一种无监督的窃密攻击及时发现方法

近年来，窃密攻击成为了最严重的网络安全威胁之一.除了恶意软件，人也可以成为窃密攻击的实施主体，尤其是组织或企业的内部人员.由人实施的窃密很少留下明显的异常痕迹，给真实场景中攻击的及时发现和窃密操作的分析还原带来了挑战.提出了一个方法，将每个用户视为独立的主体，通过对比用户当前行为事件与其历史正常行为的偏差检测异常，以会话为单元的检测实现了攻击发现的及时性，采用无监督算法避免了对大量带标签数据的依赖，更能适用于真实场景.对算法检测为异常的会话，进一步提出事件链构建方法，一方面还原具体窃密操作，另一方面通过与窃密攻击模式对比，更精确地判断攻击.在卡内基梅隆大学的CERT内部威胁数据集上进行了实验，结果达到99%以上的准确率，且可以做到无漏报、低误报，证明了方法的有效性和优越性.

An Unsupervised Method for Timely Exfiltration Attack Discovery

In recent years,exfiltration attacks have become one of the severest threats to cyber security.In addition to malware,human beings,especially insiders,can also become the executor of the attack.The obvious anomalous digital footprint left by an insider can be minuscule,which brings challenges to timely attack discovery and malicious operation analysis and reconstruction in real-world scenarios.To address the challenge,a method is proposed,which treats each user as an independent subject and detects the anomaly by comparing the deviation between current behavior and the normal historical behavior.We take one session as a unit to achieve timely attack discovery.We use unsupervised algorithms to avoid the need for a large number of labeled data,which is more practical to real-world scenarios.For the anomalous session detected by the algorithm,we further propose to construct event chains.On the one hand,it can restore the specific exfiltration operation;on the other hand,it can determine the attack more accurately by matching it with the exfiltration attack mode.Then,the experiments are undertaken using the public CMU CERT insider threat dataset,and the results show that the accuracy rates were more than 99%,and there were no false-negative and low false-positive,demonstrate that our method is effective and superior.