Comprehensive analysis system and method based on attack chain

Abstract

The invention discloses a comprehensive analysis system and method based on an attack chain, and relates to the field of network attack chain invasion analysis, and the technical scheme is that the comprehensive analysis system comprises an attack chain comprehensive analysis system, the output end of the attack chain comprehensive analysis system is connected with an attacker action classification system, and the output end of the attacker action classification system is connected with an attack chain analysis system. The output end of the attack chain analysis system is connected with an attack chain process backtracking system, the output end of the attack chain process backtracking system is connected with an attack chain process information extraction system, the output end of the attack chain process information extraction system is connected with an attack chain research and judgment system, and the output end of the attack chain research and judgment system is connected with a cloud platform accurate positioning system. The method has the beneficial effects that the efficiency of analyzing the network attack chain is greatly improved, the analyzed attack chain is comprehensively controlled, the attack chain of the same kind is prevented from attacking the network host again, and the risk is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of network attack chain violation analysis, and in particular to a comprehensive analysis system and method based on attack chains. Background Art

[0002] Cyber-infringements mainly manifest themselves in computer network crimes, including technical sabotage, the use of the Internet to create, copy and disseminate harmful information, online fraud and theft, etc.

[0003] During the operation of existing networks, network attacks of varying degrees may occur. However, the existing attacks on attack chains generally only have protection and resolution, but cannot analyze and control the attack chains, which may cause the same attack chain to attack the network again. However, the existing method of analyzing attack chains generally involves projection analysis through a projector, but the existing projector cannot adjust the front and rear angles and height angles, thus affecting the viewing effect. Summary of the invention

[0004] To this end, the present invention provides a comprehensive analysis system and method based on an attack chain, which performs multi-angle analysis on the attack chain of a network attack through the attack chain comprehensive analysis system, and finally projects and displays the analysis results through the analysis result display system, so as to solve the problem that the existing method of analyzing the attack chain is generally to perform screen projection analysis through a projector, but the existing projector cannot adjust the front and back angles and the height angle, thus affecting the viewing effect.

[0005] In order to achieve the above-mentioned purpose, the present invention provides the following technical solutions: a comprehensive analysis system and method based on attack chain, comprising:

[0006] An attack chain comprehensive analysis system, wherein the output end of the attack chain comprehensive analysis system is connected to an attacker action classification system, the output end of the attacker action classification system is connected to an attack chain analysis system, the output end of the attack chain analysis system is connected to an attack chain process backtracing system, the output end of the attack chain process backtracing system is connected to an attack chain process information extraction system, the output end of the attack chain process information extraction system is connected to an attack chain analysis and judgment system, the output end of the attack chain analysis and judgment system is connected to a cloud platform accurate positioning system, and the output end of the cloud platform accurate positioning system is connected to an analysis result display system.

[0007] Preferably, the attacker action classification system includes a network information tracking module, a system attack attempt module and a network information capture module, and the attacker action classification system also includes a control behavior analysis module and an information theft and destruction module.

[0008] Preferably, the network information tracking module includes a data packet scanning module and a continuous detection module.

[0009] Preferably, the system attack attempt module includes a system brute force cracking module and a SQL injection attack module.

[0010] Preferably, the control behavior analysis module includes a web background permission control module, an implanted webshell control module and a privilege escalation acquisition module.

[0011] Preferably, the analysis result display system includes

[0012] A projector body, wherein an adjustment mechanism is provided on the outer side of the projector body, and the adjustment mechanism is used to adjust the front and rear angles of the projector body;

[0013] A lifting mechanism is arranged on the top of the projector body and is used to adjust the height angle of the projector body.

[0014] Preferably, the adjustment mechanism comprises two movable blocks, the two movable blocks are respectively arranged on both sides of the projector body, the tops of the two movable blocks are fixedly connected with fixed rods, and the tops of the two fixed rods are fixedly connected with lifting plates;

[0015] The adjusting mechanism includes an electric push rod, which is fixedly connected to the bottom of the lifting plate. A lifting block is fixedly connected to the bottom end of the electric push rod. A lifting rod is fixedly embedded in the lifting block. Lifting grooves are opened in the two fixed rods. Both ends of the lifting rod extend to the outside of the two lifting grooves respectively. Rotating rods are fixedly connected to both ends of the lifting rod. Movable rods are provided on both sides of the projector body. The two movable rods are respectively sleeved on the outside of the two rotating rods. Positioning rods are embedded in the bottom of the two movable rods. The two positioning rods are respectively fixedly connected to the two sides of the projector body. The two movable rods are movably connected to the two positioning rods through rolling bearings.

