Attack user identification method and device based on test machine, and storage medium

Abstract

The invention relates to the technical field of network security, and discloses an attack user identification method and device based on a test machine, and a storage medium. The method comprises the steps of collecting test behavior information of a current user through a test machine; generating a user behavior portrait according to the test behavior information; the user behavior portrait is matched with a preset attack user portrait knowledge base, so that whether the matched user behavior portrait exists in the preset attack user portrait knowledge base or not is judged, and the preset attack user portrait knowledge base is obtained by integrating the attack user portrait knowledge bases according to attack types; and when the matched user behavior portrait exists in the preset attack user portrait knowledge base, determining that the current user is an attack user, thereby obtaining the preset attack user portrait knowledge base with higher recognition efficiency by integrating the attack user portrait knowledge bases, and realizing rapid recognition of the attack user.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an attacking user identification method, equipment, storage medium and device based on a testing machine. Background technique [0002] In the process of testing and confronting advanced threat actors and security endpoint products, advanced threat actors will install the endpoint product in a virtual environment in most cases, and test their malicious tools against security endpoint products, so as to evaluate the next step However, during this process, advanced threat actors will continue to expose their habitual characteristics. [0003] Existing solutions for identifying advanced threat actors mainly rely on malicious code, commercial company assets, and open-source intelligence for correlation. When advanced threat actors change their technical strategies or lack intelligence, it is difficult for emergency response teams to trace the source of the attack to the attr...

AI Technical Summary

Problems solved by technology

[0003] Existing solutions for identifying advanced threat actors mainly rely on malicious code, commercial company assets, and open-source intelligence. When advanced threat actors change their technical strategies or lack intelligence, it is difficult for emergency response teams to trace the source of the attack to the attribution. resulting in a defensive lag

Images