ATT&CK-based spoofing defense system, construction method and full-link defense implementation method

Abstract

The invention relates to an ATT&CK-based spoofing defense system, construction method and full-link defense implementation method. Attack technology of each technical point under each tactic in an ATT& CK framework is researched. In the initial database, a spoofing defense technology corresponding to each attack technology is given from tactical and technical levels; all spoofing defense technologies are hierarchically divided according to different action points of the network deception technology; an initial database is constructed from three dimensions of tactics, technology and action points; and in combination with the network asset condition in the current environment. For the behavior of the attacker in each stage during the intrusion period, spoofing defense technology is selectedfrom an initial database in three dimensions of tactics, technology and action point to fuse with the current network asset condition, and constructing an omnibearing spoofing defense system. Spoofing technology runs through the whole life cycle of an attack link, the TTP of an attacker is detected, defended and responded, and active trapping is carried out from the perspective of the attacker.

Description

technical field [0001] The invention belongs to the technical field of computer network security, and in particular relates to a deceptive defense system, a construction method and a full-link defense realization method for realizing honey array trapping by combining deceptive technologies based on the ATT&CK model. Background technique [0002] The issue of network security has become a common challenge faced by mankind in the information age, and domestic network security issues have become increasingly prominent. The specific manifestations are: computer systems are seriously infected and damaged by viruses; computer hacking activities have formed an important threat; information infrastructure is facing challenges in network security; information systems have many weak links in prediction, response, prevention and recovery capabilities. [0003] In the process of dealing with attackers, it is often passive and rigid to wait for the attacker to touch the network security ...

AI Technical Summary

Problems solved by technology

[0005] However, the existing spoofing technology cannot cover the attacker's full-link attack behavior, and it is difficult to achieve high-performance trapping of the attacker

Images