APT attack detection method and system based on ATT&CK model

Abstract

The present invention discloses an APT attack detection method, system, device and storage medium based on the ATT&CK model, including: a log collection module collects logs of various security devices and provides the logs to a YARA rule module; the YARA rule module matches the collected logs using preset YARA rules, so that the logs are marked and stored according to the tactics and techniques of ATT&CK; the APT rule module provides rules for the APT detection module, and the APT rule module is provided with rules for APT analysts to perform statistical marking weight distribution on the ATT&CK techniques used by different APT organizations; the APT detection module receives the log data matched and marked by the YARA rule module, and detects whether there is an APT attack by taking rules from the APT rule module. The present invention uses a custom preset YARA rule and adopts the matching rule of the ATT&CK label to ensure the accuracy of the source data; and in combination with the rules flexibly configured by the APT rule module, it can effectively utilize invalid logs, improve the detection rate of APT attacks, and improve the ability to discover unknown threats.

Description

Technical Field

[0001] The present invention relates to the technical field of APT attack detection, and in particular to an APT attack detection method and system based on the ATT&CK model. Background Art

[0002] APT (Advanced Persistent Threat) attacks are sophisticated and persistent cyber attacks directed at specific targets. APT attacks are usually launched by highly professional and well-organized attackers with the goal of obtaining sensitive information, stealing intellectual property, disrupting business operations or destroying critical infrastructure.

[0003] Attackers use advanced techniques and strategies to evade traditional security defense systems and maintain long-term continuous attacks. These attacks are usually divided into several stages, including penetration, persistent access, lateral movement, data collection and manipulation.

[0004] As governments, enterprises and various units pay more attention to network security, more and more security equipment is used. The detection of known APT attacks has matured, but the detection and prevention of unknown APT attacks are still relatively weak. Massive logs cannot be effectively utilized, and the detection rate of unknown APT attacks needs to be improved. Summary of the invention

[0005] In view of this, the present invention provides an APT attack detection method and system based on the ATT&CK model, so that it can detect unknown APT attacks with high detection accuracy, thereby overcoming the shortcomings of the prior art.

[0006] In a first aspect, the present invention provides an APT attack detection method based on the ATT&CK model, comprising:

[0007] The log collection module collects logs from various security devices and provides them to the YARA rule module;

[0008] The YARA rule module matches the collected logs using the preset YARA rules, so that they are labeled and stored according to the tactics and techniques of ATT&CK.

[0009] The APT rule module provides rules for the APT detection module. The APT rule module is provided with rules for APT analysts to perform statistical labeling weight allocation on the ATT&CK technologies used by different APT organizations;

[0010] The APT detection module receives the log data matched and marked by the YARA rule module, and detects whether there is an APT attack by obtaining rules from the APT rule module.

[0011] According to a specific implementation of the embodiment of the present invention, before the APT rule module provides rules for the APT detection module, it also includes:

[0012] Receive the data sent by the APT detection module and determine whether the data is in the rules of the APT rule module. If not, directly end and inform the APT detection module;

[0013] If in the rules, create or update the record data of each rule according to the data;

[0014] After recording the data, the latest rules and data are read, and the rules and data are informed to the APT detection module.

[0015] According to a specific implementation of an embodiment of the present invention, the APT detection module receives the log data matched and marked by the YARA rule module, and detects whether there is an APT attack by obtaining rules from the APT rule module, including:

[0016] The APT detection module starts to receive the log data matched and marked by the YARA rule module, stores the log data by terminal classification, and notifies the detection function to perform detection;

[0017] After the detection function gets the new data, it sends it to the APT rule module. The APT rule module returns the rules and data to the detection function. The detection function performs detection according to the data and rules returned by the APT rule module. If the APT rule module directly returns otherwise, the detection ends.

[0018] The detection function performs detection on a rule-by-rule basis according to the rules and data returned by the APT rule module, and ends the detection if the rules are not met;

[0019] The detection function compares all rule conditions. Once all are met, the APT attack is detected successfully, the data is recorded, and the detection ends;

[0020] If the detection is not successful, the semi-finished product data will be temporarily stored and the log will be tested again.

