Multidimensional deep-level APT (Advanced Persistent Threat) attack detection method

Abstract

The invention relates to the field of APT attack detection and aims at providing a multidimensional deep-level APT (Advanced Persistent Threat) attack detection method. The method comprises steps: traffic collection and analytical reduction are carried out on common network application layer protocol data packets; acquired network application behaviors are analyzed and detected, an attack behavior is recorded and an alarm is given; the detection strategy and the mechanism for each attack point are further optimized; and an APT attack link is generated through correlation. Multidimensional deep-level analysis and detection can be carried out on possible attack points in each stage of an APT attack life cycle, an attack clue found in an attack stage can be used to further serve as the basis for the detection of other attack stages, the detection conclusion in each attack stage is used for further correlation, and an attack evidence with higher certainty is formed.

Description

technical field [0001] The invention relates to the field of APT attack detection, in particular to a method for multi-dimensional in-depth detection of APT attacks. Background technique [0002] APT (Advanced Persistent Threat) attack is a series of covert and persistent attack processes that are organized and carefully planned for specific targets. APT attacks often use malware to exploit system vulnerabilities, and use external C&C servers to continuously monitor and steal data from the specific target of the attack. It is precisely because APT attacks are based on specific attack targets, are carefully planned, and can Further, through remote control and combined with artificial skills, the attack process is executed in a more targeted manner. The whole process is hidden for a long time and is difficult to detect. Therefore, once the attack is successful, it will cause a very large threat to the attack target. [0003] The life cycle of an APT attack is generally divide...

AI Technical Summary

Problems solved by technology

[0012] Traditional protection mechanisms and products are more based on single-point detection based on several attack methods in the APT attack life cycle. The detected attack points and attack levels are relatively single, and the detection strategies of each attack point cannot interact. and self-optimization, which is not conducive to discovering latent APT attacks, cannot outline APT attack links, and is easily bypassed by well-planned APT attacks. Therefore, it is necessary to analyze possible attack points in each stage of the APT attack life cycle, from In-depth analysis and detection are carried out in multiple dimensions, and the attack clues found in a certain attack stage can be further used as the detection basis for other attack stages. The detection conclusions of each attack stage can be further correlated to form more certain attack evidence. To discover APT attacks more efficiently

Images