时间变换技术在APT流量检测中的应用

106 浏览量更新于2024-08-26 收藏 195KB PDF 举报

"基于时间变换的APT流量检测技术用于识别高级持续威胁(Advanced Persistent Threat, APT)攻击。该方法利用时间变换特征来区分正常网络流量与含有恶意载荷的流量，以此检测APT攻击。" 在当前网络安全环境中，APT攻击是一种极具威胁的新型攻击方式。攻击者通过钓鱼邮件、恶意软件、社会工程学以及僵尸网络等手段，构建一系列复杂的攻击链，使得APT攻击难以被传统防御机制检测到。这种攻击方式允许攻击者远程控制受感染主机或窃取敏感信息，对个人和组织的信息安全构成严重威胁。本文提出了一种基于时间变换特征的方法来检测APT流量。关键在于，APT攻击过程中，恶意载荷必须传递到目标主机。研究人员观察到这个关键行为，并设计了一种策略，通过比较正常网络流量和包含恶意载荷的流量之间的差异，来捕获恶意载荷的信号。这一步骤对于识别APT攻击至关重要，因为它可以帮助我们从海量数据中筛选出异常活动。接下来，作者应用了机器学习算法来处理大数据中的APT攻击检测问题。机器学习模型可以训练成能从复杂流量模式中学习并识别潜在的APT攻击模式。这种方法的优势在于，它能够随着时间的推移不断适应和改进，以应对不断变化的攻击策略。为了验证所提出方法的有效性，论文中可能进行了实验分析，包括数据集的选择、特征工程的实施、不同机器学习模型的比较以及性能指标（如准确性、召回率和F1分数）的评估。这些实验结果通常会展示基于时间变换的APT流量检测方法在实际场景中的表现，证明其在提高APT攻击检测能力方面的潜力。此外，论文可能还讨论了面临的挑战，比如如何处理大数据的实时性问题、如何处理未见过的攻击模式、以及如何降低误报和漏报率。同时，未来的研究方向可能包括优化现有方法、开发新的特征提取技术，以及探索深度学习等更先进的模型来进一步提升APT检测效率和精度。总结来说，这篇研究论文探讨了使用时间变换特征进行APT流量检测的新方法，结合机器学习技术，提高了APT攻击的发现能力，对于网络安全领域具有重要的理论和实践意义。通过深入研究和改进这种方法，我们可以更好地防御APT攻击，保护网络环境的安全。

APT Traffic Detection Based on time transform

Jiazhong Lu

, Xiaosong Zhang

, Wang Junfeng

, Ying Lingyun

Center for Cyber Security, University of Electronic Science and Technology of China, Chengdu 611731;

Sichuan University, Chengdu 610041;

Institute of Software Chinese Academy of Sciences, Beijing 100080

E-mail:ljz198874@hotmail.com

Abstract: APT(Advanced persist threat) is an emerging

attack on the Internet. Attackers may combine phishing

emails, malware, social engineering and botnets to create

a series of attacks in one APT attack which makes it quite

difficult for detection. In this way, attackers can remotely

control the infected host, or steal sensitive information. In

this paper, we proposed a time transform features

approach for distinguishing APT attacks based on the

observation that malicious payload must be transferred to

the target hosts in an APT attack. By comparing the

normal traffic with the traffic containing a malicious

payload, we are able to catch the signal of malicious

payload and further infer the existence of APT attacks.

Then we use machine learning methods to detect APT

attacks in big data. To verify this approach, we placed a

device on the gateway of our university for catching the

real Internet traffic of the university for one month. Then

we mixed the APT traffic with these flows, and see

whether our approach can identify the malicious payloads.

We found our approach is not only accurate but also

efficient for catching APT attacks.

Keywords: APT, time transform, detection

1 INTRODUCTION

APT attacks are performed by attackers who have

acquired advanced expertise and enough resources to

establish and transfer information in a targeted

organization through a variety of avenues (such as social

engineering, physical device attacks, phishing, botnets,

etc.). Ultimately, they could steal sensitive information,

undermine the mission of critical systems, or lurk in the

internal network for continuous monitoring of the network

[1].

