Multi-method mixed distributed apt malicious traffic detection defense system and method

Abstract

The invention belongs to the technical field of network security, and discloses a multi-method mixed distributed APT malicious traffic detection and defense system and method, including: traffic bypass and device control at the network device layer, and sending the bypass traffic to the detection and defense layer Detection; the detection and protection layer conducts traffic detection and command execution; the analysis and control layer conducts detection log summary analysis and command issuance; the display and management layer performs data display and user interaction. The present invention can perform all-round and multi-angle accurate detection of malicious traffic in the network, thereby identifying potential APT attacks. At the same time, using the distributed architecture, it is possible to accurately and comprehensively model the intrusion of the entire protected network. At the same time, the Cyber ​​Kill Chain theoretical model is used to fully mine the correlation between alarms in the network under long-term and wide spatial spans, identify potential APT attack actions in the network and give corresponding alarms.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a multi-method mixed distributed APT malicious traffic detection and defense system and method. Background technique [0002] At present, in recent years, threats to cyberspace security have become increasingly complex. These malicious software are different from the previous common network attack software, showing the characteristics of increasing number, constantly upgrading technical means, gradually increasing attack efficiency, and mutual cooperation among various software. This shows that the network attack mode has developed from a single mode to a complex advanced persistent threat (Advanced Persistent Threat, APT) attack mode. APT attack is an organized, purposeful, complex, persistent and covert network security attack mode. Government and enterprise units are the main targets of most APT attacks, so APT attacks have a wide range and cause great l...

AI Technical Summary

Problems solved by technology

[0009] Through the above analysis, the existing problems and defects of the existing technology are: the existing technology does not address the complexity and concealment of APT attacks, analyzes the alarm information of different network locations in a wide space span, and cannot fully perceive complex and hidden APT network attacks Posture; no persistence against APT attacks, no way to identify potential APT attacks

[0010] The difficulty of solving the above problems and defects is: relatively difficult

Images