一种基于可信业务流的未知威胁检测方法杨大路.pdfVIP

2015.9 设计与研发 一种基于可信业务流的未知威胁检测方法 1 2 1 1 杨大路 ,范 维 ,南淑君 ,宿雅婷 （1.北京国电通网络技术有限公司,北京,100070;2国网辽宁省电力有限公司电力科学研究院,辽宁,110006) 摘要：在 APT 攻击过程中，突破目标系统的防御机制后，下一步是在目标系统网络内部持续渗透，控制更多的主机并搜集有价 值的数据。通常情况下，持续渗透阶段在网络内传播的未知恶意攻击检测是困难的。本文以生产网为研究对象，利用生产网流 量相对可控的特点，提出了一种未知威胁检测方法。该方法基于业务归并网络流量，通过将流量分为可信流量和非可信流量， 不断缩小攻击流量的范围并最终实现未知恶意攻击识别。通过原型系统在生产环境的测试表明该方法是可行的。 关键词 ：APT; 可信业务流 ; 检测方法 DOI:10.16520/j.cnki.1000-8519.2015.09.080 An unknown threat detection method based on trusted business flow 1 2 1 1 Yang Dalu ,Fan Wei ,Nan Shujun ,Su Yating （1.Beijing Guodian Network Technology Co.,Ltd.Beijing,100070 2.State Grid Electric Power Research Institute of Liaoning Province Electric Power Company Limited Liaoning,110006) Abstract ： In the process of APT attack,the first step is bypassing the defense mechanisms of the target system.And the second step is spreading in the network,controlling more hosts and getting more valuable data.Usually,the second step is hard to be detected.But in the production network,networktrafficsare relatively controllable. Based on the production network,a new method is proposed to detecting unknown threats. The main idea of the method is sorting network traffics by business.By sorting the network traffic into trusted and untrusted,the scope of attack traffic is narrowed.Finally,the unknown attacks can be detected.The field test indicates the method is feasible. Keywords ： APT; trusted business flow; detection method 0 引言 或多或少地部署了安全防护设备对系统实施安全防护。越来越