Industrial internet equipment attack path restoration method, related equipment and system

Abstract

The invention relates to an industrial internet equipment attack path restoration method, related equipment and a system. The method comprises the following steps of: acquiring a malicious code in a to-be-tested sample, and evaluating the malicious code based on a multi-feature fusion method to generate a malicious code evaluation result; performing homologous association on attack loads of multiple attack events in the malicious code evaluation result based on a calling habit mode, and determining a hidden attack path; obtaining multi-dimensional data, constructing an attacker portrait for the multi-dimensional data based on a multi-feature fusion method, and determining an attack intention, the multi-dimensional data comprising application program interface calling record data, network behavior record data, process behavior record data, network quintuple data and network intrusion detection / defense system rule detection data; and tracing an attacker according to the hidden attack path and the attack intention. According to the method, the tracing effect can be improved, and hidden attack paths among attackers and multiple devices can be effectively found.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method for restoring an attack path of an industrial Internet device, related equipment and a system. Background technique [0002] With the integration and development of industrial Internet and automatic control technology, industrial control systems are widely used in important national infrastructures such as electric power, transportation, energy, water conservancy, metallurgy, and aerospace. With the emergence of a new generation of 5G communication technology and the arrival of the digital twin era, the security of the industrial Internet will face more severe challenges. In addition to its unique advantages and tenacious vitality in the prevention and control of the epidemic, the industrial Internet has made more industries and manufacturing companies realize the importance of implementing informatization and intelligent construction. Therefore, strengthening the con...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a method for restoring the attack path of industrial Internet equipment, related equipment and systems to solve the problem of poor traceability and difficulty in effectively finding information such as attackers and hidden attack paths between multiple devices

Images