Advanced persistent threat detection method, system, computer and storage medium

Abstract

The invention discloses an advanced persistent threat detection method, a system, a computer and a storage medium. The advanced persistent threat detection method comprises the steps of: analyzing traffic of a backbone network of an operator, and restoring files transmitted in the backbone network; filtering the traffic in the backbone network so as to filter normal traffic and files; detecting the filtered files; detecting intrusion attack traffic in the backbone network; processing the detection result, and intercepting and blocking the corresponding intrusion attack traffic; performing logrecording on the detected attack; and displaying the recorded logs for evidence acquisition and tracing of subsequent advanced persistent threat attacks. According to the advanced persistent threat detection method provided by the invention, the advanced persistent threat (APT) attack can be detected in a multi-directional manner; and powerful data support and detailed traceability information areprovided for the operator for APT detection, meanwhile, network attacks can be blocked, and benefits of users are guaranteed.

Description

technical field [0001] Embodiments of the present invention relate to computer network security technology, and in particular to an advanced sustainable threat detection method, system, computer and storage medium. Background technique [0002] Advanced Persistent Threat (ATP) attacks usually infiltrate into the network and stay dormant for a long time, using the internal personnel of the organization as an attack springboard, constantly trying various attack methods, and continuously collecting various information until important intelligence is collected. The intent of an APT attack is to steal data, not to cause damage to the network. [0003] At present, the protection against APT is generally to detect traffic, behavior or files at the gateway of the LAN network egress, and generally requires the network firewall to have this related function. As the key nodes of the network, operators are completely unaware of APT attacks in the network. At the same time, if such a ph...

AI Technical Summary

Problems solved by technology

As the key nodes of the network, operators are completely unaware of APT attacks in the network. At the same time, if such a phenomenon occurs in the network, subsequent operators cannot block and trace the attack on the network, nor can they find out the network The perpetrator of the attack

Images