动态隔离与恢复策略对抗高级持续威胁：优化方法与影响评估

需积分: 5 61 浏览量更新于2024-07-10 收藏 2.08MB PDF 举报

本文是一篇针对高级持续性威胁（Advanced Persistent Threat, APT）的防御策略——有效隔离与恢复方案的研究论文，发表在《IEEE Transactions on Systems, Man, and Cybernetics: Systems》上。作者Lu-Xing Yang、Pengdeng Li、Xiaofan Yang、Yong Xiang、Frank Jiang和Wanlei Zhou作为IEEE成员，共同探讨了在现代组织中应对APT所带来的巨大风险时，如何设计出动态的隔离与恢复（Quarantine and Recovery, QAR）系统，以最小化APT的影响。文章的核心内容基于一种新颖的节点级别流行病模型，该模型能够量化隔离和恢复策略对网络预期状态的影响。通过这个模型，作者们分析了在实施QAR方案后，APT可能产生的预期影响。他们将原问题转化为一个优化控制问题，目标是寻找最有效的策略来控制和减少APT的传播及破坏。具体来说，论文首先定义了隔离和恢复过程中的关键变量和参数，如感染节点的传播速度、恢复时间以及组织内部网络的结构等。接着，他们利用动态系统理论，构建了一个数学模型，通过求解优化问题，确定在给定资源限制下，如何设置隔离策略和恢复步骤，以最大程度地减小APT的潜在损害。在解决这一优化问题时，论文可能探讨了不同的策略，如基于阈值的隔离、逐层隔离、协同防御等，并通过仿真或实证分析来评估它们的效果。此外，还可能讨论了在实际应用中如何实时监测和适应APT的变种，以及如何处理在隔离过程中可能出现的信息丢失或误报等问题。这篇论文提供了一种理论框架和方法，帮助组织制定灵活且高效的QAR策略，以对抗高级持续性威胁，确保网络的安全性和业务连续性。它不仅为网络安全研究人员提供了新的视角，也为实际操作者提供了实用的指导，对于提高组织抵御APT的能力具有重要的实践价值。

This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.

YANG et al.: EFFECTIVE QAR SCHEME AGAINST APT 3

B. Game-Theoretic Approach

Game theory has extensive applications in the cybersecurity

domain [17]. The game-theoretic approach to APT defense

dates to the seminal work by van Dijk et al. [18]. In this arti-

cle, protecting a system from APT is reduced to what is called

the timing game, in which the defender chooses proper time

points of investing defense resources to minimize the APT

impact at a lower cost. Later, the timing game was adapted to

a variety of realistic situations [19], [20]. In recent years, the

timing game has been successfully applied to the protection

of cloud storage systems against APT [21]–[23]. On the other

hand, Hu et al. [24] investigated an APT response problem

through the game-theoretic approach. In this article, based on

a differential equation governing the evolution of the com-

promise fraction of the system, the attacker’s beneﬁt, as well

as the APT impact are estimated. On this basis, the original

problem boils down to a continuous-kernel game under the

Nash equilibrium solution concept, which is solved analyti-

cally and numerically. In all of the above work, the impact of

lateral movement is neglected at all.

Protecting interdependent systems from APT is of practi-

cal importance. Inspired by [24] and [25] handled an APT

response problem for interdependent systems in the frame-

work of game theory. In this article, based on a node-level

epidemic model capturing the effect of the response scheme on

the network’s expected state, the attacker’s expected beneﬁt, as

well as the expected APT impact are estimated. On this basis,

the original problem is modeled as a continuous-kernel game

problem under the Nash equilibrium solution concept, which

is solved with a heuristic algorithm. Later, Yang et al. [26]

extended this article to the situation where the attack scheme

and the defense scheme are both varying over time, leading

to a differential game-theoretic model. In the two papers, the

impact of lateral movement is taken into full account.

The game-theoretic modeling of an APT defense problem

builds on the assumption that the defender knows the statisti-

cal distributions of some aspects of APT. For the purpose of

approximating the distributions, the defender needs to collect

massive real APT data, which is a challenging task.