[0021] According to a specific implementation of the embodiment of the present invention, the rules set in the APT rule module are dynamically updated rules;

[0022] The labeling and storing according to the tactics and techniques of ATT&CK includes: obtaining the corresponding ATT&CK technical ID and label after labeling according to the tactics and techniques of ATT&CK, and storing it in the event alarm record;

[0023] The APT detection module receives the log data matched and marked by the YARA rule module, and detects whether there is an APT attack by obtaining rules from the APT rule module, and also includes: matching the alarm records with APT rules, and merging events with similarity reaching a threshold into an APT attack event.

[0024] According to a specific implementation of an embodiment of the present invention, in the APT rule module, the APT rule is a configurable rule, including necessary items of the rule and optional items of the rule, and is hit when the necessary items are met, or when the weights of multiple optional items exceed a set threshold.

[0025] In a second aspect, the present invention provides an APT attack detection system based on the ATT&CK model, comprising:

[0026] The log collection module is configured to collect logs of various security devices and provide the logs to the YARA rule module;

[0027] The YARA rule module is configured to match the collected logs with the preset YARA rules so that they can be labeled and stored according to the tactics and techniques of ATT&CK;

[0028] An APT rule module is configured to provide rules for the APT detection module, wherein the APT rule module is provided with rules for APT analysts to perform statistical labeling weight allocation on ATT&CK technologies used by different APT organizations;

[0029] The APT detection module is configured to receive the log data matched and marked by the YARA rule module, and to detect whether there is an APT attack by obtaining rules from the APT rule module.

[0030] According to a specific implementation of the embodiment of the present invention, before the APT rule module provides rules for the APT detection module, it also includes:

[0031] Receive the data sent by the APT detection module and determine whether the data is in the rules of the APT rule module. If not, directly end and inform the APT detection module;

[0032] If in the rules, create or update the record data of each rule according to the data;

[0033] After recording the data, the latest rules and data are read, and the rules and data are informed to the APT detection module.

[0034] According to a specific implementation of an embodiment of the present invention, the APT detection module receives the log data matched and marked by the YARA rule module, and detects whether there is an APT attack by obtaining rules from the APT rule module, including:

[0035] The APT detection module starts to receive the log data matched and marked by the YARA rule module, stores the log data by terminal classification, and notifies the detection function to perform detection;

[0036] After the detection function gets the new data, it sends it to the APT rule module. The APT rule module returns the rules and data to the detection function. The detection function performs detection according to the data and rules returned by the APT rule module. If the APT rule module directly returns otherwise, the detection ends.

[0037] The detection function performs detection on a rule-by-rule basis according to the rules and data returned by the APT rule module, and ends the detection if the rules are not met;

[0038] The detection function compares all rule conditions. Once all are met, the APT attack is detected successfully, the data is recorded, and the detection ends;

[0039] If the detection is not successful, the semi-finished product data will be temporarily stored and the log will be tested again.

[0040] In a third aspect, the present invention further provides an electronic device, the electronic device comprising:

[0041] at least one processor; and,

[0042] a memory communicatively connected to the at least one processor; wherein,

[0043] The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor executes the APT attack detection method based on the ATT&CK model as described above.

[0044] In a fourth aspect, the present invention also provides a non-transitory computer-readable storage medium, which stores computer instructions, and when the computer instructions are executed by at least one processor, the at least one processor executes the APT attack detection method based on the ATT&CK model as described above.

[0045] In a fifth aspect, the present invention also provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer executes the APT attack detection method based on the ATT&CK model in the aforementioned first aspect or any implementation of the first aspect.

