Advanced threat attack assessment method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an advanced threat attack assessment method and device, electronic equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: acquiring global attack data of any attacker on all target units; performing dispersion analysis on the global attack data to obtain a statistical result vector formed by attack times of each target unit in a preset time window; within a preset time span, performing persistence analysis on the global attack data to obtain a plurality of statistical result vectors; and performing subscript position difference processing of a local maximum value on the plurality of statistical result vectors to obtain an advanced threat attack target unit, so that the target unit of targeted attack can be accurately positioned based on the characteristics of the advanced threat attack, and the security of the advanced threat attack is improved. The problem that an attacker identity or an attack event with typical pertinence cannot be accurately found through an existing method is solved.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular, to an advanced threat attack assessment method, apparatus, electronic device and storage medium. Background technique [0002] Advanced persistent threat attack is a long-term uninterrupted network attack using software and hardware vulnerabilities and social engineering principles. Before launching an attack, the attacker accurately collects the business process and target system of the attacked object, and digs out the vulnerabilities of the trusted system and application of the attacked object. The purpose of core data and intelligence collection is to be highly concealed and difficult for users to discover. [0003] This type of attack is usually a continuous network attack process aimed at a specific target, and has strong targeted characteristics. For example, APT attacks against my country are mainly aimed at important infrastructure and organization...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the embodiments of the present application is to provide an advanced threat attack assessment method, device, electronic equipment, and storage medium. Based on the targeted characteristics of advanced threat attacks, it can accurately locate the target unit of the targeted attack, and solve the problem that existing methods cannot accurately Identify issues with typical targeted attacker identities or attack events

Images