APT event homology judgment method based on behavior pattern

Abstract

The invention discloses an APT event homology judgment method based on a behavior pattern. The APT event homology judgment method comprises the following steps: constructing an APT event association graph based on the behavior pattern; performing node attribute expansion on the APT event association graph; performing attribute labeling on nodes in the APT event association graph; performing attribute labeling on nodes in the APT event association graph to obtain behavior tags or clue tags of the nodes of the APT event association graph; carrying out similarity discrimination on the APT event association graph; carrying out similarity judgment on the APT event association graph to complete homologous judgment of the APT event; and comparing topological structure information and node attribute information of the structural data of the two APT event association graphs by adopting a sub-graph similarity measurement function to determine the homology or similarity of the two APT event association graphs. According to the method, the problems of one-sided malicious sample analysis result and low manual homology judgment efficiency in existing APT event homology analysis are solved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for judging the homology of APT events based on behavior patterns. Background technique [0002] In recent years, with the increasingly intensified game of sovereignty in cyberspace, cyber attacks represented by Advanced Persistent Threat (APT) have become increasingly prevalent and have become one of the most serious threats to cyberspace security. All countries have improved their APT defenses from a national security perspective. [0003] Homology analysis of APT events is an important branch of traceability analysis in APT defense. Its main connotation is to determine whether there is similarity between multiple attack events based on the attack methods, attack tools, and attack loads of different APT attack events, and whether they belong to the same organization or APT attack launched by hackers. At present, the homology analysis of APT attack events is ...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the problems of one-sided malicious sample analysis results and low efficiency of manual homology judgment in the existing APT event homology analysis, the present invention discloses a behavior pattern-based APT event homology judgment method

Images