基于ATT&CK的多源数据深度安全检测技术研究  

Research on deep security detection technology of multi-source data based on ATT&CK

作　　者：贵重 GUI Zhong(China Mobile Information Security Center,Beijing 100053,China)

机构地区：[1]中国移动通信集团公司信息安全管理与运行中心,北京100053

出　　处：《电信工程技术与标准化》2020年第10期81-86,共6页Telecom Engineering Technics and Standardization

摘　　要：APT攻击检测已成为落实《中华人民共和国网络安全法》要求的重要内容。本文基于攻击战术和攻击技术统一描述的ATT&CK模型,提出一种多源数据深度安全监测模型。该模型可以在APT攻击的早期阶段,实现攻击全貌的分析和呈现。实践案例验证本文提出的模型能够有效提升安全防御和响应能力。The detection of APT attack has become an important content of implementing the requirements of network security law.Based on the ATT&CK model,which describes attack tactics and attack techniques,this paper proposes a deep security monitoring model for multi-source data.This model can analyze and present the whole picture of APT attack in the early stage.The current network practice case verifies that the model proposed in this paper can effectively improve the ability of security defense and response.

关 键 词：APT攻击 ATT&CK模型 多源数据融合 深度安全检测 

分 类 号：TN918[电子电信—通信与信息系统]