APT (advanced persistent threat) detection method and system

Abstract

The invention provides an APT (advanced persistent threat) detection method and an APT detection system. The APT detection method comprises the following steps of obtaining attack steps included by each attack scene of the APT and an association rule which is used for judging whether a previous attack step and a later attack step of each attack step exist or not, wherein each attack step corresponds to a plurality of different events capable of realizing the attack steps; obtaining a detection result of network intrusion, and recording an alarm event generated in network; if the alarm event is taken as an event corresponding to the attack step of a certain attack scene, triggering a detection process of the APT, processing an obtained attack sequence and outputting the obtained process result as APT information.

Description

technical field [0001] The present invention relates to the field of information security, in particular to a detection method and system for advanced persistent threats. Background technique [0002] As hacker attacks become more and more organized and profitable, APT (Advanced Persistent Threat, Advanced Persistent Threat) has become the most serious threat to government and major enterprise information systems. Macroscopic network security monitoring has the characteristics of a wide monitoring range and involves many key units, and is an ideal environment for detecting APT attacks. [0003] From a technical point of view, APT is not a new attack method, but a general term for a specific type of attack, that is, the entire process of a series of targeted attacks by attackers in order to obtain important information of an organization or even a country. . APT attacks use a variety of attack methods, including various latest attack methods and social engineering methods, ...

AI Technical Summary

Problems solved by technology

[0005] 1) Due to the diversity of APT, it is difficult to cover all attack scenarios, making it difficult to fully detect

In order to achieve specific goals, attackers can use a variety of methods. As a defender, it is difficult to exhaustively enumerate all possible scenarios. Once the scenario construction is missed, it will cause false negatives in detection.

[0006] 2) APT often uses encryption to transmit sensitive information, and bypass monitoring is difficult to detect

Once an attacker succeeds in intruding, they will often transmit the stolen sensitive information through an encrypted channel. As a bypass detection device, it will not be able to match the encrypted data.

[0007] 3) APT attacks often infiltrate based on zero-day vulnerabilities, and traditional intrusion detection devices based on feature matching have lagging characteristics

Once the real-time detection of the attack behavior is missed, even if the detection features are updated later and the detection capability is obtained, the process of the APT attack cannot be traced back

[0008] 4) APT attack is a long-lasting attack process. The purpose of the attack is usually not to obtain a certain benefit but to maintain long-term benefits. This makes every attack step in the APT attack process imperceptible , the use of traditional intrusion detection may only find some low-level security events that cannot attract the full attention of administrators

[0009] Based on the above deficiencies, it can be concluded that the difficulty of APT detection is that the attacker's behavior is carried out within a time window, while traditional intrusion detection equipment is based on real-time detection at time points, lacking the support of the detection context

Images