APT攻击及其防御研究

APT攻击是一种新型的网络攻击,其对国家国防安全、国民经济安全、重要行业信息安全、公司商业信息安全构成严重威胁。首先简要介绍了世界范围内发生的重大APT攻击事件,然后详细阐述了APT攻击过程,并深入研究了APT攻击与传统攻击的区别,以及APT攻击给传统信息安全防御所带来的技术和管理双重挑战。最后,深入研究了APT攻击的现有防御技术,并依据APT攻击链提出了一种针对APT攻击的防御架构。该架构完整覆盖APT攻击各个步骤环节,并考虑了管理、传统防御技术与APT防御技术的结合。

APT Attacks and Its Defense

APT(Advanced Persistent Threat) attack,as a new type of cyber attack, poses a serious threat to national defense security, national economic security, important industry information security, business information security. Firstly, this paper briefs the major events of APT attack over the world, then describes in detail the APT attack processes.In addition,the differences between APT attack and traditional attack are studied, and the double challenges of technology and management brought to traditional infosec defense by APT attack discussed. Finally, the existing defense technology against APT attack, including a defense structure based on APT attack chains is proposed. This defense structure completely covers every steps of APT attack, and the combination of management,traditional defense technology and the defense technology against APT attack is also considered.