基于ATT&CK的ARP攻击语义构建  

Construction of ARP attack semantics based on ATT&CK

作　　者：周婧莹 曾楚轩[1] 黎宇[1] Zhou Jingying;Zeng Chuxuan;Li Yu(China Joint Network Communications Co.,Ltd.,Guangdong Branch,Guangzhou 510627,China)

机构地区：[1]中国联合网络通信有限公司广东省分公司,广东广州510627

出　　处：《无线互联科技》2022年第7期130-131,共2页Wireless Internet Technology

摘　　要：ATT&CK是对TTP的一种标准化表达,包括战术目的、技术手段以及攻击过程中技术手段的选择。ATT&CK技术矩阵的形成对提升防御者的防御能力、增强攻击者的供给成本有重要意义。文章分析基于ATT&CK的ARP攻击检测,以提升威胁情报自动分析效率为目的,打造出基于ATT&CK的ARP攻击的语义规则,旨在能够有效保障系统运行安全。ATT&CK is a standardized expression of TTP,including tactical purposes,technical means and technical means during the attack.The formation of ATT&CK technology matrix plays a very important role in improving the defense ability of the defender and enhancing the supply cost of attacker.This paper analyzes the ARP attack detection based on ATT&CK,in order to improve the efficiency of automatic threat intelligence analysis,and creates the semantic rules of ARP attack based on ATT&CK,aiming to effectively ensure the operation safety of system.

关 键 词：ATT&CK ARP攻击 语义构建 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]