APT攻击与检测研究  

Research on APT Attack and Detection

作　　者：刘畅[1] LIU Chang

机构地区：[1]中国人民解放军31152部队,南京210000

出　　处：《科技创新与应用》2024年第21期8-11,共4页Technology Innovation and Application

摘　　要：随着网络在社会的应用越来越广泛和深入,信息安全的重要性也得到越来越多的关注,高级持续性威胁(Advanced Persistent Threat,APT)已成为高等级网络安全威胁的主要组成部分,其相对传统安全威胁具有隐蔽性强、时间跨度久、针对性强等特点,对传统安全防御体系造成严重威胁。该文介绍历史上一些典型的APT攻击案例,梳理APT的攻击特点和典型流程,最后探讨现有的对抗APT比较有效的检测方法。As the application of the Internet in society becomes more extensive and profound,the importance of information security has also received increasing attention.Advanced Persistent Threat(APT) has become a major component of high-level cybersecurity threats,which is characterized by strong concealment,long time span,and strong pertinence compared to traditional security threats,thus posing a serious threat to traditional security defense systems.This paper introduces some typical APT attack cases in history,summarizes the attack characteristics and typical processes,and finally reviews the existing effective detection methods against APT.

关 键 词：高级持续性威胁 社会工程学 恶意邮件 零日漏洞 攻击检测 

分 类 号：TP39[自动化与计算机技术—计算机应用技术]