APT attack identification and affiliation method and system based on homology analysis, and storage medium

Abstract

The invention discloses an APT attack identification and affiliation method and system based on homology analysis, and a storage medium, and the method comprises the following steps: collecting attackdata related to APT from monitored threat data, and extracting feature element values in each set in a defined APT quaternion feature group; carrying out feature vectorization on any existing APT attack feature tuples in a certain APT organization library; and calculating similarity of the feature vectors of the two groups of attacks, discovering a relationship between the attack and the selectedAPT attack and an organization to which the attack belongs, and storing an attack sample into an APT organization library. According to the method, the IKC attack chain and other features capable ofdistinguishing APT organizations are fused to form the multi-dimensional feature set, similarity calculation is carried out in combination with the weights, APT attack events can be effectively detected, similar APT attacks can be found based on a known APT organization library, and attack scene construction and attacker tracking are facilitated. The APT attack organization of subsequent events iseffectively identified.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an APT attack identification and attribution method, system and storage medium based on homology analysis. Background technique [0002] APT advanced persistent threat is an attack form that uses advanced attack methods to carry out long-term and persistent network attacks on specific targets. Different from traditional network attacks, APT attacks have the characteristics of pertinence, continuity, advancement, stages, sharing, and indirectness. Combined with the continuous tracking and analysis of APT threat activities by various security research institutions and security vendors at home and abroad, it can be seen that most APT attack organizations have government backgrounds, and many APT organizations have developed their own unique network weapons. The attack methods and means used , processes are quite proficient, and can master the use of various net...

AI Technical Summary

Problems solved by technology

[0004] At present, most of the identification and attribution analysis of APT attacks rely on the manual analysis of security experts. The time spent in the analysis process and the cost of human resources are high, and the efficiency is too low; the static features selected in the existing automatic analysis methods are too single , and it will be difficult to extract features due to malware obfuscation and packing technology, resulting in failure of the method

Images