Host Association Graph for APT Attack Path Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus software is unable to detect attack paths during lateral movement in advanced persistent threat (APT) attacks, making it difficult to track and respond to these threats effectively.
Innovation Solution
An attack path detection method and system that establishes a host association graph from log data, labels abnormal hosts, calculates risk values, and identifies high-risk hosts to detect and trace suspicious attack paths, utilizing the connecting relationships among hosts to quickly identify potential entry points of APT attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If general anti-virus software is used for detection, then the detection process is simple, but the attack path cannot be detected during lateral movement
Solution Approach 1:
The patent segments the detection process into multiple components: establishing host association graphs from logs, labeling abnormal hosts, calculating risk values, and searching attack paths. This segmentation enables comprehensive APT detection while maintaining manageable system complexity through modular architecture.
Solution Approach 2:
The patent introduces a host association graph as an intermediary structure that connects hosts based on log data. This graph serves as a mediator between raw log data and attack path detection, enabling the system to trace lateral movement paths without requiring direct complex analysis of all log data.
2Measurement precision
If comprehensive log analysis is performed to detect attack paths, then detection accuracy improves, but tracking time increases
Solution Approach 1:
The patent performs preliminary actions by establishing host association graphs and labeling abnormal hosts before attack path search. Risk values are pre-calculated for all hosts, enabling faster attack path identification when anomalies are detected, thus reducing overall tracking time while maintaining high detection accuracy.
Solution Approach 2:
The patent replaces manual or sequential log analysis with an automated graph-based search mechanism. By substituting traditional mechanical analysis methods with algorithmic graph traversal on pre-built host association graphs, the system achieves both high detection accuracy and reduced tracking time.
3Measurement precision
If risk calculation is performed on all hosts, then high-risk hosts are accurately identified, but computational resources increase
Solution Approach 1:
The patent applies local quality by calculating risk values for all hosts but only focusing detailed analysis and attack path search on high-risk hosts (those exceeding the threshold). This approach maintains accurate risk assessment while reducing computational resources by concentrating efforts on the most suspicious hosts rather than performing exhaustive analysis on all systems.
Data Source
AI summary
An attack path detection method, attack path detection system and non-transitory computer-readable medium are provided in this disclosure. The attack path detection method includes the following operations: establishing a connecting relationship among a plurality of hosts according to a host log set to generate a host association graph; labeling at least one host with an abnormal condition on the host association graph; calculating a risk value corresponding to each of the plurality of hosts; in a host without the abnormal condition, determining whether the risk value corresponding to the host without the abnormal condition is greater than a first threshold, and utilizing a host with the risk value greater than the first threshold as a high-risk host; and searching at least one host attach path from the high-risk host and the at least one host with the abnormal condition according to the connecting relationship of the host association graph.