[0016] Preferably, the lifting mechanism includes a mounting frame, which is arranged on the top of the projector body, and a lifting motor is fixedly provided on one side of the mounting frame. A transmission shaft is fixedly connected to the output end of the lifting motor, and the transmission shaft extends to the interior of the mounting frame and is movably connected to the mounting frame through a rolling bearing. A winding drum is embedded in the mounting frame, and the winding drum is fixedly sleeved on the outside of the transmission shaft. A pull rope is wrapped around the outside of the winding drum, and the bottom end of the pull rope is fixedly connected to the top of the lifting plate.

[0017] Preferably, slide rails are provided on both sides of the projector body, and sliders are embedded in the two slide rails. The two sliders are respectively fixedly connected to the inner ends of the two movable blocks, and the two sliders match the slide rails.

[0018] Preferably, the method further comprises the following steps:

[0019] S1: The attacker's action classification system is controlled by the attack chain comprehensive analysis system to classify the attacker's attack actions, classify the attack chain types, and then analyze the classified attack chains through the attack chain analysis system. After the analysis is completed, the attack chain process backtracking system is used to process the attack process of the attack chain, and then the attack chain process information extraction system is used to extract the attack process information of the attack chain. After the information is extracted, the attack chain judgment system is used to study and judge the extracted information, and then the cloud platform accurate positioning system is used to locate the judgment results on the cloud platform. After the positioning is completed, the analysis result display system is used to display the results after positioning;

[0020] S2: The attacker action classification system controls the network information footprint module. The network information footprint module analyzes the data packets initiated by the attacker through the data packet scanning module and the continuous detection module, such as the data packets sent by Nmap and SQLmap, and continuously monitors and analyzes the discovery records of such data by the security detection equipment (WAF, XDS) at the border. After the footprint is completed, the system attack attempt module controls the system brute force cracking module and SQL injection attack module to conduct system attack attempts against direct or suspicious attack behaviors such as brute force cracking and SQL injection attacks launched by the attacker on the system, and then associates it with the attack attempt event through the network information attack module. For example, after the relevant attacker reports the attacker's normal access log after the attack attempt, the security device needs to confirm whether it has been compromised.

[0021] S3: Then, the web background permission control module, the webshell control module and the privilege escalation module are controlled through the control behavior analysis module to control the attacker to obtain host permissions, such as web background permissions, webshell implantation, and privilege escalation to obtain system permissions; the analyst analyzes the host layer data or network layer detection data, and finally controls the attacker to use the attack control system to obtain system data through the information theft and destruction module; the analyst analyzes the attacker's behavior through the reverse connection data and the relevant historical execution commands obtained by the host.

[0022] The beneficial effects of the present invention are:

[0023] The attack chain of the network attack is analyzed from multiple angles through the attack chain comprehensive analysis system, and finally the analysis result is projected and displayed through the analysis result display system, so as to solve the problem that the existing attack chain analysis method is generally to perform screen analysis through a projector, but the existing projector cannot adjust the front and back angles and the height angle, thus affecting the viewing effect. The present invention greatly improves the efficiency of the network attack chain analysis, comprehensively controls the analyzed attack chain, prevents the same attack chain from attacking the network host again, and greatly reduces the danger;

[0024] At the same time, this device uses a control behavior analysis module to control and analyze the network operation permissions, reducing the entry of attack viruses, greatly increasing network security, and bringing great benefits to users. In addition, this device is equipped with a projector that can be adjusted in height and front and back angles to display the analysis results, greatly improving the viewing effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings described below are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0026] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size, without affecting the effects and purposes that can be achieved by the present invention, should still fall within the scope of the technical contents disclosed by the present invention.

