APT (Advanced Persistent Threat) attack detection method and APT attack detection device based on malicious domain name detection

Abstract

The invention provides an APT (Advanced Persistent Threat) attack detection method and an APT attack detection device based on malicious domain name detection. The APT attack detection method comprises the following steps: obtaining communication data in a network; analyzing the communication data so as to extract the IP (Internet Protocol) of a source host, a domain name inquired by the source host and the domain name inquiry time related in the communication data; inquiring a domain name risk grade database so as to determine whether the domain name inquired by the source host exists in the domain name risk grade database or not, if so, extracting and displaying a risk grade result corresponding to the domain name from the domain name risk grade database, and if not, evaluating the risk grade of the domain name and displaying a risk grade evaluation result so as to determine whether the source host is attacked by APT or not, wherein the risk grade evaluation result comprises abnormal heartbeat analysis and sub-domain name semantic analysis. The APT attack detection method and the APT attack detection device provided by the invention are capable of accurately detecting unknown malicious domain names; therefore, APT attacks can be detected in time; and consequences due to the APT attacks can be reduced.

Description

Technical field [0001] The invention relates to the technical field of network security, in particular to an APT attack detection method and device based on malicious domain name detection. Background technique [0002] In recent years, the successive occurrence of a series of major security incidents has brought a new term-APT attack into people's field of vision. APT (AdvancedPersistentThreat) is the advanced persistent threat. The characteristics of APT attacks that are different from traditional attacks are: A (Advanced) problem, the attacker will adapt to the defender to generate resistance, and the use of advanced intrusion methods to achieve the intrusion plan makes it difficult to effectively deal with the traditional boundary defense technology based on feature matching; P (Persistent) difficult problem, continuous attack detection challenge, APT attack time span is very long, after intrusion is often long-term latency, there is no obvious abnormality at a single time p...

AI Technical Summary

Problems solved by technology

However, such methods are often accompanied by a large number of false positives and false positives, and have poor adaptability in different user environments and business demand scenarios.

Images