APT攻击与防御  

APT attacks and defenses

作　　者：张瑜[1] 潘小明[2] LIU Qingzhong 曹均阔[1] 罗自强[1] 

机构地区：[1]海南师范大学信息学院 [2]浙江省电子信息产品检验所信息安全重点实验室 [3]萨姆休斯顿州立大学计算机系

出　　处：《清华大学学报（自然科学版）》2017年第11期1127-1133,共7页Journal of Tsinghua University(Science and Technology)

基　　金：国家自然科学基金面上项目(61462025;61262077;61363032;61463012);海南省重点研发计划项目(ZDFY2016013)

摘　　要：高级持续性威胁(advanced persistent threat,APT)逐渐演化为各种社会工程学攻击与零日漏洞利用的综合体,已成为最严重的网络空间安全威胁之一。APT以攻击基础设施、窃取敏感情报为目的,且具有强烈的国家战略意图,从而使网络安全威胁由散兵游勇式的随机攻击演化为有目的、有组织、有预谋的群体式定向攻击。近年来,APT攻击与防御已受到网络空间安全社区的持续关注,获得了长足发展与广泛应用。该文首先回顾了APT起源与发展演化过程;其次讨论了APT攻击机理与生命周期;然后探讨了APT防御体系与检测方法,归纳总结目前APT检测防御的最新技术;最后讨论了APT攻击发展趋势、APT防御存在的问题和进一步研究方向。Advanced persistent threats （APT） have gradually evolved into a complex of social engineering attacks and zero-day exploits as some of the most serious cyberspace security threats. APT attacks often attack infrastructure and steal sensitive information with strong national strategic interests, so that cyherspace security threats evolve from random attacks to purposeful, organized, premeditated attacks. In recent years, APT attacks and defenses have rapidly developed in the cyberspace security community. The origin and development of APTs are reviewed here with analyses of the mechanism and life cycle of APTs. Then, APT defenses and detection methods are described with problems and further research directions identified.

关 键 词：高级持续性威胁 威胁情报 攻击检测 网络空间安全 社会工程学 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]