Forensic traceability method, device and computer equipment for terminal attack

Abstract

The invention discloses a method, device, and computer equipment for obtaining evidence and tracing sources for terminal attacks, including: acquiring a request for obtaining evidence and tracing sources; And the event information of the event related to each label, add the object to the pre-built attack graph; add all the labels corresponding to the object to the pre-established label collection; traverse the label collection, for each label, get the The object corresponding to the label is added to the attack graph, and the associated label of the label is obtained and added to the label collection for traversal. The method, device, and computer equipment of the present invention explain the source of all tags on the object and trace the source according to the tag generation process to quickly construct a relatively complete attack graph, greatly reducing storage consumption and calculation, and improving evidence collection. The universality of the application of traceability methods.

Description

technical field [0001] The present application relates to the field of computer technology, and in particular, to a method, device, and computer equipment for forensics and traceability for terminal attacks. Background technique [0002] APT attack, that is, advanced persistent threat attack, also known as targeted threat attack, refers to the continuous and effective attack activities carried out by an organization on a specific object. This kind of attack is highly concealed and targeted, and usually uses various infected media, supply chains and social engineering to implement advanced, persistent and effective threats and attacks. The increasingly sophisticated Advanced Persistent Threats (APTs) have become a major issue in enterprise IT security. Over the past decade, more than 6,000 serious APT incidents have been reported. Large businesses in particular, such as Target and HomeDepot, have suffered significant financial and reputational damage. [0003] Attacks agai...

AI Technical Summary

Problems solved by technology

[0006] However, the above works all aim to restore the complete attack steps, so they consume a lot of space when storing events, and consume a lot of time when calculating

Most importantly, because the problem of relying on explosion cannot be solved by existing methods, that is, the huge calculation and storage costs can only alleviate the problem, so it is currently impossible to obtain a complete attack graph that does not involve misjudgment; at the same time , in an enterprise environment, hundreds or even more warnings will be generated every day, and security managers need to manually determine whether it is a real attack

Images