鱼叉式网络钓鱼攻击检测方法  

Method of spearphishing attack detection

作　　者：池亚平[1,2] 凌志婷 许萍 杨建喜[1] CHI Ya-ping;LING Zhi-ting;XU Ping;YANG Jian-xi(Department of Communication Engineering,Beijing Electronic Science and Technology Institute,Beijing 100070,China;Key Laboratory of Network Assessment Technology,Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China)

机构地区：[1]北京电子科技学院通信工程系,北京100070 [2]中国科学院信息工程研究所中科院网络测评技术重点实验室,北京100093

出　　处：《计算机工程与设计》2018年第11期3350-3355,共6页Computer Engineering and Design

基　　金：国家发改委信息安全专项基金项目(发改办高技[2015]289号);国家863高技术研究发展计划基金项目(2015AA017202)

摘　　要：对研究人员在第26届USENIX安全会议上提出的检测有凭证的鱼叉式网络钓鱼攻击的方法展开研究,在研究鱼叉式网络钓鱼攻击的流程及原理、分析应用该检测方法的黑箱粉碎机的总体结构、关键技术及应用情况的研究基础上,对定向异常评分技术进行分析,进一步详细定义子探测器对标量的选取,对网络钓鱼攻击黑箱粉碎机的方法与网络钓鱼攻击的传统检测方法进行对比分析,论述黑箱粉碎机明显的优势,展望鱼叉式网络钓鱼攻击检测方面今后的发展与研究方向。The approach of detecting credential spearphishing attacks in enterprise settings that was put forward in the conference of the 26th USENIX security symposium by researchers was studied.Based on the analyzations including the processes and the principles of spearphishing attack,the overall structure of the detector,the key technologies,and the application situations in the enterprise environment,the directed anomaly scoring technology was analyzed.The selections of scalar in sub detectors were defined,the spearphishing attack detection method of detector and the methods of traditional detection were compared and analyzed.The obvious advantages of detector were discussed.The prospection of the spearphishing attack detection development and the direction of research in the future were also given.

关 键 词：鱼叉式 网络钓鱼 检测 凭证 定向异常评分技术 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]