Testing machine family confidence method, device and equipment and storage medium

Abstract

The invention belongs to the technical field of network security, and discloses a method, a device and equipment for testing family confidence of a machine, and a storage medium. The method comprises the steps of obtaining sample information of a suspected test machine sample; matching the sample information with each matching rule in a family matching rule set corresponding to the target advanced threat behavior body family to obtain a rule matching result; and determining family confidence scores of the suspected test machine sample and the target advanced threat behavior body family according to a rule matching result. As the family matching rule set is preset, real-time setting is not needed, the matching efficiency is high, the family confidence score can be quickly determined, and then the possibility that the suspected test machine sample belongs to the target advanced threat behavior body family can be judged through the family confidence score; whether the suspected test machine sample is the advanced threat behavior body or not can be judged according to the possibility that the suspected test machine sample belongs to the target advanced threat behavior body family, so that whether the suspected test machine sample is the advanced threat behavior body or not can be quickly identified.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a testing machine family trust method, device, equipment and storage medium. Background technique [0002] In the process of testing and confronting advanced threat (Advanced Persistent Threat, APT) actors and security terminal products, advanced threat actors install the terminal product in a virtual environment in most cases, and test their malicious tools against security terminals Product capabilities to evaluate the feasibility of the next attack launch. Security terminal products need to quickly identify advanced threat actors and predict their next attack trend. During the confrontation with advanced threat actors, advanced threat actors will continue to expose their own habitual characteristics. Therefore, how to quickly identify collected suspected test machine samples Whether it is an advanced threat actor is the core issue in confronting advanced threat actor...

AI Technical Summary

Problems solved by technology

[0004] The main purpose of the present invention is to provide a test machine family confidence method, device, equipment and storage medium, aiming to solve the technical problem of how to quickly identify whether the collected suspected test machine samples are advanced threat actors

Images