Attack traceability detection method, device and equipment and readable storage medium
By analyzing network communication behavior, fusing anomaly subgraphs and filtering multi-step attack paths, the problem of low accuracy of APT attack traceability detection is solved, and high-accuracy multi-step attack traceability processing is achieved.
CN119696919AActive Publication Date: 2025-03-25CETC CYBERSPACE SECURITY TECH CO LTD
5 Cites 1 Cited by
Patent Information
- Application Number
- CN202411972511.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-30
- Publication Date
- 2025-03-25
- Estimated Expiration
- 2044-12-30
AI Technical Summary
Technical Problem
The prior art has low accuracy in APT attack traceability detection and cannot meet the needs of traceability analysis.
Method used
By analyzing the network communication behavior of traffic data, the exception subgraph database and exception edges are obtained, and the exception edges are used to fuse the exception subgraph in the exception subgraph database to filter the multi-step attack path, combine the exception subgraph database to obtain the multi-step attack data set, filter and supplement the network security event set, and finally cluster the multi-step attack security event set to obtain the multi-step attack chain.
Benefits of technology
It improves the accuracy of APT attack tracing detection and realizes accurate multi-step attack tracing processing.
✦ Generated by Eureka AI based on patent content.
Abstract
The invention discloses an attack traceability detection method, device and equipment and a readable storage medium in the technical field of network security, and the method comprises the steps: analyzing a network communication behavior of traffic data, and obtaining an abnormal sub-graph database and an abnormal edge; fusing the abnormal sub-graphs in the abnormal sub-graph database by using the abnormal edges; screening a multi-step attack path from the fused abnormal sub-graph, and obtaining a multi-step attack data set in combination with the screened multi-step attack path and an abnormal sub-graph database; acquiring a network security event set corresponding to the traffic data; screening and supplementing the network security event set by using the multi-step attack data set to obtain a multi-step attack security event set; and performing clustering processing on the multi-step attack security event set to obtain a multi-step attack chain. According to the method, clustering is carried out based on the multi-step attack communication characteristics and the multi-step attack security event set obtained after security event association analysis, and a more accurate multi-step attack chain can be obtained.
Need to check novelty before this filing date? Find Prior Art