APT attack detection method and system, storage medium and electronic equipment

Abstract

The invention provides an APT attack detection method and system, a storage medium and electronic equipment, and the method comprises the steps: collecting a plurality of attack logs of known attacks, and constructing an attack subgraph according to the attack logs; performing feature enhancement on nodes in the attack sub-graph based on an attention mechanism to obtain feature vectors corresponding to the nodes, and training the initial detection model according to the feature vectors to obtain a final detection model; obtaining a to-be-detected host log, constructing a traceability graph according to the to-be-detected host log, and performing sub-graph sampling on process nodes in the traceability graph to obtain at least one target sub-graph; and performing feature enhancement on the at least one target sub-image to obtain an enhanced target feature vector, and sequentially inputting the target feature vector into the final detection model to obtain a detection result corresponding to each target sub-image. According to the invention, the accuracy and flexibility of detection can be improved, and the situation of false alarm or missing alarm is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an APT attack detection method, system, storage medium and electronic device. Background Art

[0002] As one of the main tasks in network security, attack detection aims to promptly identify and report malicious activities or security threats to computer systems, networks or applications. As large enterprise systems have been hit by security incidents one after another in recent years, the scale and complexity of these attacks have continued to increase, causing huge losses to enterprises. In order to better prevent and respond to such attacks, enterprises have begun to widely deploy security information and event management tools, such as endpoint monitoring solutions, to continuously record system-level activities as audit logs. By analyzing these audit logs, threats can be discovered early or the source can be traced and the scope of damage can be determined when a security incident occurs.

[0003] Traditional rule-based detection methods match known attack patterns through predefined rule sets. Although they are intuitive and have a low false alarm rate, they are not effective in dealing with APT attacks like the SolarWinds incident. Especially when attackers use customized tools or variants, it is difficult to update the rules in a timely manner. In addition, the cost of maintaining the rule base is high, and there is a risk of conflicts and false alarms. First, the hit of the rules depends on the quality of the rules written by security experts, and it is easy for attackers to bypass detection. If a new attack is not hit by the rules, no alarm will be generated. Secondly, because the rules need to be continuously updated and maintained, the maintenance cost is high, and there is a risk of rule conflicts and performance issues.

[0004] According to the survey, security researchers are currently actively exploring learning-based attack detection methods to address the limitations of rule-based detection. Machine learning and artificial intelligence technologies are used to analyze large amounts of data on the terminal side to automatically identify abnormal patterns and potential threats. This method has the advantages of strong adaptability, automation, processing big data, and detecting complex attacks. However, learning-based methods also have some disadvantages. First, learning-based detection methods rely on model training, and the black box training model often results in the model identifying attacks but cannot perform source analysis because learning-based methods lack interpretability. Second, in terminal-side log detection, security personnel often rely on threat intelligence for detection, but on the one hand, the quality of external threat intelligence is uneven, which will seriously affect the effect of the detection model. On the other hand, the attack behavior pattern formed by relational entity extraction of threat intelligence is coarse-grained and cannot be aligned with the terminal-side log, resulting in omissions or false positives. Summary of the invention

[0005] The purpose of the present invention is to provide an APT attack detection method, system, storage medium and electronic device, aiming to solve the problems of underreporting and false alarm in traditional technologies.

[0006] In a first aspect, the present invention provides an APT attack detection method, the method comprising:

[0007] Collect multiple attack logs of known attacks, and construct an attack subgraph {ttp1, ttp2, ttp3, ..., ttp n}, ttp n represents the attack subgraph corresponding to the nth attack log;

[0008] Based on the attention mechanism, feature enhancement is performed on the nodes in the attack subgraph to obtain feature vectors corresponding to the nodes, and an initial detection model is trained according to the feature vectors to obtain a final detection model;

[0009] Obtain the host log to be detected, and build a traceability graph according to the host log to be detected, perform subgraph sampling on the process nodes in the traceability graph, and obtain at least one target subgraph;

[0010] The at least one target sub-image is subjected to feature enhancement respectively to obtain an enhanced target feature vector, and the target feature vector is sequentially input into the final detection model to obtain a detection result corresponding to each target sub-image.

