基于大数据的APT威胁检测方法

Big Data Based APT Detection Method

在分析APT(advanced persistent threat)攻击特点及手段的基础上提出一种基于大数据关联技术的APT检测方法。该方法通过分布式采集数据,利用各攻击阶段特征选取元素实现整个攻击链的检测。关注攻击对设备及网络功能的影响,将检测的重心从对攻击的检测转换到对设备及网络各种属性是否正常运作的检测上。同时参考APT攻击在现有网络中发挥作用的步骤及实施方法,构建基于攻击链扩展的多面体检测模型。

By analyzing the characteristics and means of attacking for APT （Advanced Persistent Threat） , we propose a method for APT detection based on big data correlation technology. Through distributed data collection, the whole attack chain can be detected by using the teature element se- lected in each attack phase. This paper focuses on the impact of attack on the device and network functions, and shifts the key point for detection from the attack itself to the normal operation of vari- ous properties of the equipment and network. At the same time, we also reier to the steps and imple- mentation methods of APT attack which play a role in the existing network, and build a polyhedron detection model based on the extension of attack chain.