A Behavioral Pattern-Based Approach to Homology Judgment of Apt Events

Abstract

The invention discloses a method for judging the homology of APT events based on behavior patterns. The steps include: constructing an APT event correlation graph based on behavior patterns; extending node attributes on the APT event correlation graph; Attribute labeling; attribute labeling of nodes in the APT event correlation graph to obtain behavior labels or clue tags of nodes in the APT event correlation graph; similarity discrimination for APT event correlation graphs; similarity judgment for APT event correlation graphs to complete APT Homology determination of events; use the subgraph similarity measurement function to compare the topology information and node attribute information of the structural data of the two APT event correlation graphs to determine the homology or similarity of the two APT event correlation graphs. The method of the invention solves the problems of one-sided malicious sample analysis results and low efficiency of manual homology determination in the prior homology analysis of APT events.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for judging the homology of APT events based on behavior patterns. Background technique [0002] In recent years, with the increasingly intensified game of sovereignty in cyberspace, cyber attacks represented by Advanced Persistent Threat (APT) have become increasingly prevalent and have become one of the most serious threats to cyberspace security. All countries have improved their APT defenses from a national security perspective. [0003] Homology analysis of APT events is an important branch of traceability analysis in APT defense. Its main connotation is to determine whether there is similarity between multiple attack events based on the attack methods, attack tools, and attack loads of different APT attack events, and whether they belong to the same organization or APT attack launched by hackers. At present, the homology analysis of APT attack events is ...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the problems of one-sided malicious sample analysis results and low efficiency of manual homology judgment in the existing APT event homology analysis, the present invention discloses a behavior pattern-based APT event homology judgment method

Images