Multi-method mixed distributed APT malicious traffic detection and defense system and method

Abstract

The invention belongs to the technical field of network security, and discloses a multi-method mixed distributed APT malicious traffic detection and defense system and method, and the method comprises the steps that a network equipment layer carries out traffic bypass and equipment management and control, and sends the bypass traffic to a detection and defense layer for detection; the detection and defense layer performs flow detection and instruction execution; the analysis and control layer is used for summarizing and analyzing detection logs and issuing instructions; and a display and management layer performs data display and user interaction. According to the method, the malicious traffic in the network can be accurately detected in an omnibearing and multi-angle manner, so the potential APT attack can be identified. Meanwhile, by using a distributed architecture, accurate and comprehensive threat modeling can be carried out on the intrusion situation of the whole protected network. Meanwhile, a Cyber Kill Chain theoretical model is used, association between alarms in the network under long time and wide space span is fully mined, potential APT attack actions in the network are identified, and corresponding alarms are given.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a multi-method mixed distributed APT malicious traffic detection and defense system and method. Background technique [0002] At present, in recent years, threats to cyberspace security have become more and more complex, especially since the "Prism Gate" incident broke out in the United States, a series of malicious software has been disclosed. These malicious software are different from the previous common network attack software, showing the characteristics of increasing number, constantly upgrading technical means, gradually increasing attack efficiency, and mutual cooperation among various software. This shows that the network attack mode has developed from a single mode to a complex advanced persistent threat (Advanced Persistent Threat, APT) attack mode. APT attack is an organized, purposeful, complex, persistent and covert network security attack mode...

AI Technical Summary

Problems solved by technology

[0009] Through the above analysis, the existing problems and defects of the existing technology are: the existing technology does not address the complexity and concealment of APT attacks, analyzes the alarm information of different network locations in a wide space span, and cannot fully perceive complex and hidden APT network attacks Posture; no persistence against APT attacks, no way to identify potential APT attacks

[0010] The difficulty of solving the above problems and defects is: relatively difficult

Images