Apt attackers will use all-around, highly-hidden

network intrusion technology. Usually, in order to use a

variety of attack methods and undisclosed vulnerabilities,

the attacker needs to develop more advanced attack tools

in order to achieve the default target. He develops a clear

strategy, and constantly tries most kinds of attacks, and

hide in the network for long terms for penetrating the

network. This time could be very long, even for several

years. The attacker continues to break through and

controls high-value targets within the network until he is

able to mine sensitive information or destroy key facilities

or wait until a certain special chance. It turns out that this

"low-intensity, long-cycle" attack is highly concealable to

be noticed by defenders. Also, the results of the attack

could also be severe enough such as Duqu attack [19].

From previously studies [20, 21], the attacker is usually

found to be a well-organized and well-funded team. This

is a threat under the guidance of a specific target, rather

than simply breaking the network through malicious

programs on the random targets. In the end, these

purposeful, organized, premeditated APT attacks often

mixed with normal Internet traffic, which makes the

features of the APT traffics are very unnoticeable while

compared to normal traffics, evading the detection of

current anti-virus software.

In our work, we focus on time transform research.

We found that the traffics sent from APT payloads are

similar to those sent from a botnet, the attacker sends

control commands that are periodic[2]. When the APT

payloads communicate with the C&C servers, the

commands for control are sent with a fixed time interval

which has a strong correlation with the type of malicious

payload. In our research, we collected features such as

time transform features (e.g., uplink and downlink packet

transmission time, the average downlink transmission

time interval, the duration of the flow, etc.). Then we

utilized machine learning GBDT methods for

classification in the flow. To validate the results of

classification, we did 10-fold cross validation of APT

traffic by training 90 percent of the APT malware traffic,

we use 10% of the traffic for testing. Our results show that

our approach can achieve 3.6% false positive rate and 3.07%

false negative rate, which is lower that Zhao`s approaches

[7].

2 RELATED WORK

Wang et al. [4] paid attention to the preliminary

phase of APT, that is, in the C&C server phase, and

investigated C&C communication. They found that access

to the C&C domain was often independent and the

legitimate domain was accessed, which effectively

distinguished the C&C domain from the legal domain. To

take advantage of this feature, they introduced a new

concept, the concurrency domain in Domain Name

Service (DNS) records, represented by CODD to measure

the correlation between domains. Based on this feature, a

1×3 vector is used to represent the relationship between

the internal host and the external domain, and the C&C is

detected using a classification algorithm. And validated

on a public dataset provided by the Los Alamos National

Laboratory.

In [4], Friedberg et al. proposed a further anomaly

detection method, which compared with other common

methods, their system uses the whitelist method, only

consider the operation of the well-known attack pattern

and malware trace signature and behavior. The author also

2016 International Conference on Intelligent Transportation, Big Data & Smart City

DOI 10.1109/ICITBS.2016.87

2016 International Conference on Intelligent Transportation, Big Data & Smart City

DOI 10.1109/ICITBS.2016.87

下载后可阅读完整内容，剩余4页未读，立即下载

weixin_38655309

粉丝: 5
资源: 904

时间变换技术在APT流量检测中的应用

基于同源行为分析的高效APT异常检测策略

华中科技大学2023年毕业设计：溯源图APT攻击检测优化

UNICORN：基于运行时溯源的APT攻击检测器

应对APT攻击的最新技术.docx

异常检测新境界：基于CNN在网络安全与欺诈预防的应用探索

溯源图资源汇总：APT攻击检测与入侵检测论文及PPT

精细金属掩模板(FMM)行业研究报告 显示技术核心部件FMM材料产业分析与市场应用

【创新未发表】斑马算法ZOA-Kmean-Transformer-LSTM负荷预测Matlab源码 9515期.zip

j link 修复问题套件

C#实现modbusRTU(实现了01 3 05 06 16等5个功能码)

最新资源

精细金属掩模板(FMM)行业研究报告显示技术核心部件FMM材料产业分析与市场应用