面向APT攻击的分层表示模型  

Hierarchical Representation Model for APT Attack

作　　者：樊雷[1] 余江明[1] 雷英杰[1] FAN Lei,YU Jiangming,LEI Yingjie(Air Force Engineering University, Xi＇an 710051, Chin)

机构地区：[1]空军工程大学,西安710051

出　　处：《计算机工程》2018年第8期155-160,共6页Computer Engineering

基　　金：国家自然科学基金(61272011;61309022);陕西省自然科学青年基金(2013JQ8031)

摘　　要：针对窃密型APT攻击缺乏形式化表示的问题,建立一种窃密型APT攻击分层表示模型APT-HRM。参考HARM模型将APT攻击分为攻击链和攻击树上下2层,并对其进行形式化定义。攻击链由侦察、渗透、开采和撤出4个阶段组成,攻击树由攻击链各阶段所对应的攻击手段组成,APT按照攻击链分阶段依次进行攻击。对DUQU 2.0 APT攻击的分析结果表明,该模型能够有效描述窃密型APT攻击行为。In viewof the lack of formal representation of the theft type APT attack,a hierarchical APT representation model is built which named APT-HRM. Referring to the HARM model,the APT attacks are divided into two layers：Attack Chain（ AC） and Attack Tree（ AT）. The AC is composed of 4 stages：reconnaissance,infiltration,exploitation and exfiltration. The AT is composed of attack means in each stage of the AC,and the APT attacks are carried out in stages according to the AC. Analysis results of DUQU 2.0 APT attack show that,the model can effectively describe the APT attack behavior.

关 键 词：APT攻击 攻击链 攻击树 分层表示模型 DUQU 2.0攻击分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]