A Method of Network Behavior Recognition and Attack Scenario Reconstruction for Attack Kill Chain

摘要

Currently, most successful network attacks are aimed at a particular target, composed of several attacks at different stages, and the attack is always carried out in a certain sequence, which coincides with the attack kill chain proposed by the US Army. Aiming at the typical multi-step attack type of attack kill chain, this paper proposes a hierarchical association analysis method for attack events based on directive database. By building a series of knowledge bases and using automatic means, the attack directives of key steps in the attack kill chain are reconstructed and generated, which can improve the accuracy of identifying and analyzing multi-step attack behaviors like attack kill chain.