基于ATT&CK的多源数据深度安全检测技术研究

Research on deep security detection technology of multi-source data based on ATT&CK

APT攻击检测已成为落实《中华人民共和国网络安全法》要求的重要内容。本文基于攻击战术和攻击技术统一描述的ATT&CK模型,提出一种多源数据深度安全监测模型。该模型可以在APT攻击的早期阶段,实现攻击全貌的分析和呈现。实践案例验证本文提出的模型能够有效提升安全防御和响应能力。

The detection of APT attack has become an important content of implementing the requirements of network security law.Based on the ATT&CK model,which describes attack tactics and attack techniques,this paper proposes a deep security monitoring model for multi-source data.This model can analyze and present the whole picture of APT attack in the early stage.The current network practice case verifies that the model proposed in this paper can effectively improve the ability of security defense and response.