信息网络安全

信息网络安全 ›› 2023, Vol. 23 ›› Issue (12): 59-68.doi: 10.3969/j.issn.1671-1122.2023.12.007

• 技术研究 • 上一篇    下一篇

一种基于攻击图的高级持续威胁检测方法

高庆官1,2, 张博3, 付安民3()   

  1. 1.东南大学计算机科学与工程学院，南京 211189
    2.南京赛宁信息技术有限公司，南京 211100
    3.南京理工大学计算机科学与工程学院，南京 210094
  • 收稿日期:2023-02-17 出版日期:2023-12-10 发布日期:2023-12-13
  • 通讯作者: 付安民 E-mail:fuam@njust.edu.cn
  • 作者简介:高庆官（1979—），男，江苏，工程师，博士研究生，主要研究方向为基于私有云的大规模网络仿真、大规模3D态势可视化和主动防御|张博（1997—），女，吉林，博士研究生，主要研究方向为威胁检测|付安民（1981—），男，湖北，教授，博士，CCF会员，主要研究方向为工业互联网安全、智能系统和软件安全
  • 基金资助:
    国家自然科学基金(62072239);江苏省自然科学基金(BK20211192);江苏省未来网络科研基金(FNSRFP-2021-ZD-05)

An Advanced Persistent Threat Detection Method Based on Attack Graph

GAO Qingguan1,2, ZHANG Bo3, FU Anmin3()   

  1. 1. School of Computer Science and Engineering, Southeast University, Nanjing 211189, China
    2. Nanjing Saining Information Technology Co., Ltd., Nanjing 211100, China
    3. School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing 210094, China
  • Received:2023-02-17 Online:2023-12-10 Published:2023-12-13

RichHTML

33

PDF (PC)

105

摘要：

针对传统入侵检测工具无法检测高级持续威胁（Advanced Persistent Threat，APT）攻击和威胁警报疲劳问题，文章提出一种基于攻击图的APT检测方法ADBAG（APT Detection Based on Attack Graph），该方法根据网络拓扑、漏洞报告等信息生成攻击图，并利用攻击图对攻击者行为进行预先分析，有效解决了威胁警报疲劳问题。文章结合ATT&CK（Adversarial Tactics，Techniques and Common Knowledge）模型和APT攻击三相检测模型，设计了一种缺失路径匹配评分算法，从攻击全局角度分析和检测APT攻击。同时，设计了基于灰名单的多攻击实体关联方法，以保证生成的APT攻击证据链的准确性。在公开数据集上进行实验，实验结果表明，ADBAG可以有效检测APT攻击，并能够检测基于零日漏洞的APT攻击，进一步定位攻击影响范围。

关键词: 入侵检测, 威胁检测, APT攻击, 攻击图

Abstract:

Aiming at the problem that traditional intrusion detection tools can’t detect advanced persistent threat (APT) attacks and threat alert fatigue, this paper proposed an advanced persistent threat detection method based on attack graph, which generated attack graph according to network topology, vulnerability report and other information to analyze the attacker’s behavior in advance, which effectively combated the threat alert fatigue problem. Combining adversarial tactics, techniques and common knowledge (ATT&CK) model and APT attack three-phase detection model, a scoring algorithm for missing path matching was designed to analyze and detect APT attacks from the global perspective. At the same time, a multi-attack entity association method based on grey list was designed to ensure the accuracy of the generated APT attack evidence chain. In this paper, experiments were carried out on public data sets, and the results show that ADBAG can effectively detect APT attacks and APT attacks that exploit zero-day vulnerabilities, and further locate the scope of attacks.

Key words: intrusion detection, threat detection, APT attack, attack graph

中图分类号: