Abstract: The world today is undergoing major changes unseen in a century. Cyberspace has become the fifth largest territory after land, sea, air and space. Security threats have also extended to cyberspace. There is no national security without network security. In the new era, cyberspace security has risen to the level of national security. Advanced Persistent Threat (APT) attacks are the most threatening attacks in cyberspace. They are highly harmful, highly concealed, and last long. Considering that the traceability of APT attacks has always been an extremely important part of cyberspace attack and defense, an APT attack source traceability method based on network traffic risk data clustering is proposed. First, the workflow of the proposed method is introduced. Secondly, the risk data clustering algorithm in the process is introduced in detail. Finally, the effectiveness of the proposed method is verified through experiments.
Content directory:
1 Traditional APT attack source tracing method
1.1 Traceability based on log records
1.2 Traceability based on packet marking technology
1.3 Traceability method based on active sensing data
2 Traceability method based on network traffic risk data
2.1 Traceability framework
2.2 Clustering algorithm model
2.3 Experiment
3 Conclusion
Advanced Persistent Threat (APT) attacks refer to attackers using a variety of advanced means to launch persistent, highly threatening network attacks against specific targets. It has three important characteristics: (1) Attack capabilities Strong, which reflects the A (advanced nature) aspect of APT; (2) long duration, which reflects the P (persistence) aspect of APT; (3) specific target, high degree of harm , which reflects the T (threat) aspect of APT. The initiators of such attacks often have strong political backgrounds, the attacks are highly concealed and targeted, and the victims of the attacks often suffer huge losses.
According to data disclosed in the "Global Advanced Persistent Threat (APT) 2021 Annual Report" released by Qi'anxin, the main targets of global APT attacks in 2021 include governments