APT detection method based on matching of flow fingerprint and communication features

Abstract

The invention provides an APT detection method based on the matching of a flow fingerprint and communication features, and the method comprises the steps: obtaining and storing a flow fingerprint of anetwork flow to form a network flow fingerprint database; building a communication feature database; carrying out the layer-by-layer analysis of a captured data packet according to the TCP / IP protocol; carrying out the abnormal flow detection, and performing the matching of the communication features of the flow packet with the communication feature database according to the comparison of the calculated flow fingerprint feature information entropy and a fingerprint baseline; and carrying out the comparison of the abnormal flow communication features with the features in an APT communication feature database. The method achieves the quick analysis of the network flow through a flow analysis method, obtains the network flow fingerprint and the communication features, judges whether the network flow is abnormal or not through a communication feature matching result and a flow fingerprint feature baseline change result, improves the discovery speed of the abnormal flow, performs the matching of the communication features of the abnormal flow with the APT communication feature database, judges whether the abnormality is an APT attack or not, and greatly improves the APT attack detection precision.

Description

technical field [0001] The invention belongs to the technical field of APT attack detection, and in particular relates to an APT detection method based on traffic fingerprint and communication feature matching. Background technique [0002] Analyzing the network through traffic is now relatively mature and has become the mainstream method for detecting the network. By capturing network traffic and then analyzing it, it is possible to identify various states of the network. In our daily work and life, network traffic is in a normal state most of the time, and there is only a small probability that abnormalities will occur. Therefore, using most The difference between the normal situation and the occurrence of anomalies can detect the occurrence of anomalies in the network in time. Many security protection companies around the world have conducted long-term analysis and research on APT attacks, and have given detection reports on the characteristics of APT. The report shows t...

AI Technical Summary

Problems solved by technology

Many security protection companies around the world have conducted long-term analysis and research on APT attacks, and have given detection reports on the characteristics of APT. The report shows that an APT attack event usually includes six main processes and lasts for a long time. During the period of data collection in the early stage and the intrusion and data acquisition stage in the later stage, various attack methods will be used, because these attack methods are usually carried out with viruses automatically generated by software, which results in multiple matching attacks in the attack process. characteristics, which are difficult to detect in advance

Images