Apt attack identification and attribution method, system and storage medium based on homology analysis

Abstract

The invention discloses an APT attack identification and attribution method, system and storage medium based on homology analysis, comprising the following steps: collecting APT-related attack data from monitored threat data, and extracting defined APT quadruple features The feature element values ​​in each set in the group; perform feature vectorization with the APT attack feature tuple in any existing APT organization library; calculate the similarity of the feature vectors of the two groups of attacks, and find that the attack is similar to the selected APT attack relationship and the organization it belongs to, and save the attack sample to the APT organization library. The invention combines the IKC attack chain with other features that can distinguish APT organizations to form a multi-dimensional feature set, and combines the weights to calculate the similarity, not only can effectively detect APT attack events, but also can find similar APTs based on known APT organization databases Attacks are conducive to constructing attack scenarios, tracking attackers, and effectively identifying subsequent APT attack organizations.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an APT attack identification and attribution method, system and storage medium based on homology analysis. Background technique [0002] APT advanced persistent threat is an attack form that uses advanced attack methods to carry out long-term and persistent network attacks on specific targets. Different from traditional network attacks, APT attacks have the characteristics of pertinence, continuity, advancement, stages, sharing, and indirectness. Combined with the continuous tracking and analysis of APT threat activities by various security research institutions and security vendors at home and abroad, it can be seen that most APT attack organizations have government backgrounds, and many APT organizations have developed their own unique network weapons. The attack methods and means used , processes are quite proficient, and can master the use of various net...

AI Technical Summary

Problems solved by technology

[0004] At present, most of the identification and attribution analysis of APT attacks rely on the manual analysis of security experts. The time spent in the analysis process and the cost of human resources are high, and the efficiency is too low; the static features selected in the existing automatic analysis methods are too single , and it will be difficult to extract features due to malware obfuscation and packing technology, resulting in failure of the method

Images