[0011] Furthermore, the step of performing feature enhancement on the nodes in the attack subgraph based on the attention mechanism to obtain feature vectors corresponding to the nodes, and training the initial detection model according to the feature vector to obtain the final detection model includes:

[0012] Feature vector enhancement is performed according to the following formula:

[0013]

[0014] Among them, h′ v is the vector representation after the attention mechanism updates, σ is the activation function, represents the sum of all neighbors j of node v, α vj represents the attention coefficient between nodes v and j, W is the weight matrix, and h j is the current representation of neighbor node j.

[0015] Furthermore, the step of obtaining the host log to be detected, constructing a traceability graph according to the host log to be detected, and performing subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph includes:

[0016] Taking each process node in the traceability graph as the center, subgraph sampling is performed within the neighborhood with a sampling radius of 5 hops.

[0017] Furthermore, the step of performing feature enhancement on the at least one target sub-graph respectively to obtain an enhanced target feature vector, and sequentially inputting the target feature vector into the final detection model to obtain a detection result corresponding to each target sub-graph comprises:

[0018] Obtain the similarity between the enhanced target feature vector and each final feature vector, and select the maximum similarity from all similarities;

[0019] Determining whether the maximum similarity is greater than or equal to a first preset similarity threshold;

[0020] If the maximum similarity is greater than or equal to a first preset similarity threshold, it is determined that the target subgraph corresponding to the enhanced target feature vector has an attack behavior;

[0021] If the maximum similarity is less than the first preset similarity threshold, it is determined that there is no attack behavior in the target subgraph corresponding to the enhanced target feature vector.

[0022] Furthermore, the step of obtaining the similarity between the enhanced target feature vector and each final feature vector, and selecting the maximum similarity from all similarities includes:

[0023] Filter out the maximum similarity according to the following formula:

[0024]

[0025] Among them, score(G) represents the enhanced target feature vector G and the i-th final feature vector ttp i The maximum similarity of similarity(·) represents the maximum similarity between the enhanced target feature vector G and the i-th final feature vector ttp i The similarity.

[0026] In a second aspect, the present invention provides an APT attack detection system, the system comprising:

[0027] The attack subgraph embedding module is used to collect multiple attack logs of known attacks and construct an attack subgraph {ttp1, ttp2, ttp3, ..., ttp n}, ttp n represents the attack subgraph corresponding to the nth attack log;

[0028] A detection model building module, used to enhance the features of the nodes in the attack subgraph based on the attention mechanism, obtain the feature vectors corresponding to the nodes, and train the initial detection model according to the feature vectors to obtain the final detection model;

[0029] A subgraph sampling module is used to obtain the log of the host to be detected, and to construct a traceability graph according to the log of the host to be detected, and to perform subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph;

[0030] The detection module is used to perform feature enhancement on the at least one target sub-image respectively to obtain an enhanced target feature vector, and input the target feature vector into the final detection model in sequence to obtain a detection result corresponding to each target sub-image.

[0031] In a third aspect, the present invention provides a storage medium, wherein the storage medium stores one or more programs, which implement the above-mentioned APT attack detection method when executed by a processor.

[0032] In a fourth aspect, the present invention provides an electronic device, the electronic device comprising a memory and a processor, wherein:

[0033] The memory is used to store computer programs;

[0034] When the processor is used to execute the computer program stored in the memory, the above-mentioned APT attack detection method is implemented.

[0035] Compared with the prior art, the present invention has the following advantages:

[0036] 1. By breaking down attacks into atomic-level attacks, the present invention can capture attack features more accurately and improve detection accuracy and flexibility. By modeling the attack detection problem as an attack subgraph matching problem, the interpretability of the model is effectively enhanced, making it easier for security personnel to conduct source tracing analysis. The IOC of threat intelligence is used to enhance the attention of the attack subgraph to solve the problem of serious false positive and false negative rates of the model.

[0037] 2. The present invention implements an enhancement mechanism by using the IOC of threat intelligence when training the model. When the nodes and edges involved in the IOC are sampled and vector embedded in the subgraph, the threat features are amplified through the attention enhancement mechanism to distinguish different attack subgraphs, which can effectively reduce the false alarm rate and missed alarm rate of subgraph matching.

[0038] 3. This paper proposes an algorithm for attack subgraph matching detection by sampling embedding vectors of process-centric subgraphs and integrating attention mechanism. Similar attack scenarios can be effectively detected through embedding, and TTP can be identified to restore attack sub-links. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A flowchart of an APT attack detection method proposed in one embodiment of the present invention;

[0040] Figure 2 This is an overall framework diagram of the APT attack detection method proposed in one embodiment of the present invention;

[0041] Figure 3 A schematic diagram of the structure of an APT attack detection system proposed in one embodiment of the present invention.

