一种应对APT攻击的安全架构异常发现.pdfVIP

计算机研究与发展 DOI :lO. 7544/issn1000-1239. 2014. Journal of Computer Research and Development 51(7): 1633-1645 , 2014 一种应对 APT 攻击的安全架构:异常发现 杜跃进1.2 霍立东l 李 跃l 责召鹏1.3 1 (中国科学院信息工程研究所 北京 100093) 2 (国家计算机网络应急技术处理协调中心 北京 100029) 3 (北京邮电大学计算机学院 北京 100876) (zhailidong@iie. ac. cn) Security Architecture to Deal with APT Attacks: Abnormal Discovery 1 2 1 1 3 Du Yuejin • , Zhai Lidong , Li Yue , and Jia Zhaopeng 1. 1Institute 0/ In/ormation Engineering , Chinese Academy 0/ Sciences. Beijing 100093) 2 (National Computer Network Emergency Response Technical Team/Coordination Center 0/ China , Beijing 100029) 3 CSchool 0/ Com户uter Science and Technology. Beijing University 0/ Posts and Telecommunications , Beijing 100876) Abstract Threat is a potential damage to specific systems , organizations and their assets. It exists in the process of various prolonged attacks to the targets by attackers in light of their task requirement. Facing advanced persistent threat (APT) , the existing security architec~ure cannot help the victims to detect the threat in time before serious economic losses are caused. Based on the in-depth analysis of the denotation and connotation of threat , this paper explores defense models to threat in details and proposes a theoretic security and defense framework to deal with the APT: abnormal discovery , so as to solve the problem of threats detection. As the prerequisite of defensing policy and protective deployment , abnormal discovery can provide the necessary information for making an effective and targeted defensing policy through discovering the abnormal in the environment in real