Attack path restoration method and apparatus

Abstract

The invention relates to an attack path restoration method and apparatus. According to the method, through comprehensive analysis on a security event alarm, and a connection relationship of each device in a network topology, a connection relationship between each of respective lists of an attacker, an internal network weak point, an attack source and the attacker and each set of device is obtained, thereby finishing restoration of an attack process. Compared with the existing path restoration method, the method provided by the embodiment of the invention can go deep into an internal network todiscover a security weak point in internal network protection, so that an attack path is traced to the source and thus the method is more effective to improve the enterprise security and improves theanalysis efficiency; and meanwhile, a noise of an uncritical connection in massive security events can further be shielded and only an attack path coming into effect is traced to the source; moreover, all attacks can be restored, so the restoration capacity is improved; and in addition, according to the method provided by the invention, while the attack path is restored, an operating service is not affect and thus the normal operation of the service can be kept.

Description

technical field [0001] Embodiments of the present invention relate to the field of communication technologies, and in particular to a method and device for restoring an attack path. Background technique [0002] With the rapid development of the Internet, network attacks are also intensified, especially DDOS and other types of attacks. Attackers take advantage of the rapid and extensive interconnectivity of the network, making traditional security measures basically useless and seriously threatening the security of enterprises; and network attacks Most of the attackers use forged IP addresses, which makes it difficult for the attacked to determine the location of the attack source, thus making it impossible to implement targeted protection strategies. All these make the tracking technology of reverse tracking the source of the attack an important part of the network active defense system. It plays a vital role in minimizing the current effect of the attack and deterring the ...

AI Technical Summary

Problems solved by technology

[0008] The embodiment of the present invention provides an attack path restoration method and device, which are used to overcome the defects of low analysis efficiency, limited restoration ability and affecting normal business operation in the existing attack path restoration method

Images