[0042] The following specific implementation manner will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0044] Regarding the technical term "provenance graph", it is a special directed graph structure used to describe and record the data flow, behavioral interaction and causal relationship in the system. It represents the interaction history and dependency relationship between entities in the system through a combination of nodes and edges. In this graph structure, nodes usually represent basic entities in the system (such as processes, files, network connections, etc.), while edges represent various interactive operations between these entities (such as reading, writing, creating, deriving, etc.). The core features of the provenance graph include its inherent temporality (capable of accurately reflecting the time sequence of events), integrity (comprehensively capturing relevant interactions at the system level) and immutability (ensuring the authenticity and reliability of the record). As a powerful data structure, the provenance graph has a wide range of applications in the field of network security, especially in intrusion detection, attack tracing, threat analysis, etc. It can help security analysts track attack chains, identify abnormal behavior patterns, reconstruct attack scenarios, and provide a reliable basis for incident response and forensic analysis. By recording and analyzing various behaviors and data flows in the system, the provenance graph makes complex security events traceable, analyzable and understandable, providing important technical support for modern network security protection systems.

[0045] Regarding the technical term "atomic attack subgraph", it is an attack behavior decomposition and representation method based on the MITRE ATT&CK framework. It decomposes complex attack behavior sequences into the smallest granularity tactics, techniques, and procedures (TTPs) units, and represents and models them through a graph structure. This method regards each attack step as an indivisible "atomic operation", and each atomic operation corresponds to a specific technology or sub-technology in the ATT&CK matrix. In the atomic attack subgraph, nodes represent specific attack techniques (such as initial access, privilege escalation, lateral movement, etc.), and edges represent the sequential relationship and dependency between attack steps. Through subgraph sampling technology, the features of these atomic attack behaviors can be extracted from the complete traceability graph. This vectorized representation not only retains the semantic information of the attack behavior, but also facilitates subsequent tasks such as similarity measurement, pattern matching, and attack detection. This representation method of atomic attack subgraph is of great significance in intrusion detection systems. It can effectively capture the behavior patterns of attackers, provide fine-grained attack feature representation, and support graph-based anomaly detection and attack identification.

[0046] like Figure 1 and Figure 2 An embodiment of the present invention provides an APT attack detection method, the method comprising steps S101 to S104, wherein:

[0047] Step S101: Collect multiple attack logs of known attacks, and construct an attack subgraph according to the attack logs;

[0048] It should be pointed out that during the training phase, the attack logs collected are sample quantities. For example, a single-step attack: a malicious file is run, and the system will recover what kind of logs it generates after the collection is completed. It can be understood that one attack behavior corresponds to one log sample. In the actual training process, there will be hundreds or thousands of samples of this level. Each attack log will correspond to a TTP number, such as T1039.001 / T1039.002 / T1040.001.

[0049] In addition, in some embodiments, the attack is reproduced by using atomic automated attack tools such as Atomic Red Team and self-developed automated attack tools separated from ATT&CK on the target range of the locally deployed collection tools. Windows implements real-time collection of process, file and registry activities based on ETW (Event Tracing for Windows), and Linux implements high-performance data filtering and log collection through eBPF (Extended Berkeley Packet Filter). The system design supports multi-threaded log collection and can achieve load balancing in a distributed environment.

[0050] Step S102: Perform feature enhancement on the nodes in the attack subgraph based on the attention mechanism to obtain feature vectors corresponding to the nodes, and train the initial detection model according to the feature vectors to obtain the final detection model;

[0051] In this step, the attack subgraph of the atomic attack log is constructed. The target range host log in JSON format is parsed into a traceability graph through script parsing. The malicious process node is sampled using the walk-along algorithm, and then the graph is embedded using the GraphSAGE algorithm.

[0052] In addition, in order to distinguish similar behaviors at different purposes or entry points, different TTP behaviors may be exhibited, which may easily generate false positives during the detection process. Therefore, the present invention introduces intelligence to enhance the attack subgraph features during model training. Specifically, this embodiment extracts IOCs from the threat intelligence text, and then uses the graph attention network to integrate the IOC information. For node v, the feature vector is enhanced according to the following formula:

[0053]

[0054] Among them, h′ v is the vector representation after the attention mechanism updates, i.e., the feature vector, σ is the activation function, represents the sum of all neighbors j of node v, α vj represents the attention coefficient between nodes v and j, W is the weight matrix, and h j is the current representation of neighbor node j.