[0027] Figure 1 A schematic diagram of the overall control system structure provided by the present invention;

[0028] Figure 2 A schematic diagram of the structure of the attacker action classification system provided by the present invention;

[0029] Figure 3 A schematic diagram of the network information tracking module structure provided by the present invention;

[0030] Figure 4 A schematic diagram of the structure of the system attack attempt module provided by the present invention;

[0031] Figure 5 A schematic diagram of the control behavior analysis module structure provided by the present invention;

[0032] Figure 6 A schematic diagram of the structure of the analysis result display system provided by the present invention;

[0033] Figure 7 A schematic diagram of the lifting mechanism structure provided by the present invention;

[0034] Figure 8 A schematic diagram of the structure of the regulating mechanism provided by the present invention;

[0035] Fig. 9 The present invention provides Figure 8 A in the enlarged view;

[0036] In the figure: 1 attack chain comprehensive analysis system, 2 attacker action classification system, 3 attack chain analysis system, 4 attack chain process backtracking system, 5 attack chain process information extraction system, 6 attack chain judgment system, 7 cloud platform accurate positioning system, 8 analysis result display system, 9 network information reconnaissance module, 10 system attack attempt module, 11 network information capture module, 12 control behavior analysis module, 13 information theft and destruction module, 14 data packet scanning module, 15 continuous detection module, 16 system brute force cracking module, 17 SQL injection attack module, 18 web background permission control module, 19 implanted webshell control module, 20 privilege escalation module, 21 projector body, 22 movable block, 23 fixed rod, 24 lifting plate, 25 electric push rod, 26 lifting block, 27 lifting rod, 28 rotating rod, 29 movable rod, 30 positioning rod, 31 mounting frame, 32 lifting motor, 33 transmission shaft, 34 reel, 35 pull rope, 36 slide rail, 37 slider. DETAILED DESCRIPTION

[0037] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0038] Refer to the attached Figure 1 -Attached Fig. 9 The present invention provides a comprehensive attack chain-based analysis system and method, including:

[0039] An attack chain comprehensive analysis system 1, an output end of the attack chain comprehensive analysis system 1 is connected to an attacker action classification system 2, an output end of the attacker action classification system 2 is connected to an attack chain analysis system 3, an output end of the attack chain analysis system 3 is connected to an attack chain process backtracking system 4, an output end of the attack chain process backtracking system 4 is connected to an attack chain process information extraction system 5, an output end of the attack chain process information extraction system 5 is connected to an attack chain judgment system 6, an output end of the attack chain judgment system 6 is connected to a cloud platform accurate positioning system 7, and an output end of the cloud platform accurate positioning system 7 is connected to an analysis result display system 8;

[0040] In this implementation scheme, the attacker's action classification system 2 is controlled by the attack chain comprehensive analysis system 1 to classify the attacker's attack actions, classify the attack chain types, and then the classified attack chain is analyzed by the attack chain analysis system 3. After the analysis is completed, the attack process of the attack chain is traced back by the attack chain process backtracking system 4, and then the attack process information of the attack chain is extracted by the attack chain process information extraction system 5. After the information is extracted, the extracted information is studied and judged by the attack chain judgment system 6, and then the cloud platform accurate positioning system 7 is used to locate the judgment result on the cloud platform. After the positioning is completed, the analysis result display system 8 displays the result after positioning;

[0041] In order to achieve the purpose of attacker action classification, the device adopts the following technical solutions:

[0042] The attacker action classification system 2 includes a network information scouting module 9, a system attack attempt module 10 and a network information attack module 11. The attacker action classification system 2 also includes a control behavior analysis module 12 and an information theft and destruction module 13. The network information scouting module 9 includes a data packet scanning module 14 and a continuous detection module 15. The system attack attempt module 10 includes a system brute force cracking module 16 and a SQL injection attack module 17. The control behavior analysis module 12 includes a web background permission control module 18, an implanted webshell control module 19 and a privilege escalation acquisition module 20.

