基于ATT&CK的APT攻击语义规则构建

潘亚峰; 周天阳; 朱俊虎; 曾子懿

引用本文：

潘亚峰,周天阳,朱俊虎,曾子懿.基于ATT&CK的APT攻击语义规则构建[J].信息安全学报,2021,6(3):77-90 [点击复制]
PAN Yafeng,ZHOU Tianyang,ZHU Junhu,ZENG Ziyi.Construction of APT Attack Semantic Rules Based on ATT&CK[J].Journal of Cyber Security,2021,6(3):77-90 [点击复制]

本文已被：浏览 7808次下载 7312次	码上扫一扫！
基于ATT&CK的APT攻击语义规则构建
潘亚峰¹, 周天阳^1,2, 朱俊虎^1,2, 曾子懿^1,2
0 字体:加大+\|默认\|缩小-
(1.信息工程大学数学工程与先进计算国家重点实验室郑州中国 450001;2.国家数字交换系统工程技术研究中心郑州中国 450001)

摘要:

从自然语言描述文本中提取网络攻击知识存在语义鸿沟，导致TTPs威胁情报自动化利用低。为提高威胁情报自动分析效率，设计并实现了基于ATT&CK的APT攻击语义规则。首先，构建带标签的有向图语义规则模型，对自然语言文本描述的攻击技术进行知识化描述；其次，定义语义规则，阐释网络实体属性及其逻辑运算关系的形式化描述方法；最后，利用关键词组识别、知识抽取等自然语言处理技术，从攻击技术文本中抽取形成123个APT攻击语义规则，涵盖ATT&CK的115项技术和12种战术。利用模拟场景采集的APT攻击日志数据，对语义规则进行验证，实验结果表明，语义规则检出率达到93.1%，并具备一定的攻击上下文信息还原能力，可有效支撑威胁检测分析。

关键词: 语义规则 APT攻击 ATT&CK 威胁情报自然语言处理

DOI：10.19363/J.cnki.cn10-1380/tn.2021.05.05

投稿时间：2020-07-04修订日期：2020-09-10

基金项目:本课题得到国家自然科学基金（No.61502528）资助。

Construction of APT Attack Semantic Rules Based on ATT&CK

PAN Yafeng¹, ZHOU Tianyang^1,2, ZHU Junhu^1,2, ZENG Ziyi^1,2

(1.State Key Laboratory of Mathematical Engineering and Advanced Computing, Information & Engineering University, Zhengzhou 450001, China;2.National Engineering Technology Research Center of the National Digital Switching System, Zhengzhou 450001, China)

Abstract:

Aiming at the problem of semantic gap in the extraction of cyber attack knowledge from natural language description, which leads to low automatic utilization of tactics, techniques, and procedures (TTPs) threat intelligence, this paper designs and implements APT attacks semantic rules based on Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK). First, we construct a labeled directed graph semantic rule model to describe the attack technology of natural language description, and then define semantic rules to explain the formal description method of network entity attributes and their logical operation relation. Finally, using natural language processing techniques such as phrase recognition and knowledge extraction, 123 APT attack semantic rules were extracted from the attack technical text, covering 115 techniques and 12 tactics of ATT&CK. After experimenting on the APT attack audit data collected in the simulation scenario to verify the semantic rules, experimental results show that the detection rate of semantic rules reaches 93.1%, and has a certain ability to reconstruct the context information of the attack behavior, which can effectively contribute to threat detection and analysis.

Key words: semantic rules APT attack ATT&CK;threat intelligence natural language processing