攻击技战术知识驱动的APT攻击路径推理方法OA

Existing provenance graph-based advanced persistent threat(APT)attack detection methods mainly focues on identifying isolated attack events and fail to capture the temporal correlations and causal dependencies among multi-stage attack events.To address this issue,the problem of APT attack path reasoning was investigated,which aimed to ag-gregate related attack events belonging to the same APT campaign into a complete attack chain,and an attack tactics and techniques knowledge-driven APT attack path reasoning method was proposed.Specifically,the proposed method first constructed an anomaly subgraph containing isolated attack events through anomaly detection,attack tactics and tech-niques identification,and graph pruning,then introduced an ATT&CK-based tactic-technique sequence pattern built from threat intelligence to guide the attack path reasoning,and finally reconstructed complete APT attack chains by integrating graph search with a threat scoring mechanism.Experimental results on a simulated attack dataset collected from kernel logs and the public DARPA TC dataset demonstrate that under the premise of maintaining attack chain integrity,the pro-posed method improves the reconstruction precision by over 60％compared with existing methods.