attack behaviors, and makes up for excessive manual analysis in existing analysis methods. Dependent defects, improve the accuracy of attack behavior detection, and facilitate the application in actual analysis

Images