TY - GEN
T1 - An APT Group Knowledge Model based on MDATA
AU - Cai, Yinyin
AU - Gu, Zhaoquan
AU - Wang, Le
AU - Li, Shudong
AU - Han, Weihong
N1 - Publisher Copyright:
© 2020 ACM.
PY - 2020/12/4
Y1 - 2020/12/4
N2 - Situational awareness is significant for cyber security, which can help researchers and security analysts obtain the network security situation comprehensively and accurately. Advanced Persistent Threat (APT) attack could cause severe consequences to cyberspace and detecting such attacks have become a very important part of cyber security situational awareness. Some APT attacks may belong to a same group, many countries and organizations have established databases for APT groups, such as adopting knowledge graph (KG) to represent the knowledge. However, cyberspace security knowledge varies by temporal and spatial characteristics, such as the attack technologies are updated very frequently, traditional KG cannot represent such knowledge timely. To address this problem, the MDATA (Multi-dimensional Data Association and inTelligent Analysis) model is proposed in [1], which is a supplement and improvement to traditional KG. In this paper, we introduce an APT group knowledge model based on MDATA, which adds spatial-temporal characteristics of the APT groups. We also analyze how this knowledge model could help address the challenges of APT attack awareness.
AB - Situational awareness is significant for cyber security, which can help researchers and security analysts obtain the network security situation comprehensively and accurately. Advanced Persistent Threat (APT) attack could cause severe consequences to cyberspace and detecting such attacks have become a very important part of cyber security situational awareness. Some APT attacks may belong to a same group, many countries and organizations have established databases for APT groups, such as adopting knowledge graph (KG) to represent the knowledge. However, cyberspace security knowledge varies by temporal and spatial characteristics, such as the attack technologies are updated very frequently, traditional KG cannot represent such knowledge timely. To address this problem, the MDATA (Multi-dimensional Data Association and inTelligent Analysis) model is proposed in [1], which is a supplement and improvement to traditional KG. In this paper, we introduce an APT group knowledge model based on MDATA, which adds spatial-temporal characteristics of the APT groups. We also analyze how this knowledge model could help address the challenges of APT attack awareness.
KW - APT attack
KW - MDATA
KW - cyber situational awareness
KW - knowledge model
KW - spatial-temporal characteristics
UR - https://www.scopus.com/pages/publications/85098934203
U2 - 10.1145/3444370.3444600
DO - 10.1145/3444370.3444600
M3 - 会议稿件
AN - SCOPUS:85098934203
T3 - ACM International Conference Proceeding Series
SP - 374
EP - 378
BT - Proceedings of the 2020 International Conference on Cyberspace Innovation of Advanced Technologies, CIAT 2020
PB - Association for Computing Machinery
T2 - 2020 International Conference on Cyberspace Innovation of Advanced Technologies, CIAT 2020
Y2 - 4 December 2020 through 6 December 2020
ER -