APT Detection and Attack Scenario Reconstruction Based on Big Data Analysis
Jue Wang · 2023
This paper firstly introduces Advanced Persistent Threat, and carries out research on the attack scenario reconstruction technique, which is the key technique for detecting Advanced Persistent Threat attacks based on big data. An alert similarity-based de-redundancy method and an SVM-based large-scale alert correlation method are designed and implemented to establish correlations for malicious attacks in the dataset. Using this method, a more intuitive and clearer intrusion attack process can be shown for network security administrators, and it is easier to understand the logical sequence of attack events. At the same time, it can realize the traceability of malicious attacks in big data, determine the source of their occurrence, and take effective preventive measures based on this.