C. Optimal Control Approach

Optimal control theory, which deals with the problem of

ﬁnding a control law for a given dynamical system such that

a certain optimality criterion is achieved [27], has widespread

applications in the cybersecurity domain [28]–[31]. In the

optimal control modeling of an APT defense problem, the

defender needs only to know the average values of only a few

parameters associated with APT. In practice, estimating the

values requires much less real APT data than ﬁtting the above-

mentioned distributions does. As a matter of fact, these average

values can be estimated through APT attack-defense manoeu-

vres [32]. Therefore, the optimal control approach to APT

defense is more practical than its game-theoretic counterpart,

at the cost of achieving suboptimal solutions.

Li et al. [33] opened up the optimal control approach to APT

defense. In this article, based on a node-level epidemic model

capturing the effect of the recovery scheme on the network’s

expected state, an APT response problem is modeled as an

optimal control problem, which is solved theoretically. One

major weakness of this article is that it neglects the indispens-

able quarantine manipulations in the APT response process. In

practice, to prevent compromised systems from compromising

other systems through lateral movement, all the compromised

systems must be timely disconnected from the network.

In this article, we consider quarantine manipulations as

well as recovery manipulations in the APT response pro-

cess. Inspired by [34]–[36], we propose a node-level epidemic

model characterizing the effect of the QAR scheme on the

network’s expected state. On this basis, we reduce the QAR

problem to an optimal control problem. By comparison with

a set of heuristic QAR schemes, we ﬁnd that the QAR

scheme obtained by solving the optimality system is satis-

factory. Therefore, our model and results are more practical

than those presented in [33].

Reference [26] is related to this article. In this article, it is

assumed that the defender knows a set of functions related

to the cost for launching an APT. In practice, these func-

tions are usually unknown to the defender. In this case, the

repair scheme proposed in this article is infeasible. In the

optimal control framework adopted in this article, this demand

is removed. As a result, our quarantine and repair scheme

is more practical than the above-mentioned repair scheme.

Additionally, Yang et al. [26] neglected the necessary quar-

antine manupulations in APT response at all. In contrast, this

article takes these manipulations into full account.

III. M

ODELING OF THE QAR PROBLEM

This section is dedicated to the modeling of the QAR

problem. First, we introduce a set of terms and notations.

Second, we establish an epidemic model capturing the effect

of the QAR scheme on the expected state of the network. Next,

we estimate the expected APT impact. Finally, we model the

QAR problem as an optimal control problem. See Table I for

a complete list of the major notations introduced in this article

and their meanings.

A. Terms and Notations

Consider an organization. Let the graph G = (V, E) denote

the business relationship between the organization’s employ-

ees, where (a) V ={v

, v

,...,v

} stands for the set of all

the computer systems (nodes) used by the employees and (b)

each edge {v

, v

}∈E stands for that the employee owning the

computer system v

has business relation with the employee

owning the computer system v

.LetA = (a

)

N×N

denote

the adjacency matrix of G, i.e., a

= 1 or 0 according as

, v

}∈E or not.

Suppose the organization’s cybersecurity team (the

defender, for short) has found indicators of APT at a certain

time denoted t = 0 and will respond in the given time

horizon [0, T] by performing a series of QAR manipulations.

At any time in the response period, each and every node is

in one of three possible states: 1) uncompromised; 2) com-

promised; and 3) quarantined, where all uncompromised

and compromised nodes are on the network, all quarantined

剩余14页未读，继续阅读

weixin_38502693

粉丝: 8
资源: 908

动态隔离与恢复策略对抗高级持续威胁：优化方法与影响评估

企业IT高级威胁防护解决方案.pptx

企业IT高级威胁防护解决方案.pdf

【金蝶容器安全隔离技术】：实现应用间有效隔离的高级技巧

【J750灾难恢复计划】：未雨绸缪，制定全面恢复方案，灾难恢复的10大步骤

【灾难恢复计划】：VMware虚拟化环境的备份与恢复方案

VMware分布式交换机配置指南：网络扩展与隔离方案

网络隔离与防火墙策略：防御网络威胁的终极指南

【网神防火墙高级威胁防护】：策略对抗现代网络威胁，全面防护指南

文件系统一致性检查：磁盘修复到数据恢复的全面解决方案

多层防护策略：实现Linux防火墙与物理、虚拟隔离的高级指南

最新资源