Deceptive defense system, construction method and full-link defense implementation method based on att&ck

Abstract

This application relates to a deceptive defense system based on ATT&CK, a construction method and a full-link defense implementation method, and studies the attack technology of each technical point under each tactic in the ATT&CK framework; At the level, the deception defense technology corresponding to each attack technology is given, and all deception defense technologies are divided into layers according to the different action points of the network deception technology. Network asset situation, according to the behavior of the attacker at each stage during the intrusion, select the deception defense technology from the initial database and integrate it with the current network asset situation in the three dimensions of tactics, technology, and action point to build a comprehensive deception defense. system. In the present invention, the deception technology runs through the entire life cycle of the attack link, and the TTP of the attacker is detected, defended and responded to, and active trapping is performed from the attacker's perspective.

Description

technical field [0001] The invention belongs to the technical field of computer network security, and in particular relates to a deceptive defense system, a construction method and a full-link defense implementation method based on the ATT&CK model for deceptive technology combination to realize honey-array trapping. Background technique [0002] Network security issues have become a common challenge faced by mankind in the information age, and domestic network security issues have become increasingly prominent. The specific manifestations are: the computer system is seriously infected and damaged by viruses; computer hacking activities have formed an important threat; the information infrastructure is facing the challenge of network security; the information system has many weak links in the ability of prediction, response, prevention and recovery. [0003] In the process of responding to attackers, it is often passive and rigid waiting for the attacker to touch the network...

AI Technical Summary

Problems solved by technology

[0005] However, the existing spoofing technology cannot cover the attacker's full-link attack behavior, and it is difficult to achieve high-performance trapping of the attacker

Images