Detection and defense method for APT attack

Abstract

The invention discloses a method for detecting and defending APT (Advanced Persistent Threat) attacks, which relates to the technical field of network protection and comprises the following steps: firstly, designing and actively spreading information with specific marks by a system; then, a network flow analyzer and a safety information management system are used for monitoring the circulation condition of the mark information in real time, and abnormal changes are captured; and then, recording and analyzing the abnormal data, and constructing a detailed attack behavior database. Based on the database, an attack prediction model is established. And finally, a powerful guarantee is provided for network security by establishing a network security situation awareness system. The APT attack can be effectively detected and defended through the measures of actively spreading marked information, diffusing in different channels, deeply mining nonlinear features and spatial-temporal features of network flow data, monitoring and analyzing a network security situation in real time and the like, the security and the stability of the network are improved, the attack is actively triggered, and the security and the reliability of the network are improved. Therefore, the data reliability of the attack prediction model is improved.

Description

Technical Field

[0001] The present invention relates to the field of network protection technology, and in particular to a method for detecting and defending against APT attacks. Background Art

[0002] APT (Advanced Persistent Threat), also known as an advanced persistent threat or multi-step network attack, is highly stealthy, latent, and persistent, often used by hackers to steal data from specific targets in a long-term, planned, and organized manner. While APT attacks employ varying means and methods, they are ultimately reflected in network traffic data. The main symptoms include subsequence-level and point-level network traffic anomalies. Subsequence-level network traffic anomalies refer to instances in which certain subsequences in network traffic data exhibit behavior inconsistent with the overall traffic pattern. Point-level network traffic anomalies refer to network traffic observed at a specific point in time that significantly deviates from expected or normal patterns. However, existing detection and defense methods for APT attacks have problems such as insufficient in-depth mining of the nonlinear and spatiotemporal characteristics of network traffic data and inability to respond to changes in network security status in a timely manner. Mainstream time series anomaly detection methods do not mine the nonlinear and spatiotemporal characteristics of network traffic data in a deep enough way, and the weighted summation attack risk calculation method cannot reflect the current status, historical behavior and future trends of network traffic anomalies, and cannot respond to changes in network security status in a timely manner. Therefore, we propose a detection and defense method for APT attacks. Summary of the Invention

[0003] The purpose of the present invention is to solve the problems that existing detection and defense methods for APT attacks do not mine the nonlinear characteristics and spatiotemporal characteristics of network traffic data deeply enough and cannot respond to changes in network security situation in a timely manner. The mainstream time series anomaly detection methods do not mine the nonlinear characteristics and spatiotemporal characteristics of network traffic data deeply enough, and the weighted summation attack risk calculation method cannot reflect the current status, historical behavior and future trends of network traffic anomalies, and cannot respond to changes in network security situation in a timely manner. The present invention provides a detection and defense method for APT attacks.

[0004] In order to achieve the above-mentioned purpose, the present invention specifically adopts the following technical solutions:

[0005] A method for detecting and defending against APT attacks includes the following steps:

[0006] S1. Dissemination of tagged information: Design and proactively disseminate tagged information through routers, switches, or intrusion detection systems (IDS). This information is distributed through different channels, covering different paths and key nodes in the network, ensuring that the tagged information can flow through potential attack vulnerabilities while taking into account network redundancy and fault tolerance.

[0007] S2. Monitor the movement and circulation of tagged information. Deploy network traffic analyzers (NTA) and security information and event management (SIEM) systems to monitor network traffic in real time, set thresholds and rules, and identify abnormal changes in information propagation paths, speeds, and status.

[0008] S3. Establish an attack behavior database, record and analyze attack behaviors based on the propagation path, speed, and status of abnormal marked information, and establish an attack behavior database to record the time, type, characteristics, and impact of the attack;

[0009] S4. Build an attack prediction model. Leveraging deep learning and machine learning techniques, we mine the nonlinear and spatiotemporal features of abnormal network traffic data within the attack behavior database. We then build an attack prediction model using a long short-term memory (LSTM) network for feature extraction and pattern recognition. We regularly update the model to adapt to changes in the network environment and attack methods.

[0010] S5. Establish a network security situation awareness system to monitor and analyze the circulation of tagged information in real time. When the propagation path, speed, and status of tagged information change, evaluate the changes in network security situation through attack prediction models, timely warn of potential APT attacks, and isolate the propagation path to provide decision support and defense space for defense measures.

