基于系统溯源图的威胁发现与取证分析综述  

Review of threat discovery and forensic analysis based on system provenance graph

作　　者：冷涛 蔡利君[1] 于爱民 朱子元[1,2] 马建刚 李超飞 牛瑞丞[1,2] 孟丹 LENG Tao;CAI Lijun;YU Aimin;ZHU Ziyuan;MA Jian’gang;LI Chaofei;NIU Ruicheng;MENG Dan(Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China;School of Cyber Security,University of Chinese Academy of Sciences,Beijing 100049,China;Intelligent Policing Key Laboratory of Sichuan Province,Sichuan Police College,Luzhou 646000,China)

机构地区：[1]中国科学院信息工程研究所,北京100093 [2]中国科学院大学网络空间安全学院,北京100049 [3]四川警察学院智能警务四川省重点实验室,四川泸州646000

出　　处：《通信学报》2022年第7期172-188,共17页Journal on Communications

基　　金：中科院战略性先导科技专项基金资助项目(No.XDC02040200);智能警务四川省重点实验室资助项目(No.ZNJW2022ZZQN002)。

摘　　要：通过调研溯源图研究相关的文献,提出了基于系统溯源图的网络威胁发现和取证分析研究框架。详细综述了基于溯源图的数据采集、数据管理、数据查询和可视化方法;提出了基于规则、基于异常和基于学习的威胁检测分类方法;概括了基于威胁情报或基于战略、技术、过程驱动的威胁狩猎方法;总结了基于因果关系、序列学习、特殊领域语言查询和语义重建的取证分析方法;最后指出了未来的研究趋势。By investigating works of literature related to provenance graph research,a research framework for network threat discovery and forensic analysis based on system-level provenance graph was proposed.A detailed overview of data collection,data management,data query,and visualization methods based on provenance graphs was provided.The rule-based,anomaly-based,and learning-based threat detection classification methods were proposed.Threats based on threat intelligence or based on strategy,technology,and process-driven threats hunting methods were summarized.Foren-sic analysis methods based on causality,sequence learning,language query and semantic reconstruction in special fields were summarized.Finally,the future research trends were pointed out.

关 键 词：溯源图 高级持续性威胁 威胁发现 取证分析 图神经网络 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]