A Flow-Based Tracing Attack Path Method in Network Shooting Range

Abstract

The invention relates to a flow-based traceability attack path method in a network shooting range, which is designed based on a directional network network attack traceability technology, and through accurate and effective flow monitoring in the network shooting range, from the perspective of reverse traceability, the description of the traceability attack path is realized , which can assist security analysts to better disassemble network attack behaviors. Among them, the reverse source tracing method generates attacker fingerprints through the extraction of attacker behavior characteristics, and directional traces of attacker traffic in historical logs, which is more targeted It can reproduce the attack path in a more comprehensive manner. Aiming at the description of the attack path, the network kill chain model is introduced, and the network traffic of different protocols and time nodes can be reasonably divided by finding the attack time node, which is more conducive to security analysts. Analyze how the attack occurred.

Description

technical field [0001] The invention relates to a traffic-based source tracing attack path method in a network shooting range, belonging to the technical field of network shooting ranges. Background technique [0002] The construction of a national network shooting range is an urgent need of the national cyberspace security strategy, an important strategic measure to enhance my country's cyberspace security capabilities, and a security guarantee for building a country with a powerful information system. Through the construction of the national network shooting range, it can provide analysis, design, research and development, integration, testing, evaluation, operation and maintenance and other full-life cycle guarantee services for the construction of national key information infrastructure security systems such as finance, telecommunications, energy, transportation, and electric power, and solve problems that cannot be solved. Conduct realistic simulation and testing of com...

AI Technical Summary

Problems solved by technology

From a systematic point of view, all kinds of traceability technologies are used independently and independently, and there is a lack of research on the overall model of targeted network attack traceability.

Images