A Network Gene-Based Framework for Detecting Advanced Persistent Threats
A Network Gene-Based Framework for Detecting Advanced Persistent Threats
复制标题
用于检测高级持续威胁的基于网络基因的框架
DOI：
--
复制
发表时间：
2014
期刊：
影响因子：
--
通讯作者：
Zhijian Huang
中科院分区：
文献类型：
--
作者：
Y. Wang;Yongjun Wang;J. Liu;Zhijian Huang
高级持续性威胁(APT)对网络安全构成了严重威胁，其特有的高度不可预测性、隐蔽性和严重危害性使传统的网络监控技术在海量复杂的网络流量背景下面临前所未有的挑战。本文针对APT网络监控的迫切需求进行了研究。依托大数据分析和云计算技术的快速发展，借鉴生物基因的概念，提出了一种新的网络基因内涵来刻画语义丰富的网络应用行为特征模式。通过网络协议逆向分析和网络数据流处理技术的有机结合，建立了一套网络基因构建和计算的基础理论和技术架构，形成了一种新的APTS检测框架，为构建容忍入侵的网络生态环境提供支持。
Advanced Persistent Threat (APT) poses a serious threat to cyber security, and its unique high unpredictability, deep concealment and grave harmfulness make the traditional network monitoring technology facing unprecedented challenges in the background of massive and complicated network traffic. This paper aimed for the urgent demand of APT network monitoring. Relying on the rapid development of big data analysis and cloud computing technology, to draw lessons from biology gene concept, we put forward a new connotation of the network gene to depict the semantic-rich behavior characteristics pattern of network applications. Through the organic combination of network protocol reverse analysis and the network data stream processing technology, we established a set of basic theories and technical architecture of network gene construction and calculation, forming a new detection framework for APTs to support the construction of intrusion-tolerant network ecological environment.