基于文件、进程和网络的APT检测模型  

APT Information Stolen Behavior Detection based on File,Process and Network Factor Analysis

作　　者：朱平[1] 史记[1] 杜彦辉[1] 

机构地区：[1]中国人民公安大学网络安全保卫学院,北京100038

出　　处：《信息安全与通信保密》2014年第3期99-103,共5页Information Security and Communications Privacy

摘　　要：APT(Advanced Persistent Threat)攻击造成的信息泄漏是目前国家核心部门和大型商业集团面临的最严重的信息安全威胁。通过APT攻击开展的信息窃取行为一般受政治势力或特定利益集团操控,由具有丰富经验的网络渗透组织或团队实施,具有持续时间长、技术性强、策略性高的特点,攻击使用的APT木马变化多端,信息窃取行为手段随目标对象的不同而千变万化,常规检测手段和软件难以防范。文中提出一种基于文件、进程(线程)和网络三要素相结合的APT网络信息窃取行为检测模型,为加强对检测结果的自动化判断,作者引入神经网络中的自适应谐振检验方法,实验表明,模型可以对APT木马的信息窃取行为进行有效检测。APT（Advanced Persistent Threat）is the most serious threat to national and corporation. Generally, it is controlled by a meticulously designed organization and hardlydetected. It has advanced,persistent and high strategy characteristics.This paper presents a method for APT information theft behavior detection basedon file process and network factor analysis. To identify the dangerous behaviors automatically, a dynamic learning and classification method according to the characteristics of the model based on adaptive resonance theory is proposed. Experiments indicate that the model based on this method can detect APT information stolen behavior effectively.

关 键 词：APT 信息窃取 网络木马 文件 进程 网络 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]