Network threat analysis method and system

Abstract

The invention discloses a network threat analysis method and system. The English name of the network threat analysis system is ThreatAnalysis Center (hereinafter referred to as TAC for short). Known and unknown malicious software and files entering a network through a webpage, an e-mail or other online file sharing modes can be effectively detected, APT attack behaviors utilizing 0day vulnerabilities are discovered, and a client network is protected from various risks caused by attacks such as 0day. According to the TAC system, a multi-core virtualization platform is adopted, and higher performance and higher detection rate are achieved through a parallel virtual environment detection and stream processing mode. The system comprises four core detection assemblies: a reputation detection engine, a virus detection engine, a static detection engine (including vulnerability detection and shellcode detection) and a dynamic sandbox detection engine, through parallel detection of multiple detection technologies, a 0day attack and an unknown attack can be effectively detected while a known threat is detected, so that an advanced sustainable threat can be effectively monitored.

Description

technical field [0001] The invention belongs to the field of computer network security, and specifically relates to a network threat analysis system, which is used to protect customer networks from various risks caused by 0day attacks. Background technique [0002] Today, governments and businesses alike face an ever-evolving cyber threat environment. The original hacker attack was to attack media websites for the purpose of gaining influence and self-satisfaction, but now it has evolved into an attack for economic and political purposes. Attackers can directly obtain benefits by stealing intellectual property rights, and can also invade and steal customers' personal financial information, or even directly encrypt documents and carry out naked extortion, and what's more, destroy the other party's services and even the country's infrastructure. The change in motivation also brought about a change in the way of attack. From the widespread and aimless attack threat in the pas...

AI Technical Summary

Problems solved by technology

[0013] In the use of these methods, various problems have been found, including high false positive rate, a large number of missed negative problems, and high requirements for security managers, so that most organizations cannot make the product play the expected detection role. Therefore, it has not been widely recognized by the market

Images