高级持续性威胁(APT)攻击检测与防御的深度学习方法研究  

Research on Deep Learning Methods for Advanced Persistent Threat(APT)Attack Detection and Defense

作　　者：庞九凤 张亚昊 胡威 王临风 尹红珊 刘春晓 Pang Jiufeng;Zhang Yahao;Hu Wei;Wang Linfeng;Yin Hongshan;Liu Chunxiao(Information and Communication Branch,The State Grid Co.,Ltd.,Beijing 100761,China)

机构地区：[1]国家电网有限公司信息通信分公司,北京100761

出　　处：《办公自动化》2024年第14期73-76,共4页Office Informatization

摘　　要：本研究旨在从企业应用的角度探索高级持续性威胁(APT)对国家电网等关键基础设施的威胁,并引入深度学习技术以建立更为全面的检测与防御机制。在协同防御策略的构建中,特别关注邮件安全与电网企业的关联。通过加强邮件安全措施,提出一种有效的防范措施,降低电网企业受APT攻击的概率。最后,通过算例模拟数据的分析,验证基于深度学习的检测方法和协同防御策略的有效性。这一检测机制为电网企业提供强大的网络安全保护,减缓APT攻击对企业的威胁。This paper aims to explore the threat of advanced persistent threat(APT)to critical infrastructure such as national power grid from the perspective of enterprise application,and introduce deep learning technology to establish a more comprehensive detection and defense mechanism.In the construction of collaborative defense strategy,we pay special attention to the relationship between email security and power grid enterprises.By strengthening email security measures,we propose an effective preventive measure to reduce the probability of power grid enterprises being attacked by APT.Finally,through the analysis of the simulation case data,we verify the effectiveness of the detection method and the cooperative defense strategy based on deep learning.This detection mechanism provides powerful network security protection for power grid enterprises,and slows down the threat of APT attacks on enterprises.

关 键 词：高级持续性威协(APT) 攻击检测 防御机制 深度学习 

分 类 号：TP18[自动化与计算机技术—控制理论与控制工程] TP393.08[自动化与计算机技术—控制科学与工程]