[0011] Furthermore, the format and content of the tagged information in S1 must include specific identification and tracking mechanisms, define the structure and encoding of the information, and ensure its uniqueness, identifiability, and compatibility with existing network protocols. Specific identification and tracking mechanisms include one or more of the following:

[0012] A1. Unique identifier (UID): Use UUID (Universally Unique Identifier) ​​or GUID (Globally Unique Identifier) ​​to generate a unique identifier for each entity that needs to be tracked;

[0013] A2. For digital content, digital watermarking or fingerprinting technology can be used to embed a unique identifier. Digital watermarks are usually embedded in media files, including images, audio, and video.

[0014] A3. Metadata tags: Embed metadata tags in files or data packets, containing unique identifiers and other tracking information, using UTF-8 character encoding to ensure compatibility;

[0015] A4. Blockchain technology uses cryptographic hash functions to generate unique identifiers for blocks.

[0016] Furthermore, the abnormal state threshold setting with marked information in S2 includes determining the normal traffic range and setting the abnormal behavior threshold. The normal traffic range is determined by statistical historical data and business needs, and a minimum and minimum threshold interval is set. The abnormal behavior threshold is set by setting the alarm change range based on the historical traffic change range. When the traffic of that IP address or port suddenly increases or decreases and reaches the set threshold, an alarm is triggered.

[0017] Furthermore, the abnormal status rules with the marked information in S2 include but are not limited to:

[0018] B1. Set whitelist and blacklist rules. Pre-set whitelists and blacklists for different network activities with marked information. The whitelist contains allowed network activities, and the blacklist contains prohibited network activities. When network activities that do not match the whitelist or the blacklist are detected, an alarm is triggered;

[0019] B2. Set pattern matching rules to match specific network data packets through regular expressions. When a network data packet that matches a specific pattern is detected, an alarm is triggered.

[0020] Furthermore, the attack behavior database in S3 utilizes data mining methods including cluster analysis and association rule mining.

[0021] Furthermore, in the attack prediction model of S4, the threat level of the attack event is quantified using the attack score, which is usually calculated based on the attributes of the attack event, including the threat index of the source IP address set, the destination IP address set, and the attack event name. The specific calculation formula is:

[0022] AtkScr=Σ(Cip / Stotal×Iatk)(ip∈Ssrc∪Sdes)

[0023] Among them, AtkScr represents the attack score, Cip represents the asset value of the IP address, Stotal represents the sum of the asset values ​​of all IP addresses, Iatk represents the threat index of the attack event name, Ssrc represents the set of source IP addresses, and Sdes represents the set of destination IP addresses. This formula calculates the attack score by comprehensively considering multiple attributes of the attack event, thereby reflecting the threat level of the attack event.

[0024] Furthermore, the defense measures in S5 include implementing dynamic firewall rules to block attack paths and isolate infected nodes, using automated tools for system recovery and patch management to repair damaged systems, and the automated recovery process includes backup verification, system updates and security reinforcement steps.

[0025] The beneficial effects of the present invention are as follows:

[0026] 1. The system of the present invention is designed to actively disseminate information with specific tags, ensuring that this information can cover key nodes and potential attack paths in the network. Then, the network traffic analyzer and security information management system are used to monitor the circulation of these tagged information in real time to capture any abnormal changes. Subsequently, these abnormal data are recorded and analyzed to build a detailed attack behavior database. Based on this database, deep learning and machine learning technologies are used to establish an attack prediction model that can effectively identify and predict potential attack behaviors. Finally, by establishing a network security situation awareness system, the security status of the network is evaluated in real time. Once an anomaly is detected, an early warning is immediately issued and isolation measures are taken, thereby providing strong protection for network security. By actively disseminating tagged information, diffusing through different channels, deeply mining the nonlinear characteristics and spatiotemporal characteristics of network traffic data, and monitoring and analyzing the network security situation in real time, APT attacks can be effectively detected and defended, the security and stability of the network can be improved, attacks can be actively triggered, thereby improving the data reliability of the attack prediction model and reducing the threat of unknown attack methods.

[0027] 2. The present invention divides massive amounts of network activity data into different categories through cluster analysis and identifies abnormal behavior patterns. Then, using association rule mining technology, the potential connections between the categories are analyzed to reveal hidden attack paths and strategies. This dual mining mechanism not only improves the accuracy of detection, but also can promptly detect complex and changing APT attacks. In addition, the system will regularly update and maintain the database to ensure that it can adapt to the ever-changing network environment and maintain efficient defense capabilities. Through this comprehensive data mining application, the present invention can effectively identify and defend against APT attacks at an early stage, ensuring the overall security of the network system.