[0046] By adopting the above technical solution, the present invention has at least the following beneficial effects:

[0047] By widely collecting security device logs, the present invention can effectively utilize massive amounts of invalid logs, and can discover difficult-to-prevent APT attack problems through big data. By using customized preset YARA rules and matching rules of ATT&CK tags, the accuracy of source data is guaranteed. Combined with the detection rules flexibly configured by the APT rule module, invalid logs can be effectively utilized to improve the detection rate of APT attacks, avoid the waste of massive logs, difficulty in detecting APT attacks, and improve the ability to discover unknown threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The above is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0049] Figure 1 A flowchart of an APT attack detection method based on the ATT&CK model provided by one embodiment of the present invention;

[0050] Figure 2 A schematic diagram of an APT attack detection method based on the ATT&CK model provided by one embodiment of the present invention;

[0051] Figure 3 A schematic diagram of a rule provided in one embodiment of the present invention;

[0052] Figure 4 APT rule module workflow diagram provided by one embodiment of the present invention;

[0053] Figure 5 APT detection module workflow diagram provided by one embodiment of the present invention;

[0054] Figure 6 A schematic diagram of the structure of an APT attack detection system based on the ATT&CK model provided by one embodiment of the present invention; and

[0055] Figure 7 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0057] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0058] Figure 1 A flowchart of an APT attack detection method based on the ATT&CK model provided by an embodiment of the present invention is shown; Figure 2 A schematic diagram of an APT attack detection method based on the ATT&CK model provided by an embodiment of the present invention is shown;

[0059] Cooperate Figure 1 , 2 As shown, this embodiment provides an APT attack detection method based on the ATT&CK model, including:

[0060] Step S110: The log collection module collects logs of various security devices and provides the logs to the YARA rule module.

[0061] Security equipment includes anti-virus software, behavior detection software, and network traffic monitoring equipment. Logs of each security device are collected for subsequent detection.

[0062] In step S120, the YARA rule module matches the collected logs using preset YARA rules, so that the logs are labeled and stored according to the tactics and techniques of ATT&CK.

[0063] Here, YARA rules are a powerful tool for malware detection and threat intelligence. YARA, short for “YetAnother Recursive Acronym”, is an open source rule engine for creating and applying pattern matching-based rules.

[0064] ATT&CK is a knowledge framework for threat intelligence and attack behavior. ATT&CK is the abbreviation of "Adversarial Tactics, Techniques, and Common Knowledge", which describes the various techniques and tactics used by attackers in network attacks.

[0065] Specifically, in this step, the preset YARA rules are used for matching, and the corresponding ATT&CK technology ID and label are obtained after labeling according to the tactics and techniques of ATT&CK, and then stored in the event alarm record.

[0066] by Figure 3 For example, Figure 3 A rule in this embodiment is shown. If the rule matches the operation of adding a user to the administrator using a command line in the log, the ATT&CK persistence tactic and T1098 technology are tagged.

[0067] Step S130, the APT rule module provides rules for the APT detection module, and the APT rule module is provided with rules for APT analysts to perform statistical labeling weight allocation on the ATT&CK technologies used by different APT organizations.

[0068] Here, APT rules are a set of attack techniques and tactics used by different APT organizations, and label operations such as weighting and scoring the ATT&CK techniques and tactics used according to the habits of different organizations. APT analysts are people who specialize in tracking APT organizations.

[0069] APT analysts can define characteristic rules for APT organizations based on the techniques and tactics of the ATT&CK model, and ensure the accuracy of detection by formulating rules in multiple dimensions such as technology and attack habits based on the attack methods of different organizations.

[0070] Here we take the APT organization APT29 (Cozy Bear) as an example. The tactics used by this organization in the ATT&CK model are: persistence, credential access, execution, defense evasion, and privilege escalation. The commonly used techniques are: T1078: Windows management tools, T1059: command line interface, T1112: Regsvr32, T1218: Office macros, T1003: OS startup items, T1070: dynamic link library injection, T1027: process injection, and T1005: operating system configuration changes.

[0071] 1. Based on the techniques commonly used by the APT29 organization mentioned above, the following detection rules can be formulated: tactics used, Persistence, Credential Access, Execution, Defense Evasion, and Privilege Escalation.

[0072] 2. Direct hit technologies: T1078, T1112, T1003, T1027, T1005.

