Attack event tracing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses an attack event tracing method and device, electronic equipment and a storage medium. The method comprises the steps that a historical attack event database is constructed, and the historical attack event database comprises a plurality of historical attack events, dimension information of each historical attack event and known attackers; obtaining a to-be-traced attack event; and calculating the similarity between the to-be-traced attack event and historical attack events in a database, and determining an attacker of the to-be-traced attack event according to a calculation result. According to the invention, the database is constructed in advance according to a plurality of known historical attack events of an attacker, and the attacker of the attack event to be traced is determined by calculating the similarity between the attack event to be traced and the historical attack events in the database, so that the attacker corresponding to the attack event to be traced is accurately and efficiently determined.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of network security management, and in particular to an attack event source tracing method, device, electronic equipment, and storage medium. Background technique [0002] Advanced persistent threats (Advanced Persistent Threat, APT) are significantly different from traditional network attacks in attack methods and purposes. Through elaborate camouflage, targeted attacks, long-term latency, continuous penetration, etc., they steal the core data and various information of network information systems. an intelligence attack. In order to trace the source of APT attacks and determine the attackers, the current traceability methods usually include: traceability based on the characteristics of malicious proxy purchases in APT attack events, and traceability based on attack IP / domain name analysis. [0003] However, for the first traceability method, due to the large number of malicious codes...

AI Technical Summary

Problems solved by technology

[0003] However, for the first traceability method, due to the large number of malicious codes, the traditional malware detection technology based on signatures and signatures can no longer meet the emerging malicious code detection requirements, and new variants can appear with a slight modification of the code, so it is difficult Accurate positioning of attackers; for the second method, due to unfavorable factors such as users can easily forge their own IP addresses, use a large number of dynamic IP addresses and private IP addresses, and devices can rarely save logs for a long time. Finding a specific address renter at a specific time is more difficult

Therefore, the existing technology cannot effectively trace the source of APT attacks, so as to accurately and quickly determine the attackers

Images