[0028] 3. The attack prediction model of the present invention continuously monitors network activity, identifies abnormal behavior, and performs a preliminary assessment. The model then substitutes this abnormal behavior data into the aforementioned formula to quickly calculate an attack score. This score provides the security team with a direct threat assessment reference and can trigger the early warning system, promptly informing relevant personnel to take appropriate measures. Furthermore, the model integrates historical attack records and the latest threat intelligence, dynamically adjusting the weights of various parameters to ensure the accuracy and real-time nature of the calculation results. Through this quantification and dynamic optimization strategy, the present invention can effectively predict and defend against APT attacks, significantly enhancing the security protection level of network systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is an operation flow chart of the present invention. DETAILED DESCRIPTION

[0030] To make the objectives, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0031] See also Figure 1 The present invention provides a method for detecting and defending against APT attacks, comprising the following steps:

[0032] S1. Dissemination of tagged information: Design and proactively disseminate tagged information through routers, switches, or intrusion detection systems (IDS). This information is distributed through different channels, covering different paths and key nodes in the network, ensuring that the tagged information can flow through potential attack vulnerabilities while taking into account network redundancy and fault tolerance.

[0033] S2. Monitor the movement and circulation of tagged information. Deploy network traffic analyzers (NTA) and security information and event management (SIEM) systems to monitor network traffic in real time, set thresholds and rules, and identify abnormal changes in information propagation paths, speeds, and status.

[0034] S3. Establish an attack behavior database, record and analyze attack behaviors based on the propagation path, speed, and status of abnormal marked information, and establish an attack behavior database to record the time, type, characteristics, and impact of the attack;

[0035] S4. Build an attack prediction model. Leveraging deep learning and machine learning techniques, we mine the nonlinear and spatiotemporal features of abnormal network traffic data within the attack behavior database. We then build an attack prediction model using a long short-term memory (LSTM) network for feature extraction and pattern recognition. We regularly update the model to adapt to changes in the network environment and attack methods.

[0036] S5. Establish a network security situation awareness system to monitor and analyze the circulation of tagged information in real time. When the propagation path, speed, and status of tagged information change, evaluate the changes in network security situation through attack prediction models, timely warn of potential APT attacks, and isolate the propagation path to provide decision support and defense space for defense measures.

[0037] The working principle and use process of the present invention:

[0038] First, the system proactively disseminates specially tagged information, ensuring it covers key nodes and potential attack paths within the network. Next, it utilizes network traffic analyzers and security information management systems to monitor the flow of this tagged information in real time, capturing any anomalies. This anomaly data is then recorded and analyzed to build a comprehensive database of attack behavior. Based on this database, deep learning and machine learning techniques are employed to develop an attack prediction model that effectively identifies and predicts potential attack behaviors. Finally, a network security situational awareness system is established to assess the network's security status in real time. Once an anomaly is detected, it immediately issues an alert and implements isolation measures, providing strong protection for network security. By proactively disseminating tagged information, disseminating it through different channels, deeply mining the nonlinear and spatiotemporal characteristics of network traffic data, and monitoring and analyzing the network security situation in real time, it effectively detects and defends against APT attacks, improving network security and stability. By proactively triggering attacks, the system improves the data reliability of the attack prediction model and mitigates the threat of unknown attack vectors.

[0039] In this embodiment, preferably, the format and content of the tagged information in S1 need to include a specific identification and tracking mechanism, define the structure and encoding method of the information, and ensure its uniqueness, identifiability, and compatibility with existing network protocols. Specific identification and tracking mechanisms include one or more of the following:

[0040] A1. Unique identifier (UID): Use UUID (Universally Unique Identifier) ​​or GUID (Globally Unique Identifier) ​​to generate a unique identifier for each entity that needs to be tracked;

[0041] A2. For digital content, digital watermarking or fingerprinting technology can be used to embed a unique identifier. Digital watermarks are usually embedded in media files, including images, audio, and video.

[0042] A3. Metadata tags: Embed metadata tags in files or data packets, containing unique identifiers and other tracking information, using UTF-8 character encoding to ensure compatibility;

[0043] A4. Blockchain technology uses cryptographic hash functions to generate unique identifiers for blocks.

[0044] During implementation, these identification and tracking mechanisms must not only ensure data integrity and security but also be highly flexible and scalable to adapt to changing network environments and attack vectors. In practice, network traffic is monitored in real time, and data packets bearing specific identifiers are identified using pre-set rules and algorithms. Upon detecting abnormal behavior, the system immediately triggers an alert, recording and analyzing the relevant data to enable security personnel to rapidly implement countermeasures. Furthermore, this approach seamlessly integrates with existing security protection systems, further enhancing overall defense capabilities. This multi-layered, multi-dimensional detection and defense system effectively identifies and blocks APT attacks, ensuring a secure and stable network environment.