[0073] 3. Technologies that may be used: T1059, T1218, T1070, T1078, T1112, T1003, T1027, T1005.

[0074] 4. Set the threshold to 70%.

[0075] 5. Set the time period.

[0076] The detection logic of this rule is: when the data meets all the conditions in rule 2, it is directly hit. When the data does not meet all the conditions in 2, but meets some of the conditions in 3, the satisfaction is judged according to the threshold, and it can be hit after the satisfaction is reached. If there is a time period, all data must be within the time period.

[0077] As can be seen from the above, APT rules are configurable rules, including necessary items of the rule (Rule 2) and optional items of the rule (Rule 3). They are hit when the necessary items are met, or when the weights of multiple optional items exceed the set threshold.

[0078] The rules set in the APT rule module are dynamically updated rules, that is, the rules can be updated and improved based on the latest discoveries.

[0079] If the APT29 rule recently discovered the use of T089's ATT&CK technology, it can be added to Rule 2 or Rule 3 in the APT29 rule based on the importance of the technology, and subsequent detection can be performed based on the modified rules.

[0080] As a preferred embodiment, Figure 4 As shown: Before the APT rule module provides rules for the APT detection module, it includes:

[0081] Step 1: The APT rule module receives the data sent by the APT detection module and determines whether the data is in the rules of the APT rule module. If not, the APT detection module is notified directly.

[0082] For example, taking the APT29 rule above as an example, if the sent data is not in rule 2 and rule 3, it will end directly.

[0083] Step 2: If in the rule, create or update the record data of each rule according to the data.

[0084] Record data storage format: A piece of data is uniquely located by the terminal and the detection rule. The main content of the data is the corresponding ATT&CK technology. When the stored data fully meets the rules, an APT attack event will be formed.

[0085] Here we still take the APT29 rule as an example. When the data tag sent is T1059, it will be stored in the record data corresponding to rule 3. If the data tag sent is T1005, it will be stored in the records corresponding to both rules 2 and 3.

[0086] Step 3: After recording the data, read the latest rules and data, and inform the APT detection module of the rules and data.

[0087] For example, if the newly arrived data is T059, it will match the rule APT29 and write the corresponding record data (if it matches other rules, it will also be written synchronously). At this time, the matched rules and recorded data will be returned to the detection module.

[0088] Next, proceed to step S140:

[0089] Step S140: The APT detection module receives the log data matched and marked by the YARA rule module, and detects whether an APT attack exists by obtaining rules from the APT rule module.

[0090] Specifically, with Figure 5 As shown, the APT detection module includes:

[0091] Step 1: The APT detection module starts to receive the log data matched and marked by the YARA rule module, stores the log data according to the terminal classification, and notifies the detection function to perform detection.

[0092] Here, since the analysis of a single log sometimes cannot directly explain the problem, the present invention classifies the logs according to the terminal, and different logs of the same terminal can be combined for judgment.

[0093] For example, this terminal first generates a log of creating a user. There is nothing wrong with this log itself. Then it generates a log of promoting this user to an administrator. There is nothing wrong with this. Finally, this user executes an operation to run a specified program. There is nothing wrong with these three steps separately. If they are connected together, it will be found that it is an event of a privileged user running a program.

[0094] Step 2: After the detection function gets the new data, it sends it to the APT rule module. The APT rule module returns the rules and data to the detection function. The detection function performs detection according to the data and rules returned by the APT rule module. If the APT rule module returns directly, the detection ends.

[0095] Here we take the APT29 rule above as an example. If the detection function obtains data with a label of T0001 technology and sends it to the APT rule module, but the APT rule module does not match the corresponding data, the APT rule module will return directly, and this round of detection will end.

[0096] Step 3: The detection function performs detection on a rule-by-rule basis according to the rules and data returned by the APT rule module, and the detection ends if the rules are not met.

