APT attack detection method based on event relation directed graph in network full traffic

Abstract

The invention relates to the technical field of network security, in particular to an APT attack detection method based on an event relation directed graph in network full traffic, which comprises the following steps of: S1, acquiring bypass traffic by using deep packet analysis to obtain real-time network metadata; S2, analyzing the network metadata by using big data based on a hacker network technology, and generating a network event relation directed graph; and S3, constructing a network event attack technology directed graph based on a preset APT attack technology weighted directed graph, performing matching analysis on the network event attack technology directed graph and a preset APT attack technology weighted directed graph, calculating a connected component weight of the network event directed graph, and finally detecting a current APT attack result and generating an alarm prompt. According to the technical scheme, the APT attack detection method based on the event relation digraph in the network full traffic is comprehensive and reliable in data analysis, higher in detection accuracy, capable of saving storage resources and convenient for backtracking, querying and analyzing historical data.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an APT attack detection method based on a directed graph of event relationships in full network traffic. Background technique [0002] Advanced Persistent Threat (APT) attack is a persistent network attack on a specific target using advanced technical means. With the continuous development of network technology, APT attacks have become more and more stealthy. A single traditional network security protection and analysis device is powerless against complex APT attacks, and it is difficult to correlate the analysis results of different network protection and analysis devices. The traces of APT attacks are hidden in the vast sea of ​​network traffic. The log information of network security devices cannot directly and accurately reflect the events in the network, and some hackers even delete the logs on network devices to avoid tracking. Only by collecting and analyzing th...

AI Technical Summary

Problems solved by technology

However, as the technical means of APT attacks become more and more advanced, it will detect the operating environment. Once it is found to be a sandbox, it will not show malicious behavior, making the sandbox detection invalid.

Images