Situation awareness node defense method and system aiming at APT attack

Abstract

The invention provides a situation awareness node defense method and system for APT attacks, and relates to the technical field of network security. The node defense method comprises the following steps: collecting information that a network node is attacked by APT, and setting a virtual backup node for the network node; establishing a communication connection between the network node and the virtual backup node, storing the data information of the network node into the virtual backup node, and cutting off the connection between the network node and the associated network node; and establishing a connection between the virtual backup node and the associated network node. According to the method, the storage path of the data information is changed in real time based on the attack mode information in the network, so that an attacker is difficult to find the storage address of the data information to attack, and situation awareness system node defense is realized on the basis of ensuring normal communication of the whole network.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a situation awareness defense method against APT attacks. Background technique [0002] APT (Advanced Persistent Threat), also known as advanced persistent threat, multi-step network attack, has a high degree of concealment, latency and persistence, and is often used by hackers to target specific targets for a long-term, planned and organized Steal data. Compared with other forms of attack, APT attacks are more advanced, mainly reflected in the need to accurately collect the business process and target system of the attack target before launching the attack. [0003] Existing technical means, in the face of APT attacks, use the network security situational awareness system to predict the future security status and changing trends of the network. The situational awareness system uses scientific theories, methods and existing experience to judge and predict the developme...

AI Technical Summary

Problems solved by technology

However, as far as the current technology is concerned, the network situation is changing rapidly, and it is difficult to accurately respond to fragmented and ultra-long latency threat behaviors by prior knowledge, and the attacker's attack strategies may be diversified, which also makes network attack prediction difficult to deal with. Unknown attacks online and in real time

Images