Network attack tracing method and device

Abstract

The invention relates to a network attack tracing method and device. The method comprises the following steps: obtaining each abnormal host and a login behavior relation graph of each abnormal host, wherein the login behavior relation graph comprises login behaviors occurring between the abnormal host and the behavior association host, the abnormal host is a host where network abnormality occurs,the behavior association host is a host logging in the abnormal host, and / or the behavior association host is a host logged in by the abnormal host; obtaining a sub-attack graph generated by each abnormal host, the sub-attack graph comprising a link from a starting process to an attack process; and generating a network attack graph according to the sub-attack graph of each abnormal host and the login behavior relationship graph, the network attack graph including the sub-attack graph of the abnormal host, and the sub-attack graphs of different abnormal hosts being connected according to loginbehaviors occurring between the behavior association host and the abnormal hosts. The method is used for effectively and quickly performing attack tracing.

Description

technical field [0001] The present application relates to the field of computer technology, and in particular to a network attack source tracing method and device. Background technique [0002] In recent years, with the continuous popularization of the network, the attack techniques and attack methods used by network attackers have also developed new trends. Therefore, network security issues also require network users to pay constant attention and take effective security protection measures. [0003] Among the protective measures adopted in the prior art, common network attacks can be effectively dealt with by setting a firewall or the like. However, for hackers using network vulnerabilities, such as advanced persistent threat attacks, the existing methods cannot provide effective protection, and the source of network attacks needs to be located to provide effective protection. Therefore, how to effectively and quickly trace the source of the attack is an urgent problem t...

AI Technical Summary

Problems solved by technology

However, for the advanced persistent threat attacks carried out by hackers through network vulnerabilities, for example, the existing methods cannot provide effective protection, and the source of the network attack needs to be located for effective protection.

Images