Tracing method and device for multi-sample combined attack

Abstract

The invention relates to a tracing method and device for multi-sample combined attacks. The method comprises the following steps: detecting an attack trigger event; obtaining at least two attack samples to be traced; performing feature extraction on the at least two attack samples to be traced to obtain feature information of each attack sample to be traced; and according to the feature information of each attack sample to be traced and a pre-created target Bayesian traceability model, obtaining traceability results of the at least two attack samples to be traced. According to the scheme, the tracing efficiency for the multi-sample combined attacks can be improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a source tracing method and device for multi-sample combined attacks. Background technique [0002] Advanced Persistent Threat (Advanced Persistent Threat, APT), different from traditional network intrusion, often uses multiple attack samples to carry out combined attacks on network information systems. Due to its high risk, difficult detection, long duration and clear attack target , has caused a serious threat to network security. In order to restore network security, it is necessary to trace the source of network attacks as soon as possible to find a solution. [0003] At present, most malicious attack sample traceability analysis methods are mainly aimed at a single sample, which is not suitable for APT multi-sample combination attacks, and most of the existing traceability analysis solutions have certain limitations. The attack samples in APT come from multiple att...

AI Technical Summary

Problems solved by technology

The attack samples in APT come from multiple attack organizations. Therefore, at present, the analysis and traceability of this obfuscation attack method mainly rely on the experience of professional analysts. At the same time, the traceability analysis requires a large amount of data accumulation. With the continuous change of APT attack methods, A large amount of characteristic data is generated, which will increase the difficulty of traceability for analysts and increase the time for traceability analysis, resulting in low traceability efficiency for multi-sample combined attacks

Images