Method and device for detecting threat attack, equipment and storage medium

Abstract

The embodiment of the invention discloses a method and device for detecting advanced persistent threat attacks by utilizing an access relation, computer equipment and a readable storage medium. The method comprises the steps that acquiring business assets, determining the type of a business access strategy of a business access relation according to the business assets, wherein the type of the business access strategy comprises a business necessary access strategy and a business unnecessary access strategy; according to the service assets, sorting the service access relationship to generate a network access control list; if the service access strategy in the service access relationship is a service non-necessity access strategy, defining the service access strategy as rejection; detecting the flow of the server, matching the flow of the server with the network access control list, determining the flow of the server of which the service access strategy is rejected as an advanced persistent threat, and giving an alarm. The advanced persistent threat attack is restrained from the path from organizing the service characteristics of the system, and the efficiency of safety management work and the effect of safety operation and maintenance are improved.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a method, a device, a computer device and a readable storage medium for detecting an advanced persistent threat attack by using an access relationship. Background technique [0002] At present, a complete APT (Advanced Persistent Threat, Advanced Persistent Threat) attack roughly has the following stages: [0003] Intelligence Gathering Phase: The goal of this phase is to gather not only strategic information about the intended target IT environment, but also information about its organizational structure. The information collected can range from the business applications and software used by the enterprise to the roles and relationships that exist in the organization. Intrusion Phase: Using the information obtained during the intelligence gathering phase, supplemented by the accumulated knowledge of previous attacks on the corporate environment, the threat acto...

AI Technical Summary

Problems solved by technology

Among them, for stage 1, the improvement of personnel security awareness is a continuous process, which requires a large amount of information security awareness training and long-term and continuous investment of a large amount of human resources; for stage 2, stage 3, and stage 4, due to the need to deploy More protective equipment requires a large amount of capital investment at this stage; at the same time, reasonable and effective use of the above equipment requires maintenance personnel with a very high technical level and high-end human resources investment; therefore, it can be seen from the above that, The disadvantage of the existing technical protection solutions against APT attacks is that it requires a lot of resource investment, especially in terms of funds. Depending on the size of the organization, it may require tens or millions of investments, and the cost is too high.

Images