A Novel Search Engine to Uncover Potential Victims for APT Investigations

摘要: Advanced Persistent Threats APT are sophisticated and target-oriented cyber attacks which often leverage customized malware bot control techniques to the victims for remotely accessing valuable information. As samples specific few, signature-based or learning-based approaches weak detect them. In this paper, we take a more flexible strategy: developing search engine investigators quickly uncover potential based on attributes of known victim. We test our approach in real case happened large enterprise network consisting several thousands computers run commercial antivirus system. best effort prove, can other unknown 33 infected by malware. Finally, is implemented Hadoop platform. 440GB data, it return queries 2 seconds.