Research on system-level origin graph design for APT attack detection

Abstract

With the rapid development of science and technology, the world has accelerated into the network information era, and the high sustained and high intensity attack and defense confrontation in cyberspace has become the new normal of the game between countries, the organization of attackers, the standardization of attack equipment, and the automation of attack methods have evolved. The research on APT attack detection has become a hot and difficult issue for academia and industry. To address these challenges, this paper proposes a system-level origin graph model for APT attack detection, analyzes and discusses the advantages and disadvantages of different granularity of origin graphs, selects a reasonable granularity of origin graph models, and focuses on multi-operating system origin graph models to determine different origin graph models for the respective characteristics of different operating system platforms, specifically, to build different entity objects, and elaborates on the technical details. The technical details are elaborated. Finally, the validity and feasibility of the system-level origin graph model are clarified to provide model support for the subsequent research on effective APT attack detection.