Big data platform defense method for advanced sustainable threat attacks

Abstract

The invention discloses a big data platform defense method for advanced sustainable threat attacks. The method comprises the following steps: 1, constructing an APT attack and defense model, and carrying out income analysis; 2, enabling the defense party to evaluate and determine a target resource value, executing defense action cost, and obtaining information cost from an information institution;3, training a random forest classifier for APT attack flow identification; 4, training a decision tree classifier, and establishing the decision tree classifier; 8, repeating the steps 4-7, and establishing a plurality of decision tree classifiers to form a random forest classifier; 9, inputting the data in the test set into a random forest classifier to obtain a prediction result set, and comparing the prediction result set with an experiment result to obtain the accuracy of effectively identifying the APT attack by the defense party and the defense failure probability of the defense party;and 10, obtaining a defense strategy. The method is closer to an actual attack and defense scene, can recognize the flow data, and theoretically knows how to select a proper defense strategy by a defense party.

Description

technical field [0001] The invention relates to a big data platform defense method for advanced sustainable threat attacks, belonging to the technical field of cyberspace security. Background technique [0002] In recent years, Advanced Persistent Threat (APT) attacks have occurred frequently, and information security threats have become more and more serious. APT attacks have become one of the most harmful attack methods due to their strong targeting, good concealment, and difficulty in detection. APT attackers often carry out attacks through social engineering, zero-day vulnerabilities and other means, and traditional network attack defense technologies are difficult to effectively defend against. Therefore, how to effectively identify APT attacks and specify a reasonable defense strategy has become a current research hotspot. [0003] Game theory studies the decision-making when the behavior of the decision-making subject interacts, the equilibrium of this decision-maki...

AI Technical Summary

Problems solved by technology

[0007] The technology of the present invention solves the problem: because the APT attack takes a long time and is relatively hidden, it is difficult to find, so how to detect the APT attack, and when the APT attack is detected, what defense method the defender should adopt is the key problem that must be solved

Images