[0043] The attacker action classification system 2 controls the network information stomping module 9 to work. The network information stomping module 9 analyzes the data packets initiated by the attacker to scan and detect through the data packet scanning module 14 and the continuous detection module 15, such as the data packets sent by Nmap and SQLmap, and continuously monitors and analyzes the discovery records of such data by the security detection equipment WAF and XDS at the border. After the stomping is completed, the system brute force cracking module 16 and the SQL injection attack module 17 are controlled by the system attack attempt module 10 to conduct system attack attempts against direct or suspicious attack behaviors such as brute force cracking and SQL injection attacks launched by the attacker on the system, and then the network information attack module 11 is associated with the attack attempt event, such as the security device needs to confirm whether the attacker has been attacked after reporting the attacker's normal access log after the attack attempt;

[0044] Then, the web background permission control module 18, the webshell implantation control module 19 and the privilege escalation acquisition module 20 are controlled by the control behavior analysis module 12 to control the attacker to obtain host permissions, such as web background permissions, implanting webshells, and obtaining system permissions by privilege escalation; the analyst analyzes the host layer data or network layer detection data, and finally controls the attacker to use the attack control system to obtain system data through the information theft and destruction module 13; the analyst analyzes the attacker's behavior through the reverse connection data and the relevant historical execution commands obtained by the host;

[0045] Among them, in order to achieve the purpose of displaying the analysis results, this device adopts the following technical solutions:

[0046] The analysis result display system 8 includes

[0047] A projector body 21, an adjustment mechanism is provided on the outside of the projector body 21, and the adjustment mechanism is used to adjust the front and rear angles of the projector body 21;

[0048] A lifting mechanism, which is disposed on the top of the projector body 21 and is used to adjust the height angle of the projector body 21;

[0049] The adjustment mechanism includes two movable blocks 22, which are respectively arranged on both sides of the projector body 21. The tops of the two movable blocks 22 are fixedly connected to fixed rods 23, and the tops of the two fixed rods 23 are fixedly connected to lifting plates 24.

[0050] The adjustment mechanism includes an electric push rod 25, which is fixedly connected to the bottom of the lifting plate 24. A lifting block 26 is fixedly connected to the bottom of the electric push rod 25. A lifting rod 27 is fixedly embedded inside the lifting block 26. Lifting slots are opened inside the two fixed rods 23. Both ends of the lifting rod 27 extend to the outside of the two lifting slots respectively. Both ends of the lifting rod 27 are fixedly connected to a rotating rod 28. Both sides of the projector body 21 are provided with movable rods 29. The two movable rods 29 are respectively sleeved on the outside of the two rotating rods 28. Positioning rods 30 are embedded at the bottom of the two movable rods 29. The two positioning rods 30 are fixedly connected to the two sides of the projector body 21 respectively. The two movable rods 29 are respectively movably connected to the two positioning rods 30 through rolling bearings.

[0051] The lifting mechanism includes a mounting frame 31, which is arranged on the top of the projector body 21. A lifting motor 32 is fixedly arranged on one side of the mounting frame 31. A transmission shaft 33 is fixedly connected to the output end of the lifting motor 32. The transmission shaft 33 extends to the inside of the mounting frame 31 and is movably connected to the mounting frame 31 through a rolling bearing. A winding drum 34 is embedded in the mounting frame 31. The winding drum 34 is fixedly sleeved on the outside of the transmission shaft 33. A pull rope 35 is wound around the outside of the winding drum 34. The bottom end of the pull rope 35 is fixedly connected to the top of the lifting plate 24.

[0052] Slide rails 36 are disposed on both sides of the projector body 21 . Slide blocks 37 are embedded in the two slide rails 36 . The two slide blocks 37 are fixedly connected to the inner ends of the two movable blocks 22 , respectively. The two slide blocks 37 match the slide rails 36 .

[0053] The use process of the present invention is as follows: when the user controls the projector body 21 to project, when the front and rear angle of the projector body 21 needs to be adjusted, the electric push rod 25 is started to work, and the electric push rod 25 drives the lifting block 26 and the lifting rod 27 to move up and down, and the lifting rod 27 moves up and down to drive the rotating rod 28 and the movable rod 29 to rotate, and the movable rod 29 rotates to make the projector body 21 slide outside the two sliders 37, so that the front and rear angle of the projector body 21 moves;

[0054] When the user needs to adjust the height angle of the projector body 21, the user starts the lifting motor 32, and the lifting motor 32 drives the transmission shaft 33 and the winding drum 34 to rotate. The rotation of the winding drum 34 drives the pull rope 35 to reel up. The reeling of the pull rope 35 causes the lifting plate 24 and the projector body 21 to rise, so that the height angle of the projector body 21 changes.