[0045] In this embodiment, preferably, the abnormal state threshold setting with the marked information in S2 includes determining the normal traffic range and setting the abnormal behavior threshold. The normal traffic range is determined by statistically analyzing historical data and business needs, setting a minimum and maximum threshold interval, and the abnormal behavior threshold is set by setting the alarm change range based on the historical traffic change range. When the traffic of a certain IP address or port suddenly increases or decreases and reaches the set threshold, an alarm is triggered. In actual operation, security personnel can also manually adjust the threshold according to specific needs to further improve the flexibility and accuracy of detection. Through this dynamic adjustment mechanism, the system can more effectively respond to complex and changing network attack methods and ensure the security and stability of the network environment.

[0046] In this embodiment, preferably, the abnormal state rules with the marked information in S2 include but are not limited to:

[0047] B1. Set whitelist and blacklist rules. Pre-set whitelists and blacklists for different network activities with marked information. The whitelist contains allowed network activities, and the blacklist contains prohibited network activities. When network activities that do not match the whitelist or the blacklist are detected, an alarm is triggered;

[0048] B2. Set pattern matching rules to match specific network data packets through regular expressions. When a network data packet that matches a specific pattern is detected, an alarm is triggered.

[0049] These rules not only accurately identify known threats but also continuously optimize and update the rule base through machine learning algorithms to address new attack vectors. Furthermore, the system supports real-time monitoring and logging, enabling security personnel to trace and analyze attack behaviors, enabling timely countermeasures and ensuring network security. Furthermore, through a multi-layered protection mechanism, this approach effectively intercepts potential attacks at different stages, ensuring a secure and stable network environment.

[0050] In this embodiment, preferably, the attack behavior database in S3 utilizes data mining methods including cluster analysis and association rule mining.

[0051] Cluster analysis divides massive amounts of network activity data into different categories, identifying abnormal behavior patterns. Next, association rule mining technology is used to analyze the potential connections between categories, revealing hidden attack paths and strategies. This dual mining mechanism not only improves detection accuracy, but also enables the timely detection of complex and ever-changing APT attacks. Furthermore, the system regularly updates and maintains the database to ensure that it can adapt to the ever-changing network environment and maintain efficient defense capabilities. Through this comprehensive data mining application, the present invention can effectively identify and defend against APT attacks at an early stage, ensuring the overall security of the network system.

[0052] In this embodiment, preferably, in the attack prediction model of S4, an attack score is used to quantify the threat level of the attack event, which is usually calculated based on the attributes of the attack event, including the threat index of the source IP address set, the destination IP address set, and the attack event name. The specific calculation formula is:

[0053] AtkScr=Σ(Cip / Stotal×Iatk)(ip∈Ssrc∪Sdes)

[0054] Among them, AtkScr represents the attack score, Cip represents the asset value of the IP address, Stotal represents the sum of the asset values ​​of all IP addresses, Iatk represents the threat index of the attack event name, Ssrc represents the set of source IP addresses, and Sdes represents the set of destination IP addresses. This formula calculates the attack score by comprehensively considering multiple attributes of the attack event, thereby reflecting the threat level of the attack event.

[0055] The attack prediction model will continuously monitor network activity, identify abnormal behavior, and conduct a preliminary assessment. The model will then substitute this abnormal behavior data into the above formula to quickly calculate an attack score. This score provides the security team with a direct threat assessment reference and can trigger the early warning system to promptly inform relevant personnel to take appropriate measures. Furthermore, the model will integrate historical attack records and the latest threat intelligence, dynamically adjusting the weights of various parameters to ensure the accuracy and real-time nature of the calculation results. Through this quantification and dynamic optimization strategy, the present invention can effectively predict and defend against APT attacks, significantly enhancing the security protection level of network systems.

[0056] In this embodiment, preferably, the defense measures in S5 include implementing dynamic firewall rules to block attack paths and isolate infected nodes, using automated tools for system recovery and patch management to repair damaged systems, and the automated recovery process includes backup verification, system updates, and security reinforcement steps.

[0057] The defensive measures will dynamically adjust the firewall rules based on the real-time monitoring data to ensure that the attack path is blocked in time. After isolating the infected node, the system will immediately start the automated tool to conduct a comprehensive scan and repair of the damaged system to ensure that all vulnerabilities are patched in a timely manner. In the automated recovery process, the backup verification link will ensure the integrity and availability of the backup data, and the system update step will upgrade the system to the latest version to cope with the latest security threats. Finally, the security reinforcement step will perform a comprehensive security configuration optimization on the system to further enhance the system's anti-attack capabilities. Through this series of comprehensive defensive measures, the present invention can quickly respond to and effectively resist APT attacks, ensuring the stable operation of the network system.

