Attack path detection method, attack path detection system and non-transitory computer-readable medium

An attack path detection system, comprising:

• a storage device, configured for storing a host log set;
• and
• a processor, electrically connected to the storage device, the processor comprises:
• a host relationship establishing unit, is configured for establishing a connecting relationship among a plurality of hosts according to a host log set to generate a host association graph, wherein the host log set comprises a log corresponding to each of the plurality of hosts;
• an abnormal labeling unit is electrically connected to the host relationship establishing unit, and configured for labeling at least one host with an abnormal condition on the host association graph, wherein the abnormal labeling unit further comprising:
• a file relationship establishing unit, is configured for establishing a file association graph of each of the plurality of hosts according to the host log set, wherein each of the file association graph comprises a file connecting relationship among a plurality of files corresponding to each of the plurality of hosts, and each of the plurality of files corresponds to a hash value;
• and
• a malicious file determining unit, is electrically connected to the file relationship establishing unit, and configured for utilizing the hash value to determine whether corresponding file has a malicious data;
• and
• a host calculating unit is electrically connected to the abnormal labeling unit, and configured for calculating a risk value corresponding to each of the plurality of hosts;
• in a host without the abnormal condition, determining whether the risk value corresponding to the host without the abnormal condition is greater than a first threshold, and utilizing a host with the risk value greater than the first threshold as a high-risk host,
• wherein the host calculating unit is configured for searching at least one host attach path between the high-risk host and the at least one host with the abnormal condition according to the connecting relationship of the host association graph.

A non-transitory computer-readable medium including one or more sequences of instructions to be executed by a processor for performing an attack path detection method, wherein the method comprises:

• establishing a connecting relationship among a plurality of hosts according to a host log set to generate a host association graph, wherein the host log set comprises a log corresponding to each of the plurality of hosts;
• labeling at least one host with an abnormal condition on the host association graph, further comprising establishing a file association graph of each of the plurality of hosts according to the host log set, wherein each of the file association graph comprises a file connecting relationship among a plurality of files corresponding to each of the plurality of hosts, and each of the plurality of files corresponds to a hash value, utilizing the hash value to determine whether corresponding file has a malicious data;
• calculating a risk value corresponding to each of the plurality of hosts;
• in a host without the abnormal condition, determining whether the risk value corresponding to the host without the abnormal condition is greater than a first threshold, and utilizing a host with the risk value greater than the first threshold as a high-risk host;
• and
• searching at least one host attach path from the high-risk host and the at least one host with the abnormal condition according to the connecting relationship of the host association graph.