[0055] The working process of the control system of the present invention is as follows:

[0056] S1: The attack chain comprehensive analysis system 1 controls the attacker action classification system 2 to classify the attacker's attack actions and classify the attack chain types. Then, the attack chain analysis system 3 analyzes the classified attack chains. After the analysis is completed, the attack chain process backtracking system 4 is used to backtrack the attack process of the attack chain. Then, the attack chain process information extraction system 5 extracts the attack process information of the attack chain. After the information is extracted, the attack chain judgment system 6 studies and judges the extracted information. Then, the cloud platform accurate positioning system 7 locates the judgment results on the cloud platform. After the positioning is completed, the analysis result display system 8 displays the results after positioning.

[0057] S2: The attacker action classification system 2 controls the network information footprint module 9 to work. The network information footprint module 9 analyzes the data packets initiated by the attacker to scan and detect through the data packet scanning module 14 and the continuous detection module 15, such as the data packets sent by Nmap and SQLmap, and continuously monitors and analyzes the discovery records of such data by the security detection equipment WAF and XDS at the border. After the footprint is completed, the system brute force cracking module 16 and the SQL injection attack module 17 are controlled by the system attack attempt module 10 to conduct system attack attempts against direct or suspicious attack behaviors such as brute force cracking and SQL injection attacks launched by the attacker on the system, and then associated with the attack attempt event through the network information attack module 11, such as the security device needs to confirm whether the attacker has been attacked after reporting the attacker's normal access log after the attack attempt;

[0058] S3: Then, the web background permission control module 18, the webshell implantation control module 19 and the privilege escalation acquisition module 20 are controlled by the control behavior analysis module 12 to control the attacker to obtain the host permissions, such as the web background permissions, implantation of webshells, and privilege escalation to obtain system permissions; the analyst analyzes the host layer data or network layer detection data, and finally controls the attacker to use the attack control system to obtain system data through the information theft and destruction module 13; the analyst analyzes the attacker's behavior through the reverse connection data and the relevant historical execution commands obtained by the host.

[0059] The above is only a preferred embodiment of the present invention. Any person skilled in the art may modify the present invention by using the above technical solution or modify it into an equivalent technical solution. Therefore, any simple modification or equivalent replacement made according to the technical solution of the present invention shall fall within the scope of protection claimed by the present invention.

Claims

1. A comprehensive analysis system and method based on attack chain, characterized by: include An attack chain comprehensive analysis system (1), wherein the output end of the attack chain comprehensive analysis system (1) is connected to an attacker action classification system (2), the output end of the attacker action classification system (2) is connected to an attack chain analysis system (3), the output end of the attack chain analysis system (3) is connected to an attack chain process backtracking system (4), the output end of the attack chain process backtracking system (4) is connected to an attack chain process information extraction system (5), the output end of the attack chain process information extraction system (5) is connected to an attack chain judgment system (6), the output end of the attack chain judgment system (6) is connected to a cloud platform accurate positioning system (7), and the output end of the cloud platform accurate positioning system (7) is connected to an analysis result display system (8).

2. A comprehensive analysis system and method based on attack chain according to claim 1, characterized in that: The attacker action classification system (2) comprises a network information tracking module (9), a system attack attempt module (10) and a network information capture module (11), and the attacker action classification system (2) further comprises a control behavior analysis module (12) and an information theft and destruction module (13).

3. A comprehensive analysis system and method based on attack chain according to claim 2, characterized in that: The network information tracking module (9) comprises a data packet scanning module (14) and a continuous detection module (15).

4. A comprehensive analysis system and method based on attack chain according to claim 3, characterized in that: The system attack attempt module (10) comprises a system brute force cracking module (16) and a SQL injection attack module (17).

5. A comprehensive analysis system and method based on attack chain according to claim 4, characterized in that: The control behavior analysis module (12) comprises a web background authority control module (18), an implanted webshell control module (19) and a privilege escalation acquisition module (20).

6. The comprehensive analysis system and method based on attack chain according to claim 1, characterized in that: The analysis result display system (8) comprises A projector body (21), wherein an adjustment mechanism is provided on the outside of the projector body (21), and the adjustment mechanism is used to adjust the front and rear angles of the projector body (21); A lifting mechanism is provided on the top of the projector body (21), and is used to adjust the height angle of the projector body (21).

