Method for defending APT attack and safety controller

Abstract

The invention discloses a method for defending an advanced persistent threat (APT) attack and a safety controller. The method comprises: a safety controller constructs a global data stream knowledge base according to flow table information obtained from a network device, wherein the data stream knowledge base includes flow directions of data streams in all network devices at all historical times in a global range; the safety controller directing an abnormal data stream in the data stream knowledge base to a safety device, so that the safety device can carry out depth detection on a data packet in the abnormal data stream conveniently; the safety controller receives warning information submitted by the safety device, wherein the warning information includes a suspected malicious behavior that is determined by the safety device during depth detection; and the safety controller carries out safety processing on the network devices based on the suspected malicious behavior in the warning information. The invention provides a novel method for defending an APT attack, so that an APT attack can be defended effectively.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method for defending against APT attacks and a security controller. Background technique [0002] Network security, especially the Internet security is facing unprecedented challenges, which mainly come from new types of attacks and threats that are organized, have specific targets, and last a long time. It is called APT (Advanced Persistent Threat) attack internationally, and it is generally called APT (Advanced Persistent Threat) attack in China. It is called "Advanced Sustainability Threat". Threat is a potential factor that causes damage to a specific system, organization and its assets, and reflects the process that the attackers continue to attack the attacked object in various forms for a long time according to their mission requirements. From a macro perspective, all aspects of security threats are a closed ring structure centered on the attacker. As time and various o...

AI Technical Summary

Problems solved by technology

[0006] 2) Attack forms are becoming more and more complex

Images