APT attack detection method, terminal equipment and storage medium

Abstract

The invention relates to an APT attack detection method, terminal equipment and a storage medium, and the method comprises the steps: S1, collecting a to-be-detected network request data set, and extracting a domain name contained in the to-be-detected network request data set; S2, constructing a domain name IP bipartite graph according to the extracted relationship between the domain name and theIP, converting the domain name IP bipartite graph into a domain name graph only with domain name nodes according to the mapping relationship between the domain name and the IP, and obtaining connected sub-graphs in the domain name graph; and S3, analyzing each connected sub-graph in the domain name graph to obtain a suspicious domain name list. According to the method, the relevance between domain names is considered, the relevance between IPs and the specific situation that the domain names map the IPs are calculated, and the malicious domain names are detected more accurately by improving the weight of the IP jointly mapped by most malicious domain names.

Description

technical field [0001] The invention relates to the field of malicious attack detection, in particular to an APT attack detection method, a terminal device and a storage medium. Background technique [0002] In recent years, a class of cyber attacks called Advanced Persistent Threats (APTs) has brought very serious losses to organizations such as governments and enterprises. This type of attack called APT has the characteristics of long duration, complex attack means, and strong concealment, which makes it difficult to detect this type of attack. In the face of APT attacks with long latency and high concealment, traditional detection methods (such as firewalls, intrusion detection systems, etc.) cannot achieve effective detection. [0003] At present, there are three main detection methods for traditional APT attacks: [0004] (1) The detection method based on machine learning analyzes the unique characteristics of APT attacks in the overall behavior, and then uses these u...

AI Technical Summary

Problems solved by technology

[0007] Because APT usually lasts for a long time, different attack stages distributed in irrelevant time periods will be mistaken for several irrelevant independent events, and APT attacks usually use complex attack methods such as social engineering, 0-day vulnerabilities, and spear-phishing attacks. Therefore, the traditional technology that only focuses on border defense and real-time detection based on a single point in time is very inefficient in dealing with the complexity of APT attacks

Images