Discrimination method for advanced persistent threat attack

Abstract

The invention relates to a discrimination method for advanced persistent threat attack. The discrimination method comprises the following steps: collecting an API (Application Program Interface) calling sequence of a terminal sample program system; extracting the API calling short sequence of the terminal sample program system through a MapReduce module, then, calculating the information gain of the short sequence, and screening program behavior characteristics with huge information gain; scanning the API calling sequence of the terminal sample program system again to obtain the behavior characteristics of a terminal sample program; using the behavior characteristics of each sample program as input by a statistical machine learning model module, training the statistical machine learning model module until the classification correction rate of the training sample program by the statistical machine learning model module is above 90%, determining a model parameter, and taking the model parameter as an APT (Advanced Persistent Threat) attack discriminator; collecting the system calling sequence of a target terminal program; and after the API calling sequence of the target program is collected and the behavior characteristics of the target program are extracted, judging whether the target program has attack behaviors. The discrimination method is high in APT attack detection capability and shortens the extraction time of program behavior characteristics.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for distinguishing advanced persistent threat attacks. Background technique [0002] Advanced Persistent Threat (Advanced Persistent Threat) attacks are cyber attacks and intrusions launched by hackers against customers for the purpose of stealing core data. In terms of attack channels, there are various APT attack channels. Among the well-known APT incidents that have been exposed so far, social attacks, 0day exploits, and physical ferrying emerge in endlessly, while traditional detection often only focuses on border defense. Once the system border is bypassed, the difficulty of implementing subsequent attack steps will be greatly reduced. From the behavior point of view, it is difficult to extract the characteristics of APT attack behavior. APT generally uses 0day vulnerabilities to obtain permissions and conduct remote control through unknown Trojan hor...

AI Technical Summary

Problems solved by technology

The disadvantage of this method is that the flexibility of the rule base is insufficient, and its ability to detect unknown APT attacks is very limited, and the difficulty of maintaining the rule base will increase with the increase in the number of rules.

Images