[0097] Here, taking the above APT29 rule as an example, if the detection function obtains data with a label of T1078 technology and sends it to the APT rule module, the APT rule module matches the APT29 rule and writes the record data. At this time, the APT rule module will return the data to the APT detection module. At this time, the APT detection module will determine that this label belongs to Rule 2 in the APT29 rule, but there is no complete match. At this time, it will be determined as a failure and the detection will end.

[0098] If the APT rule module rules are updated, the APT detection module will directly match the logs stored by the terminal according to the new rules to see whether there are APT attack events that meet the new rules in the historical data (time-consuming). This is only done once. If the historical data exists, an APT attack event is generated.

[0099] Step 4: The detection function compares all rule conditions. Once all are met, the APT attack is detected successfully (hitting the APT attack organization), the data is recorded, and the detection ends.

[0100] Here, the alarm records are matched with APT rules, and events with similarity reaching a threshold can be combined into one APT attack event.

[0101] Here, taking the APT29 rule above as an example, if the detection function sends data with tags such as T1078, T1112, T1003, T1027, and T1005 to the APT rule module, then rule 2 in the APT29 rule will be fully matched. At this time, the detection will be judged to be successful, and the recorded data will be saved as an APT attack event.

[0102] Step 5: If the detection is not successful, temporarily store the semi-finished product data and wait for the log to be detected again.

[0103] Cooperate Figure 6 As shown, the embodiment of the present invention also provides an APT attack detection system 400 based on the ATT&CK model, including:

[0104] The log collection module 410 is used to collect logs of various security devices and provide the logs to the YARA rule module;

[0105] The YARA rule module 420 is used to match the collected logs using preset YARA rules so that the logs are marked and stored according to the tactics and techniques of ATT&CK;

[0106] APT rule module 430, used to provide rules for the APT detection module, wherein the APT rule module is provided with rules for APT analysts to perform statistical labeling weight allocation on ATT&CK technologies used by different APT organizations;

[0107] The APT detection module 440 is used to receive the log data matched and marked by the YARA rule module, and to detect whether there is an APT attack by obtaining rules from the APT rule module.

[0108] Since the above-mentioned system and method correspond to each other, they will not be described in detail here.

[0109] See also Figure 7 The embodiment of the present invention further provides an electronic device 50, the electronic device comprising:

[0110] at least one processor; and,

[0111] a memory communicatively connected to the at least one processor; wherein,

[0112] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the APT attack detection method based on the ATT&CK model in the aforementioned method embodiment.

[0113] An embodiment of the present invention also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the APT attack detection method based on the ATT&CK model in the aforementioned method embodiment.

[0114] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the APT attack detection method based on the ATT&CK model in the aforementioned method embodiment.

[0115] Reference below Figure 7, which shows a schematic diagram of the structure of an electronic device 50 suitable for implementing an embodiment of the present invention. The electronic device in the embodiment of the present invention may include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a vehicle terminal (such as a vehicle navigation terminal), and the like. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0116] like Figure 7 As shown, the electronic device 50 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 50 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0117] Typically, the following devices may be connected to the I / O interface 505: input devices 506 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 508 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 509. The communication device 509 may allow the electronic device 50 to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device 50 with various devices is shown in the figure, it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively.

[0118] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present invention are executed.

