Design for Zombie PCs and APT Attack Detection based on traffic analysis
作者： Kyungho Son , Taijin Lee , Dongho Won
DOI: 10.13089/JKIISC.2014.24.3.491
关键词:
摘要: ABSTRACT Recently, cyber terror has been occurred frequently based on ad vanced persistent threat(APT) and it is very difficult to detect these attacks because of new malwares which cannot be detected by anti-virus softwares. This paper proposes verifies the algorithms advanced threat previously through real-time network monitoring combinatorial analysis big data log. In future, APT can more e asily enhancing adapting platform. Keywords: Advanced Persistent Threat, APT, I.서 론 최근 들어, 사이버 공격은 기존 해커에 의한 호기심·자기과시 목적에서 벗어나 국가나 단체에 경제적 이익과 사회혼란을 목적으로 진화하고 있다. 발생한 ‘11년 3.4 DDoS공격,’13년 3.20 사이버테러는 공격자가 특정대상을 겨냥해 명확한 목표를 두 접수일(2013년 9월 10일), 수정일(1차: 2014년 4월 9일, 2차: 6월 12일), 게재확정일(2014년 13일)* 본 연구는 산업통상자원부 및 정보통신기술진흥센터의 산업융합원천기술개발사업(정보통신)의 일환으로 수행하였음. [10044938, 악성코드 프로파일링 대용량 보안이벤트 분석을 통한 공격징후 탐지기술 개발]†주저자, khson@kisa.or.kr‡교신저자, dhwon@security.re.kr(Corresponding author)
koreascience.or.kr参考文章(14)
Peng Ning, Yun Cui, An Intrusion Alert Correlator Based on Prerequisites of Intrusions North Carolina State University at Raleigh. ,(2002)
Oliver M. Dain, Robert K. Cunningham, Building Scenarios from a Heterogeneous Alert Stream ,(2001)
Hervé Debar, Andreas Wespi, Aggregation and Correlation of Intrusion-Detection Alerts recent advances in intrusion detection. pp. 85- 103 ,(2001) , 10.1007/3-540-45474-8_6
S. Noel, E. Robertson, S. Jajodia, Correlating intrusion events and building attack scenarios through attack graph distances annual computer security applications conference. pp. 350- 359 ,(2004) , 10.1109/CSAC.2004.11
K. Julisch, Mining alarm clusters to improve alarm handling efficiency annual computer security applications conference. pp. 12- 21 ,(2001) , 10.1109/ACSAC.2001.991517
F. Cuppens, Managing alerts in a multi-intrusion detection environment annual computer security applications conference. pp. 22- 31 ,(2001) , 10.1109/ACSAC.2001.991518
Peng Ning, Yun Cui, Douglas S. Reeves, Analyzing intensive intrusion alerts via correlation recent advances in intrusion detection. pp. 74- 94 ,(2002) , 10.1007/3-540-36084-0_5
Benjamin Morin, Ludovic Mé, Hervé Debar, Mireille Ducassé, M2D2: a formal data model for IDS alert correlation recent advances in intrusion detection. pp. 115- 137 ,(2002) , 10.1007/3-540-36084-0_7
Fu Xiao, Shi Jin, Xie Li, A Novel Data Mining-Based Method for Alert Reduction and Analysis Journal of Networks. ,vol. 5, pp. 88- 97 ,(2010) , 10.4304/JNW.5.1.88-97
Alfonso Valdes, Keith Skinner, Probabilistic Alert Correlation recent advances in intrusion detection. pp. 54- 68 ,(2001) , 10.1007/3-540-45474-8_4