APT attack identification and tracing technology based on threat intelligence correlation
Zhao Yunlong,Yang Ji, Yu Yuntao, Wang Shaojie
The 6th Research Institute of China Electronics Corporation
Abstract： The form of confrontation in cyberspace is becoming more complex, with artificial intelligence, evasion, intelligence gathering, social engineering, geopolitics and more. At present, IOC characteristics of threat intelligence are mainly used to identify controlled host and C&C terminal connection behavior. In addition, we can trace the hacker organization through the association extension IOC. Based on the data of full traffic storage, backtracking and global APT threat intelligence monitoring, an APT attack identification and background traceability scheme based on IOC extended index, TTP rules and model association is proposed, which can extend the traditional detection mode based on time point to the detection mode based on historical time window, and can more fully cope with the persistence and long-term nature of APT. At the same time, it also becomes one of the effective ways to trace the background of APT organization.
Key words : full traffic; threat intelligence; IOC characteristics; TTP; association analysis
