APT detection method based on context behavior analysis

Abstract

The invention discloses an APT (Advanced Persistent Threat) detection method based on context behavior analysis, which comprises the following steps: collecting log data in real time, objects related to the log data comprising processes, files and events; then preprocessing the collected log data; performing intrusion detection based on context behavior analysis according to the simplified data dependency graph; and taking the newest data dependence graph, and tracing according to the process carrying the threat tag contained in the newest data dependence graph to obtain a complete APT attack chain. The APT detection method based on context behavior analysis has good adaptability and high detection success rate.

Description

technical field [0001] The present application belongs to the field of APT attack detection, and specifically relates to an APT detection method based on contextual behavior analysis. Background technique [0002] APT (Advanced Persistent Threat) attacks, that is, advanced persistent threat attacks, usually refer to attacks on governments, core infrastructure (such as energy, transportation, communications) and important industries (such as military industry, finance, and medical care). Compared with traditional attack modes, APT attacks have the characteristics of long duration, long attack chain, high concealment, various methods, and strong harm. They can use social engineering, 0-day vulnerabilities, infected storage media, etc. way to attack. Therefore, it is difficult to directly detect a complete APT attack chain using existing detection methods. Analysts usually detect a certain step of the attack at a certain point in time, and use forensic analysis to quickly loca...

AI Technical Summary

Problems solved by technology

Among them, the detection method based on network traffic analysis relies on the traffic generated by the program, and cannot directly observe the activities of malicious programs; the detection method based on software static feature analysis is easily avoided by polymorphic changes and confusion of code; the detection method based on hook tracking analysis will Modifying the logic of the underlying implementation code makes the program / system unstable and may expose new vulnerabilities; the detection method based on dynamic sandbox analysis needs to simulate the real environment, and the running overhead is high

In addition to the above traditional grid attack detection methods, a detection method of endpoint detection and response is also proposed, but this method also has the defects of threat alarm fatigue, analysis of logs requires technical knowledge costs, and low log storage efficiency

Images