Method for detecting intranet lateral movement attack

Abstract

The invention provides a method for detecting an intranet lateral movement attack. The method comprises the following steps: collecting flow and log data of intranet equipment; extracting all nodes inthe data, connecting the two nodes subjected to network communication, and constructing an inter-host communication graph; extracting and combinding flow data between every two connected nodes and extracting and combinding data on the nodes to serve as feature values to be assigned to edges and points of the inter-host communication graph; performing dimension reduction on the inter-host communication graph with the features by using a network representation learning method, and extracting a low-dimensional feature vector by using an auto-encoder; and classifying the low-dimensional feature vectors by using a semi-supervised classification learning algorithm, and distinguishing hosts suspected to be attacked.

Description

technical field [0001] The invention relates to the field of computer network security, and is used for combating the lateral movement attack stage in advanced persistent threats, more specifically, a detection method for intranet lateral movement attacks. Background technique [0002] A lateral movement attack refers to an attacker targeting a specific internal network, starting from an infected peripheral device, accessing other hosts in the network and stealing sensitive information (such as credentials, confidential information, etc.) etc.) malicious infiltration behavior. Through lateral movement attacks, attackers can finally obtain domain control rights and then control all devices, thereby achieving the purpose of stealing important data and residing in intranet systems, which seriously threatens the information security of enterprises and other organizations. [0003] Lateral movement attacks are widely used in complex network attacks, and are also a very important...

AI Technical Summary

Problems solved by technology

Because attackers can compromise multiple devices through lateral movement attacks, it is very easy for attackers to hide themselves and difficult to eradicate

[0004] At present, traditional detection technologies cannot defend against such advanced attacks. Most of the solutions are intrusion detection deployed on the network boundary, such as the detection of abnormal traffic at the boundary or the heuristic detection of 0day vulnerabilities, etc.

However, there is no good solution to the attacks that have penetrated into the intranet, so the detection of lateral movement attacks is a difficult problem that cannot be effectively solved now

Images