APT attack detection method, device and system of server and storage medium

Abstract

The invention discloses an APT (Advanced Persistent Threat) attack detection method for a server, which is characterized by comprising the following steps: acquiring flow information corresponding to a server IP (Internet Protocol); identifying APT attack traffic information from the traffic information; and judging whether the server is subjected to the APT attack according to the APT attack traffic information, and if so, sending APT attack prompt information. Flow information corresponding to a server IP is obtained, APT attack flow information is recognized from the flow information, then whether the corresponding server is subjected to APT attack is further judged according to the APT attack flow information, and APT attack prompt information is sent out when it is determined that the server is subjected to the APT attack; according to the method, the APT attack condition of the server can be detected in the using process, APT attack prompting is carried out in time, defense measures can be taken for the server in time, and the information safety is improved.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a server APT attack detection method, device, system and computer-readable storage medium. Background technique [0002] APT attack technology is an important capability for the development of intelligence organizations and cyber warfare forces in various countries, and it is also an important tool for current black industry groups to profit. With the increasingly intensified struggles of various countries and the prosperity of my country's Internet economy in the future, various information systems in our country will become important targets of APT attacks. For a server, good daily operation is very important. More and more organizations are paying attention to the daily operation of servers. [0003] However, since the current server maintainers cannot identify whether the server is being attacked by APT, they cannot take defensive measures against the at...

AI Technical Summary

Problems solved by technology

[0003] However, since the current server maintainers cannot identify whether the server is being attacked by APT, they cannot take defensive measures against the attack, which will affect the normal server operation and even steal user information

Images