基于树型结构的APT攻击预测方法  

Method for APT Prediction Based on Tree Structure

作　　者：张小松[1] 牛伟纳[1] 杨国武[2] 卓中流 吕凤毛 

机构地区：[1]电子科技大学网络空间安全研究中心,成都611731 [2]电子科技大学大数据研究中心,成都611731

出　　处：《电子科技大学学报》2016年第4期582-588,共7页Journal of University of Electronic Science and Technology of China

基　　金：国家自然科学基金项目(61572115;61402080);中国博士后科学基金(2014M562307);四川省重大基础研究课题(2016JY0007)

摘　　要：近年来,高级持续性威胁已成为威胁网络安全的重要因素之一。然而APT攻击手段复杂多变,且具有极强的隐蔽能力,使得目前常用的基于特征匹配的边界防护技术显得力不从心。面对APT攻击检测防御难题,提出了一种基于树型结构的APT攻击预测方法。首先结合杀伤链模型构建原理,分析APT攻击阶段性特征,针对攻击目标构建窃密型APT攻击模型;然后,对海量日志记录进行关联分析形成攻击上下文,通过引入可信度和DS证据组合规则确定攻击事件,计算所有可能的攻击路径。实验结果表明,利用该方法设计的预测模型能够有效地对攻击目标进行预警,具有较好的扩展性和实用性。In recent years, advanced persistent threat （APT） has become one of the most important factors threatening cyber security. However, due to the complicated attacking method and strong conceal ability of APT, it is very hard to predict APT using the common boundary protection technique based on feature matching. To solve the problem of APT attack detection and defense, we propose an APT attacks prediction method based on tree structure. An APT exfiltration model of an attack target combing the kill chain model with stage characteristics is first constructed. And then the correlation analysis of massive logs is conducted to formulate attack events context, and the credibility ratio and DS evidence theory are introduced to determine true attack events. Finally, all possible attack paths are calculated. Experimental results show that our proposed method can predict APT attacks, and it can obtain good scalability and practicability.

关 键 词：高级持续性威胁 攻击预测 关联分析 杀伤链 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]