Key host event identification method based on information flow analysis

Abstract

The invention provides a key host event identification method based on information flow analysis, relates to the field of network attack discovery, and aims at researching key host event identification related to file operation on a Windows system, and capturing an effective information flow relationship among events by researching information flow characteristics, a common event which can only express a single-step information flow is enhanced into a key host event which can express a multi-step information flow, and other invalid dependency relationships and corresponding redundant events are eliminated, so that the aim of clue simplification is fulfilled, the problem of clue explosion is relieved, and attack event chains can be more accurately extracted and host end attacks are more accurately detected.

Description

technical field [0001] The present invention relates to the field of network attack discovery, in particular to a method for assisting network attack discovery by identifying key host events, and more specifically, to a key host event identification method based on information flow analysis. Background technique [0002] In today's highly interconnected world, cyber attacks pose an increasingly serious threat to personal privacy, life and property safety, and hosts, as an important medium for human daily work, entertainment, and communication, are the main target of cyber attacks and the main place where attacks occur. Attacks that occur on the host will inevitably leave traces on the host—host events, and host event analysis is an important means to detect host-side attacks and restore the attack process. However, the large number of host events and the complex dependencies between events lead to the problem of thread explosion. Every application will continuously generate...

AI Technical Summary

Problems solved by technology

However, the above methods all rely on the behavior characteristics of the subject, lack of universality, and are difficult to deal with complex and changeable attack scenarios

[0004] In addition, for file operations on the host, the host event recording system can only record single-step operations such as creating, closing, renaming, reading, and writing. For example, process P performs a read operation on file A and reads the content; but multi-step operations such as copying, compressing, dumping, and decompressing cannot be recorded. For example, process P copies file A to file B, that is, reads file A and then writes file B

Moreover, each event may have a dependency relationship with many events, which makes it difficult to accurately capture the flow of information and the event chain to accurately extract

Images