[0058] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting and defending against APT attacks, characterized in that: It includes the following steps: S1. Dissemination of tagged information: Design and proactively disseminate tagged information through routers, switches, or intrusion detection systems (IDS). This information is distributed through different channels, covering different paths and key nodes in the network, ensuring that the tagged information can flow through potential attack vulnerabilities while taking into account network redundancy and fault tolerance. S2. Monitor the movement and circulation of tagged information. Deploy network traffic analyzers (NTA) and security information and event management (SIEM) systems to monitor network traffic in real time, set thresholds and rules, and identify abnormal changes in information propagation paths, speeds, and status. S3. Establish an attack behavior database, record and analyze attack behaviors based on the propagation path, speed, and status of abnormal marked information, and establish an attack behavior database to record the time, type, characteristics, and impact of the attack; S4. Build an attack prediction model. Leveraging deep learning and machine learning techniques, we mine the nonlinear and spatiotemporal features of abnormal network traffic data within the attack behavior database. We then build an attack prediction model using a long short-term memory (LSTM) network for feature extraction and pattern recognition. We regularly update the model to adapt to changes in the network environment and attack methods. S5. Establish a network security situation awareness system to monitor and analyze the circulation of tagged information in real time. When the propagation path, speed, and status of tagged information change, evaluate the changes in network security situation through attack prediction models, timely warn of potential APT attacks, and isolate the propagation path to provide decision support and defense space for defense measures.

2. The method for detecting and defending against APT attacks according to claim 1, wherein: The format and content of the tagged information in S1 must include specific identification and tracking mechanisms, define the structure and encoding of the information, and ensure its uniqueness, identifiability, and compatibility with existing network protocols. Specific identification and tracking mechanisms include one or more of the following: A1. Unique identifier (UID): Use UUID (Universally Unique Identifier) ​​or GUID (Globally Unique Identifier) ​​to generate a unique identifier for each entity that needs to be tracked; A2. For digital content, digital watermarking or fingerprinting technology can be used to embed a unique identifier. Digital watermarks are usually embedded in media files, including images, audio, and video. A3. Metadata tags: Embed metadata tags in files or data packets, containing unique identifiers and other tracking information, using UTF-8 character encoding to ensure compatibility; A4. Blockchain technology uses cryptographic hash functions to generate unique identifiers for blocks.

3. The method for detecting and defending against APT attacks according to claim 1, wherein: The abnormal state threshold setting with marked information in S2 includes determining the normal traffic range and setting the abnormal behavior threshold. The normal traffic range is determined by statistical historical data and business needs, and a minimum and minimum threshold interval is set. The abnormal behavior threshold is set by setting the alarm change range based on the historical traffic change range. When the traffic of an IP address or port suddenly increases or decreases and reaches the set threshold, an alarm is triggered.

4. The method for detecting and defending against APT attacks according to claim 1, wherein: The abnormal status rules with marked information in S2 are limited to but not limited to: B1. Set whitelist and blacklist rules. Pre-set whitelists and blacklists for different network activities with marked information. The whitelist contains allowed network activities, and the blacklist contains prohibited network activities. When network activities that do not match the whitelist or the blacklist are detected, an alarm is triggered; B2. Set pattern matching rules to match specific network data packets through regular expressions. When a network data packet that matches a specific pattern is detected, an alarm is triggered.

5. The method for detecting and defending against APT attacks according to claim 1, wherein: The attack behavior database in S3 utilizes data mining methods including cluster analysis and association rule mining.

6. The method for detecting and defending against APT attacks according to claim 1, wherein: In the attack prediction model of S4, the attack score is used to quantify the threat level of the attack event. It is usually calculated based on the attributes of the attack event, including the threat index of the source IP address set, the destination IP address set, and the attack event name. The specific calculation formula is: AtkScr=Σ(Cip / Stotal×Iatk)(ip∈Ssrc∪Sdes) Among them, AtkScr represents the attack score, Cip represents the asset value of the IP address, Stotal represents the sum of the asset values ​​of all IP addresses, Iatk represents the threat index of the attack event name, Ssrc represents the set of source IP addresses, and Sdes represents the set of destination IP addresses. This formula calculates the attack score by comprehensively considering multiple attributes of the attack event, thereby reflecting the threat level of the attack event.

7. The method for detecting and defending against APT attacks according to claim 1, wherein: The S5 defense measures include implementing dynamic firewall rules to block attack paths and isolate infected nodes, using automated tools for system recovery and patch management to repair damaged systems, and the automated recovery process includes backup verification, system updates, and security hardening steps.

Images