摘要
在分析APT(advanced persistent threat)攻击特点及手段的基础上提出一种基于大数据关联技术的APT检测方法。该方法通过分布式采集数据,利用各攻击阶段特征选取元素实现整个攻击链的检测。关注攻击对设备及网络功能的影响,将检测的重心从对攻击的检测转换到对设备及网络各种属性是否正常运作的检测上。同时参考APT攻击在现有网络中发挥作用的步骤及实施方法,构建基于攻击链扩展的多面体检测模型。
By analyzing the characteristics and means of attacking for APT （Advanced Persistent Threat） , we propose a method for APT detection based on big data correlation technology. Through distributed data collection, the whole attack chain can be detected by using the teature element se- lected in each attack phase. This paper focuses on the impact of attack on the device and network functions, and shifts the key point for detection from the attack itself to the normal operation of vari- ous properties of the equipment and network. At the same time, we also reier to the steps and imple- mentation methods of APT attack which play a role in the existing network, and build a polyhedron detection model based on the extension of attack chain.
作者
王通
郭渊博
祝松帅
严新成
WANG Tong;GUO Yuanbo;ZHU Songshuai;YAN Xincheng(Information Engineering University,Zhengzhou 450001,China;State Key Laboratory of Mathematical Engineering and Advanced Computing,Zhengzhou 450001,China)
出处
《信息工程大学学报》
2017年第6期719-725,共7页
Journal of Information Engineering University
关键词
APT攻击
大数据
攻击链
元素
关联分析
advanced persistent threat
big data
kill chain
element
relevancy
