全流量回溯结合APT建模分析技术  

Full packet capture and retrospective forensics combined with APT modeling and analysis technology

作　　者：姚星昆 郑先伟[2] YAO Xingkun;ZHENG Xianwei(Information Technology Center,Tsinghua University,Beijing 100084,China;Institute of Network Science and Cyberspace,Tsinghua University,Beijing 100084,China)

机构地区：[1]清华大学信息化技术中心,北京100084 [2]清华大学网络科学与网络空间研究院,北京100084

出　　处：《福州大学学报（自然科学版）》2023年第5期639-646,共8页Journal of Fuzhou University(Natural Science Edition)

基　　金：国家自然科学基金资助项目(62372259)。

摘　　要：研究海量网络数据包存储及快速检索技术,并结合高级持续性威胁(APT)组织攻击链特征,提出一种全流量回溯与APT建模分析技术方案,实现APT精准识别.系统通过网络流量聚合成大块文件,实现磁盘的顺序写入及文件系统的零碎片,提升数据包写入速度;通过两级索引,提升数据包检索速度.结合APT组织的TTP模型,对原始流量快速提取反分析,实现APT攻击的精准识别、回溯分析和攻击链还原.Research on massive network data packets storage and quick search technology,combined with APT organization kill chains feature modeling technology,to achieve accurate identification of APT attacks.The data packet writing speed is improved through the technology of writing large blocks of data to disk,sequential writing,and timeline recovery;the two-level distributed indexing technology improves the network data packets searching speed;and the session aggregation technology improves the network data packets reading speed.Combined with the TTP model of APT organization,it quickly extracts and reverse analysis the original traffic,achieving precise identification,retrospective analysis,and attack chain restoration of APT attacks.

关 键 词：全包捕获 伴随索引 回溯分析 攻击链 高级持续性威胁 

分 类 号：TP393.2[自动化与计算机技术—计算机应用技术]