[0119] It should be noted that the computer-readable medium of the present invention can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0120] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0121] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0122] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. An APT attack detection method based on the ATT&CK model, characterized in that: include: The log collection module collects logs from various security devices and provides them to the YARA rule module; The YARA rule module matches the collected logs using the preset YARA rules, so that they are labeled and stored according to the tactics and techniques of ATT&CK. The APT rule module provides rules for the APT detection module. The APT rule module is provided with rules for APT analysts to perform statistical labeling weight distribution on the ATT&CK technologies used by different APT organizations. Before providing rules for the APT detection module, the APT rule module also includes: receiving data sent by the APT detection module and determining whether the data is in the rules of the APT rule module. If not, the APT detection module is notified directly. If it is in the rules, the record data of each rule is created or updated according to the data. The record data storage format is: a piece of data is uniquely located by the terminal and the detection rule. The main content of the data is the corresponding ATT&CK technology. When the stored data fully meets the rules, an APT attack event will be formed. After recording the data, the latest rules and data are read, and the rules and data are notified to the APT detection module. The APT detection module receives the log data matched and marked by the YARA rule module, and detects whether there is an APT attack by obtaining rules from the APT rule module, including: The APT detection module starts to receive the log data matched and marked by the YARA rule module, stores the log data by terminal classification, and notifies the detection function to perform detection; After the detection function gets the new data, it sends it to the APT rule module. The APT rule module returns the rules and data to the detection function. The detection function performs detection according to the data and rules returned by the APT rule module. If the APT rule module directly returns otherwise, the detection ends. The detection function performs detection on a rule-by-rule basis according to the rules and data returned by the APT rule module, and ends the detection if the rules are not met; The detection function compares all rule conditions. Once all are met, the APT attack is detected successfully, the data is recorded, and the detection ends; If the detection is not successful, the semi-finished product data will be temporarily stored and the log will be tested again.

2. The APT attack detection method based on the ATT&CK model according to claim 1 is characterized in that: The rules set in the APT rule module are dynamically updated rules; The labeling and storing according to the tactics and techniques of ATT&CK includes: obtaining the corresponding ATT&CK technical ID and label after labeling according to the tactics and techniques of ATT&CK, and storing it in the event alarm record; The APT detection module receives the log data matched and marked by the YARA rule module, and detects whether there is an APT attack by obtaining rules from the APT rule module, and also includes: matching the alarm records with APT rules, and merging events with similarity reaching a threshold into an APT attack event.

3. The APT attack detection method based on the ATT&CK model according to claim 1 is characterized in that: In the APT rule module, the APT rule is a configurable rule, including necessary items of the rule and optional items of the rule, and is hit when the necessary items are met, or when the weights of multiple optional items exceed a set threshold.

4. An APT attack detection system based on the ATT&CK model, characterized in that: include: The log collection module is configured to collect logs of various security devices and provide the logs to the YARA rule module; The YARA rule module is configured to match the collected logs with the preset YARA rules so that they can be labeled and stored according to the tactics and techniques of ATT&CK; The APT rule module is configured to provide rules for the APT detection module. The APT rule module is provided with rules for APT analysts to perform statistical labeling weight distribution on the ATT&CK technologies used by different APT organizations. Before providing rules for the APT detection module, the APT rule module also includes: receiving data sent by the APT detection module and determining whether the data is in the rules of the APT rule module. If not, the APT detection module is directly terminated and notified. If it is in the rules, the record data of each rule is created or updated according to the data. The record data storage format is: a piece of data is uniquely located by the terminal and the detection rule. The main content of the data is the corresponding ATT&CK technology. When the stored data fully meets the rules, an APT attack event will be formed. After recording the data, the latest rules and data are read, and the rules and data are notified to the APT detection module. The APT detection module is configured to receive the log data matched and marked by the YARA rule module, and to detect whether there is an APT attack by obtaining rules from the APT rule module, including: The APT detection module starts to receive the log data matched and marked by the YARA rule module, stores the log data by terminal classification, and notifies the detection function to perform detection; After the detection function gets the new data, it sends it to the APT rule module. The APT rule module returns the rules and data to the detection function. The detection function performs detection according to the data and rules returned by the APT rule module. If the APT rule module directly returns otherwise, the detection ends. The detection function performs detection on a rule-by-rule basis according to the rules and data returned by the APT rule module, and ends the detection if the rules are not met; The detection function compares all rule conditions. Once all are met, the APT attack is detected successfully, the data is recorded, and the detection ends; If the detection is not successful, the semi-finished product data will be temporarily stored and the log will be tested again.

5. An electronic device, characterized in that: The electronic device includes: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor executes the APT attack detection method based on the ATT&CK model as described in any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which, when executed by at least one processor, cause the at least one processor to execute the APT attack detection method based on the ATT&CK model as described in any one of claims 1 to 3.

Images