Method and device for detecting and backtracking collapsed host based on real-time stream processing

Abstract

The invention discloses a method and a device for detecting and backtracking a collapsed host based on real-time stream processing, and relates to the technical scheme and device for discovering the collapsed host through an exception detection algorithm. According to the method, the network connection behavior of the host serves as an analysis standing point, a machine learning anomaly detectionalgorithm is realized by adopting a real-time stream processing technology, and massive historical data is brought into host behavior pattern recognition, so that the detection has more real-time andlanding. Meanwhile, the abnormal host flow is reserved, flow backtracking analysis can be carried out, and the accuracy of the detection result is improved. Meanwhile, the threat information is updated, and the research and judgment rate of the subsequent abnormal host is increased.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for detecting a compromised host based on real-time stream processing and backtracking. Background technique [0002] The CKC (Cyber ​​Kill Chain) model proposed by Lockheed Martin decomposes the advanced threat process. With the gradual deepening of the attack process, the target host locked by the attacker will go through several stages such as intrusion, control, and malicious behavior. . After the target host is compromised, it will establish a connection with the remote C&C server and continue to be controlled by the attacker. It will often be used as a springboard to launch scanning attacks, denial of service attacks, malicious website access, and vulnerability intrusions on new targets on the intranet or extranet. , data theft and a series of activities. [0003] Existing host security is mostly identified through anti-virus software deployed...

AI Technical Summary

Problems solved by technology

The detection of compromised host attacks based on signature signatures cannot provide early warning of new features, such as newly generated attack behaviors that have not been supplemented in the signature database; the behavior of compromised hosts is becoming more and more hidden, and it is becoming more and more difficult to identify based on statistical laws; simply The identification of compromised hosts based on threat intelligence is limited by the quality of threat intelligence; there is no effective historical retrospective means for the behavior process of compromised hosts, and this method has the limitation that it must be based on a specific scenario

Images