In view of the increasing frequency of overseas hackers

APT organizations

malware attacks and botnet activities in recent years

this article has carried out the research

development

deployment and application of traffic based attack traceability technology. The system integrates the traditional rule-based detection technology

machine learning and other advanced analysis technologies

and finds out the evil through monitoring network traffic

connections and objects signs of intentional behavior

especially after the fall. At the same time

the unified information meta language description model based on knowledge map and the association reasoning model based on knowledge map and attack chain are constructed. By analyzing the total device traffic of public network

the attack information is found

and the attack chain confirmation is realized through the intelligent association analysis engine

so as to realize the accurate detection of effective attack behavior. The black hole route is used for the link key disposal

so as to realize the attack behavior rapid disposal.