靶向性复杂攻击网络建模和行为分析研究

The research on the detection of APT (Advanced Persistent Threat) attack has become a hot topic and a widely-acknowledged problem in industry due to features like lasting attack cycle, various and covert means, as well as customized attack patterns etc. In this project, we propose a Targeted Complex Attack Network (TCAN) model. This project plans to reveal the general rules of mainstream APT attacks through the research of the characteristics of the network structure and behavior patterns of the proposed network. The research mainly includes: 1) Using the acyclic directed graph which is advantageous in cumulating to conduct the research on TCAN modeling, to illuminate the mechanism of detour attack, immunization group as well as failed node percolation problems etc. in real APT attack scenarios. 2) Studying the unidirectional mappings in TCAN by means of the APT pyramid attack model, and revealing the TCAN process pattern through the improved analysis method for disease propagation. This research project establishes the foundation of the detection and defense for current advanced attacks, multiple attacks, joint attacks and customized APT.

APT攻击具有持续周期长、方法隐蔽多样、攻击手段定制等特点，其检测技术的研究已成为业界关注的热点和公认的难题。本项目提出一种靶向性复杂攻击网络（TCAN）模型，通过研究该类型网络的结构特点和行为模式，揭示主流APT攻击过程的普遍规律。研究内容主要包括：一、采用具有累积优势的非循环有向图进行TCAN建模研究，阐明实际APT攻击中，迂回攻击、免疫群、失效节点渗流等问题的机制；二、利用APT金字塔攻击模型进行TCAN中节点单向映射研究，采用改进的疾病传播分析方法，揭示TCAN网络过程规律。本项目的研究为解决当前高级攻击、多重攻击、联合攻击以及定制化APT的检测防御难题奠定了基础。

APT攻击具有持续周期长、方法隐蔽多样、攻击手段定制等特点，其检测技术的研究已成为业界关注的热点和公认的难题。本项目首先针对APT攻击检测中存在的技术瓶颈和检测难点，通过对网络设备日志进行深度分析、APT攻击中常使用的僵尸网络进行建模以及对硬件木马进行检测，实现了于全网流量和日志深度分析的APT检测与建模，更进一步防御APT攻击；之后，研究靶向性复杂攻击网络的行为及域关联分析，提出了基于关联规则挖掘的复杂性网络攻击及行为关联方法与基于攻击树中关键路径分析方法和基于金字塔的展开模型；最后，面对APT攻击检测防御难题，提出了基于树型结构的APT攻击预测方法。综上所述，本项目既有充分的理论意义，也有丰富的实践价值。