APT攻击分层表示模型

发布时间：2018-05-11 19:30

本文选题：高级可持续性威胁 + 攻击链　；参考：《计算机应用》2017年09期

【摘要】：针对攻击链模型攻击阶段划分过细且无法表示攻击手段的问题,提出了一种高级可持续性威胁(APT)攻击分层表示模型(APT-HARM)。通过总结分析大量公开的APT事件报告和参考APT攻击链模型与分层攻击表示模型(HARM),将APT攻击分为攻击链和攻击树上下两层,并将其形式化定义。首先,将APT攻击分为由侦察、渗透、行动和撤出四个阶段组成的攻击链,并研究了各阶段特点;然后,研究各阶段中采取的攻击手段,并依据其逻辑关系组成攻击树。APT攻击按照攻击链分阶段依次进行,各阶段按照攻击树流程依次执行。案例分析表明,本模型相较攻击链模型具有粒度划分合理、攻击描述完备准确的优点。APT-HARM形式化地定义了APT攻击,为APT攻击的预测和防范提供了一种思路。
[Abstract]:Aiming at the problem that the attack stage of the attack chain model is too detailed to represent the attack means, an advanced sustainable threat (APT) attack hierarchical representation model (APT-HARMN) is proposed. By summing up and analyzing a large number of published APT event reports and reference APT attack chain models and hierarchical attack representation models, the APT attacks are divided into two layers: attack chain and attack tree, and their formal definition is given. Firstly, the APT attack is divided into four stages: reconnaissance, infiltration, operation and withdrawal, and the characteristics of each stage are studied. According to its logical relation, the attack tree. Apt attack is carried out in stages according to the attack chain, and each stage is executed in turn according to the attack tree flow. The case analysis shows that the model has reasonable granularity partition compared with the attack chain model, and the advantage of complete and accurate description of attack. APT-Harm formally defines APT attack, which provides a way to predict and prevent APT attacks.
【作者单位】：空军工程大学信息与导航学院;
【基金】：国家自然科学基金资助项目(61402510) 陕西省工业科技攻关项目(2016GY-087)~~
【分类号】：TP393.08

【相似文献】