Apt attack scene recovery detection method and system based on multi-source log correlation analysis

Abstract

APT attack scene recovery detection method and system based on multi-source log correlation analysis, the detection method includes collecting multi-source logs of hosts, setting new characteristic parameters, using relationship vectors to correlate all log entries, and treating all log entries as nodes in the network , the relationship between log entries is regarded as the edge between nodes, an undirected and weighted complex network graph is constructed, and the label propagation algorithm is used to cluster and identify events; then log and events are formed into a long sequence in chronological order to mine events The logical relationship and time relationship among them, generate the initial sub-partition graph and continuously optimize it to obtain the scene graph; then learn the vector representation of the vertices and edges of the scene graph, perform clustering, and detect new edges and vertices of the updated scene graph Whether it is abnormal, after the detection is completed, the clustering situation is updated to prepare for subsequent detection. The invention can comprehensively and accurately restore the attack scene, prevent high false alarm rate and fish that slip through the net, and efficiently detect APT attacks.

Description

technical field

[0001] The invention belongs to the field of network security, and in particular relates to an APT attack scene restoration detection method and system based on correlation analysis of multi-source logs. Background technique

[0002] With the rapid development of computer information technology, people rely more and more on the network for information transmission and interaction. However, incidents that threaten network security occur frequently, which have seriously affected the information security of the entire society and individuals. It is reported that, on average, an Internet computer intrusion event occurs every 20 seconds around the world. In order to protect network security, devices such as firewalls and intrusion detection systems have appeared on the market. These devices perform rule matching based on unique parameters in network data packets, and can only alarm and block behaviors that violate existing rules. has a certain lag. Especially f...

Images