Terminal detection and response system

Abstract

The present disclosure relates to a terminal detection and response system, comprising: at least one detection point for capturing an event, constructing an event context of the event, and sending the event context to a filtering engine; a security object database which is used for storing information of key objects; a filtering engine which is used for maintaining the strategy set, filtering the event context transmitted by the detection point according to the strategy set, and returning a filtering result, wherein when the filtering engine carries out filtering judgment on the event context, the security object database is inquired to obtain information of the event related object; and a detection point which is also used for executing corresponding operation according to the filtering result. Therefore, real-time detection and response can be realized at the terminal, and the detection efficiency and effect are improved.

Description

technical field [0001] The present disclosure relates to the technical field of information security, and in particular to a terminal detection and response system. Background technique [0002] At present, from the earliest viruses, worms, Trojan horses, to APT (Advanced Persistent Threat, advanced persistent threat), malicious code is always the most serious threat to information systems. [0003] In related technologies, the means of preventing malicious codes is usually anti-virus software or active defense software. Anti-virus software is implemented by detecting signatures contained in malicious codes. The effectiveness of anti-virus software is closely related to its virus database. With the new When malicious code is discovered, the virus database must also be updated. Therefore, within the update period of the virus database, it is impossible to prevent newly generated malicious code, especially for malicious code that is hidden deep. Once a large-scale outbreak occ...

AI Technical Summary

Problems solved by technology

[0003] In related technologies, the means of preventing malicious codes is usually anti-virus software or active defense software. Anti-virus software is implemented by detecting signatures contained in malicious codes. The effectiveness of anti-virus software is closely related to its virus database. With the new When malicious code is discovered, the virus database must also be updated. Therefore, within the update period of the virus database, it is impossible to prevent newly generated malicious code, especially for malicious code that is hidden deep. Once a large-scale outbreak occurs, it is too late to upgrade the virus database. Late, unable to deal with APT, the attackers use various obfuscation and evasion methods, can bypass the defense, the continuous growth of the virus database will definitely affect the detection efficiency; Monitor its access to specific resources during the period. When a risky operation is captured, the user may be prompted, and the user decides whether to block the operation, or directly block the operation. However, when a risky operation occurs, it is difficult to determine whether it is true or not. If the decision is made by the user, it depends on the user's professional knowledge; if it is directly judged, it is easy to make mistakes, and it is still unable to deal with the evasion methods commonly used by APT, such as borrowing system tools in the whitelist to complete malicious operations to bypass detection

Images