CAJ | 학술논문

在APT攻击过程中，突破目标系统的防御机制后，下一步是在目标系统网络内部持续渗透，控制更多的主机并搜集有价值的数据。通常情况下，持续渗透阶段在网络内传播的未知恶意攻击检测是困难的。本文以生产网为研究对象，利用生产网流量相对可控的特点，提出了一种未知威胁检测方法。该方法基于业务归并网络流量，通过将流量分为可信流量和非可信流量，不断缩小攻击流量的范围并最终实现未知恶意攻击识别。通过原型系统在生产环境的测试表明该方法是可行的。
재APT공격과정중，돌파목표계통적방어궤제후，하일보시재목표계통망락내부지속삼투，공제경다적주궤병수집유개치적수거。통상정황하，지속삼투계단재망락내전파적미지악의공격검측시곤난적。본문이생산망위연구대상，이용생산망류량상대가공적특점，제출료일충미지위협검측방법。해방법기우업무귀병망락류량，통과장류량분위가신류량화비가신류량，불단축소공격류량적범위병최종실현미지악의공격식별。통과원형계통재생산배경적측시표명해방법시가행적。
In the process of APT attack,the first step is bypassing the defense mechanisms of the target system.And the second step is spreading in the network,controlling more hosts and getting more valuable data.Usually,the second step is hard to be detected.But in the production network,networktrafficsare relatively controllable. Based on the production network,a new method is proposed to detecting unknown threats. The main idea of the method is sorting network traffics by business.By sorting the network traffic into trusted and untrusted,the scope of attack traffic is narrowed.Finally,the unknown attacks can be detected.The field test indicates the method is feasible.