Advanced persistent threat attack detection method and device

Abstract

The invention discloses an advanced persistent threat attack detection method and device. The method comprises the steps of obtaining advanced persistent threat viruses in advanced persistent threat attack samples, establishing a communication message in a connection phase with a command and control server, and establishing feature libraries of fields according to the fields in the communication messages; obtaining a to-be-detected message, and extracting one or more fields from the message; and matching the extracted field with the corresponding feature library thereof, and judging whether the message is an advanced persistent threat message or not according to a matching result. According to the embodiment of the invention, the samples are analyzed, the feature libraries are established,and the to-be-detected message is matched with the feature library to judge whether the message is the advanced persistent threat message or not, so the message can be effectively detected. Two timesof matching operation: fuzzy matching and accurate matching are employed, so the detection efficiency and accuracy are greatly improved.

Description

technical field [0001] The invention relates to communication technology, in particular to a method and device for detecting advanced persistent threat attacks. Background technique [0002] Advanced Persistent Threat (APT) refers to an attack form in which organizations or groups use advanced attack methods to carry out long-term persistent network attacks on specific targets. Compared with other forms of attack, the principle of APT attack is more advanced and advanced. It integrates intelligence, hacking technology, social engineering and other means to launch complex and professional attacks on valuable information assets. [0003] The difference between APT attack and traditional attack is that its attack purpose is very clear. Through careful planning, establish long-term attack points and wait for the opportunity to complete the scheduled tasks. Careful organization by professionals, long-term monitoring, and dynamic adjustments to the attack process as defense weak...

AI Technical Summary

Problems solved by technology

APT attacks are generally specially designed, with complex attack methods, and more use of 0day vulnerabilities (that is, vulnerabilities that have been discovered but have not yet been patched) to bypass traditional code-based security solutions (such as anti-virus software, firewalls, intrusion prevention systems ( Intrusion Prevention System, referred to as IPS), etc.), and lurking in the system for a longer period of time, making it difficult for traditional defense systems to detect

Images