APT detection analysis method and system based on network threat intelligence knowledge

By constructing an attack attribution map and an automated threat intelligence metadata database, and utilizing key information quadruple encoding and technical tactical label semantics, an alert APT lifecycle chain is generated. This solves the problems of inaccurate APT detection results and insufficient interpretability in existing technologies, and achieves efficient and readable APT detection and analysis.

CN121530604APending Publication Date: 2026-02-13PEKING UNIV
0 Cites 1 Cited by

Patent Information

Application Number
CN202411107332.X
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2024-08-13
Publication Date
2026-02-13

AI Technical Summary

Technical Problem

Existing APT detection and analysis technologies based on attribution analysis lack the accuracy and interpretability of detection results, have insufficient generalization ability to resist new heterogeneous attacks, and are difficult to achieve direct mapping between threat intelligence and system attribution logs, resulting in insufficient improvement in defense capabilities.

Method used

We employ an APT detection and analysis method based on network threat intelligence knowledge. By constructing an attack source map and an automated threat intelligence utilization metadata database, we generate an alert APT lifecycle chain using key information quadruple encoding and technical and tactical label semantics, and use generative artificial intelligence tools to generate standardized APT attack reports.

Benefits of technology

It achieves efficient APT detection and attribution analysis, provides highly interpretable detection results, helps security professionals analyze and understand APT attack alerts more intuitively and efficiently, and enriches the interpretability of APT detection results.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention discloses an APT detection analysis method and system based on network threat intelligence knowledge, and belongs to the technical field of information security. The method comprises the following steps: acquiring an application data set, wherein the application data set comprises multi-source heterogeneous network threat intelligence data and related system traceability logs; constructing an attack traceability graph based on a related system traceability log; according to multi-source heterogeneous network threat intelligence data, constructing a threat intelligence automatic utilization metadatabase composed of coding results of key information tetrads; coding the traceability log edge, and obtaining an attack-related traceability log by matching a coding result of the key information tetrad; constructing an attack traceability sub-graph according to the attack-related traceability log; and for the attack traceability sub-graph, performing attack attribution based on technical and tactical label semantics by using the technical and tactical labels of the traceability log edge, and generating an alarm APT life cycle chain and a standardized attack report. According to the method, efficient APT detection and attribution analysis as well as high-interpretability APT detection analysis can be realized.
Need to check novelty before this filing date? Find Prior Art