7. A comprehensive analysis system and method based on attack chain according to claim 6, characterized in that: The adjustment mechanism comprises two movable blocks (22), the two movable blocks (22) are respectively arranged on both sides of the projector body (21), the tops of the two movable blocks (22) are fixedly connected to fixed rods (23), and the tops of the two fixed rods (23) are fixedly connected to lifting plates (24); The adjustment mechanism comprises an electric push rod (25), the electric push rod (25) is fixedly connected to the bottom of the lifting plate (24), the bottom end of the electric push rod (25) is fixedly connected to a lifting block (26), a lifting rod (27) is fixedly embedded inside the lifting block (26), the two fixed rods (23) are each provided with a lifting groove inside, the two ends of the lifting rod (27) respectively extend to the outside of the two lifting grooves, the two ends of the lifting rod (27) are fixedly connected to a rotating rod (28), both sides of the projector body (21) are provided with movable rods (29), the two movable rods (29) are respectively sleeved on the outside of the two rotating rods (28), the bottoms of the two movable rods (29) are each embedded with a positioning rod (30), the two positioning rods (30) are respectively fixedly connected to the two sides of the projector body (21), and the two movable rods (29) are respectively movably connected to the two positioning rods (30) through rolling bearings.

8. The comprehensive analysis system and method based on attack chain according to claim 6, characterized in that: The lifting mechanism comprises a mounting frame (31), the mounting frame (31) is arranged on the top of the projector body (21), a lifting motor (32) is fixedly arranged on one side of the mounting frame (31), the output end of the lifting motor (32) is fixedly connected to a transmission shaft (33), the transmission shaft (33) extends into the interior of the mounting frame (31) and is movably connected to the mounting frame (31) through a rolling bearing, a winding drum (34) is embedded in the interior of the mounting frame (31), the winding drum (34) is fixedly sleeved on the outside of the transmission shaft (33), a pull rope (35) is wound around the outside of the winding drum (34), and the bottom end of the pull rope (35) is fixedly connected to the top of the lifting plate (24).

9. The comprehensive analysis system and method based on attack chain according to claim 7, characterized in that: Slide rails (36) are provided on both sides of the projector body (21), and sliders (37) are embedded inside the two slide rails (36). The two sliders (37) are respectively fixedly connected to the inner ends of the two movable blocks (22), and the two sliders (37) match the slide rails (36).

10. The comprehensive analysis system and method based on attack chain according to claim 1, characterized in that: The following steps are also included: S1: The attack chain comprehensive analysis system (1) controls the attacker action classification system (2) to classify the attacker's attack actions and classify the attack chain types. Then, the attack chain analysis system (3) analyzes the classified attack chains. After the analysis is completed, the attack chain process backtracking system (4) backtracks the attack process of the attack chain. Then, the attack chain process information extraction system (5) extracts the attack process information of the attack chain. After the information is extracted, the attack chain judgment system (6) studies and judges the extracted information. Then, the cloud platform accurate positioning system (7) locates the judgment results on the cloud platform. After the positioning is completed, the analysis result display system (8) displays the results after positioning. S2: The attacker action classification system (2) controls the network information tracking module (9) to work. The network information tracking module (9) analyzes the data packets initiated by the attacker to scan and detect, such as the data packets sent by Nmap and SQLmap, through the data packet scanning module (14) and the continuous detection module (15). It continuously monitors and analyzes the discovery records of such data by the security detection equipment (WAF, XDS) at the border. After the tracking is completed, the system brute force cracking module (16) and the SQL injection attack module (17) are controlled through the system attack attempt module (10) to conduct system attack attempts against the direct or suspicious attack behaviors such as brute force cracking and SQL injection attacks launched by the attacker on the system. Then, the network information attack module (11) is used to associate with the attack attempt event, such as when the security device reports the attacker's normal access log after the attack attempt to confirm whether it has been compromised. S3: Then, the web background permission control module (18), the webshell implantation control module (19) and the privilege escalation acquisition module (20) are controlled by the control behavior analysis module (12) to control the attacker to obtain host permissions, such as web background permissions, implanting webshells, and obtaining system permissions by privilege escalation; the analyst analyzes the host layer data or network layer detection data, and finally controls the attacker to use the attack control system to obtain system data through the information theft and destruction module (13); the analyst analyzes the attacker's behavior through the reverse connection data and the relevant historical execution commands obtained by the host.

Images