APT detection correlation analysis method based on graph algorithm

Abstract

The APT detection correlation analysis method based on the graph algorithm provided by the invention comprises the following steps: acquiring terminal user behavior data and kernel-level data generated by a detection system to obtain original audit log data; storing the original audit log data into a database with a graph algorithm; performing TTP rule matching on the original audit log data according to an ATT & CK knowledge base model to obtain an alarm event; and evaluating the strength of the dependency relationship between the alarm events by utilizing the path correlation degree, constructing an APT attack scene graph, and promoting the original audit log data to an APT attack step. According to the method, the APT activity is detected with high accuracy and low false alarm rate by analyzing the correlation between suspicious information flows of an attacker at an attack stage, so that the ongoing attack activity can be summarized and backtracked effectively in real time, the real-time network response activity is helped to be carried out, and the visualization of an attack scene is realized.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to an APT detection association analysis method based on a graph algorithm. Background technique [0002] Advanced persistent threat (Advanced Persistent Threat, APT) is an attack form that uses advanced attack methods to carry out long-term persistent network attacks on specific targets. The principle of APT attack is more advanced and advanced than other attack forms. Its advanced nature is mainly reflected in the fact that APT needs to accurately collect the business process and target system of the attack object before launching the attack. During the collection process, this attack will actively dig out the vulnerabilities of the trusted system and application of the attacked target, use these vulnerabilities to build the network required by the attacker, and use 0day vulnerabilities to attack. [0003] APT attacks are mainly carried out against import...

AI Technical Summary

Problems solved by technology

[0005] First, traditional firewalls, intrusion detection, security gateways, anti-virus software and anti-spam systems and other detection technologies mainly detect at the network boundary and host boundary, and they all lack the ability to detect and correlate APT attacks, especially 0day attacks. ability

[0006] Second, the existing rule-based APT threat detection engine cannot effectively correlate a large number of alarm events, or can only use some ready-made indicators such as time stamps for simple correlation, and lacks an understanding of the complex relationship between alarms and actual intrusions. It is also impossible to correlate attack events that occurred on different hosts over a long period of time into an overall threat event

On the other hand, the relatively weak correlation analysis ability will also cause a high false positive rate of detection.

Images