一种基于同源行为分析的APT异常发现策略

A discovery strategy for APT anomaly based on homologous behavior analysis

APT(advanced persistent threat)攻击的日益频繁对APT攻击行为的检测提出了更高的要求,对同源行为进行分析是尽早发现APT攻击行为的一种有效方法。针对数据量过大造成数据对比认证效率低下的难题,提出了借助数据标签技术,建立历史同源行为数据库,并将数据库存储到云端;依托Hadoop平台和MapReduce聚合计算能力,基于伪随机置换技术完成网络全流量并行检测,通过与数据库中的数据标签进行对比验证,来判断是否有APT攻击行为。测试结果表明,该方法可尽早从网络中发现APT异常行为,提高全数据流检测的效率。

As APT （advanced persistent threat） attacks are increasingly frequently, higher requirements for the detection of APT attacks were proposed. It was an effective method to early discover the attack behavior of APT based on homologous behavior analysis. Aiming at the problem of low efficiency of data authentication caused by excessive data, the historical behavior database with data label technology was established and the database was stored in the cloud. Relying on the Hadoop platform and the aggregate computing ability of MapReduee and the pseudorandom permutation technique, the whole traffic parallel detection of the network was realized. In order to determine whether there was a APT attack behavior, the detection of APT attacks was implemented by comparing the data labels in the database. Test results show that the proposed method can detect the abnormal behavior of APT from the network as soon as possibleand improve the efficiency of the whole data flow detection.