| In recent years,Advanced Persistent Threat(APT)events have occurred frequently.At present,most intrusion detection systems are only responsible for detecting a certain step in the APT attack chain.APT detection should cover the entire attack chain and also explore the connections between single step attack events.Therefore,this article designs a detection model based on multiple stages in APT attacks,and correlates the detection intelligence of each stage to reconstruct the APT attack scenario.This work includes three parts:1.Research the key detection phases and detection points in the life cycle of APT attack.This article divides the detection objects on the network side into protocol flow and domain name,and detect the attack behavior in the reconnaissance phase,the initial attack phase,the lateral movement phase and the action phase from the flow characteristics,and detect the Command-and-Control server access behavior in the initial attack phase and the command-and-control phase from the malicious domain name of generation algorithm.Use machine learning to perform fine-grained detection at relevant stages,and introduce external opensource threat intelligence as a blacklist to accurately match specific targets in traffic to form local stage detection intelligence.2.Research the fusion correlation model of alarms.This article uses MAC addresses for long-history alarms correlation of internal network hosts,uses network alarm interaction graph for scenario reconstruction,combines network-side alarms and host-side logs to discover hidden lateral movement,and proposes an attack chain extraction method based on tags for merging attack chains and splitting overlapping attack chains.3.Based on the distributed micro-service architecture,an APT attack detection system based on multi-stage intelligence correlation is designed and implemented.The system decoupling of capture,storage,analysis,detection and correlation modules is realized in the way of micro-service,achieving the goals of fully utilizing single machine performance,adjustable collection and analysis capabilities,preserving historical data,and facilitating maintenance and updates.Finally,a functional test was conducted on the system implemented in this article. |
