NETWORKS & SECURITY
Xiuzhang Yang, Guojun Peng, Side Liu, Dongni Zhang, Chenguang Li, Xinyi Liu, Jianming Fu
Advanced persistent threat (APT) can use malware, vulnerabilities, and obfuscation countermeasures to launch cyber attacks against specific targets, spy and steal core information, and penetrate and damage critical infrastructure and target systems. Also, the APT attack has caused a catastrophic impact on global network security. Traditional APT attack detection is achieved by constructing rules or manual reverse analysis using expert experience, with poor intelligence and robustness. However, current research lacks a comprehensive effort to sort out the intelligent methods of APT attack detection. To this end, we summarize and review the research on intelligent detection methods for APT attacks. Firstly, we propose two APT attack intelligent detection frameworks for endpoint samples and malware, and for malware-generated audit logs. Secondly, this paper divides APT attack detection into four critical tasks: malicious attack detection, malicious family detection, malicious behavior identification, and malicious code location. In addition, we further analyze and summarize the strategies and characteristics of existing intelligent methods for each task. Finally, we look forward to the forefront of research and potential directions of APT attack detection, which can promote the development of intelligent defense against APT attacks.