[0055] Step S103: obtaining the host log to be detected, and constructing a traceability graph according to the host log to be detected, performing subgraph sampling on the process nodes in the traceability graph, and obtaining at least one target subgraph;

[0056] In the detection phase, in general, we first use the host log to build a traceability graph, and then use the graph sampling method of the previous attack subgraph to build a graph representation vector for the incoming process node. Then, we use the subgraph matching algorithm to perform similarity matching on all attack subgraphs. If the similarity reaches the threshold, the corresponding TTP is output, an alarm is generated, and the attack scenario display is restored.

[0057] It should be noted that the host logs to be detected obtained in the detection phase are a summary of log data collected over a long period of time. In the sub-graph sampling process, a sub-graph within 5 hops around each process is embedded, and then compared with the samples in the training phase for similarity. When the similarity reaches the threshold, the TTP number is matched, such as T1039.001.

[0058] For example, process A in the provenance graph reads file B and then generates file C. In the form of a graph, for this huge provenance graph, each process-type node, such as A here, uses a subgraph sampling algorithm to sample the neighborhood within five hops, such as A->B->C->D->E. If the neighborhood exceeds five hops, it is considered that the graph is too large and not conducive to training, so only the neighborhood within five hops is considered, thus completing the subgraph sampling.

[0059] Step S104: performing feature enhancement on the at least one target sub-image respectively to obtain an enhanced target feature vector, and inputting the target feature vector into the final detection model in sequence to obtain a detection result corresponding to each target sub-image.

[0060] It should be noted that the way to enhance the features of the target subgraph is exactly the same as the way to enhance the attack subgraph. In addition, in the detection phase, the system first calculates the similarity of the two graph vectors based on cosine similarity, and selects the K most similar TTPs through the K nearest neighbor algorithm. Finally, it determines whether to trigger an alarm based on the threshold and displays the matching attack link. The threshold here is manually adjusted based on empirical data and statistical information. For the graph to be detected, G and the TTP attack subgraph {ttp1, ttp2, ttp3, ..., ttp n}, and calculate the maximum similarity score(G).

[0061] In some embodiments, the specific process of subgraph matching is as follows:

[0062] Obtain the similarity between the enhanced target feature vector and each final feature vector, and select the maximum similarity from all similarities;

[0063] Determining whether the maximum similarity is greater than or equal to a first preset similarity threshold;

[0064] If the maximum similarity is greater than or equal to a first preset similarity threshold, it is determined that the target subgraph corresponding to the enhanced target feature vector has an attack behavior;

[0065] If the maximum similarity is less than the first preset similarity threshold, it is determined that there is no attack behavior in the target subgraph corresponding to the enhanced target feature vector.

[0066] More specifically, the maximum similarity is screened out according to the following formula:

[0067]

[0068] Among them, score(G) represents the enhanced target feature vector G and the i-th final feature vector ttp iThe maximum similarity of similarity(·) represents the maximum similarity between the enhanced target feature vector G and the i-th final feature vector ttp i The similarity.

[0069] The test results are obtained according to the following formula:

[0070] Test results AS(G):

[0071]

[0072] Finally, the attack sub-link is restored and visualized based on the detected attack behavior.

[0073] In summary, according to the above APT attack detection method, by decomposing the attack log into atomic-level single-step attacks according to the ATT&CK framework and corresponding to specific TTPs (tactics, techniques, and procedures), the attack features can be captured at the same granularity to improve the accuracy and flexibility of detection. At the same time, with the help of IOC of threat intelligence, an enhancement mechanism is implemented to effectively reduce the false alarm rate of detection. Finally, through the learning-based subgraph matching method, unknown threats can be effectively discovered and the attack sub-links can be restored.

[0074] like Figure 3 As shown, an embodiment of the present invention further provides an APT attack detection system, the system comprising:

[0075] The attack subgraph embedding module 10 is used to collect multiple attack logs of known attacks and construct an attack subgraph {ttp1, ttp2, ttp3, ..., ttp n}, ttp n represents the attack subgraph corresponding to the nth attack log;

[0076] A detection model building module 20 is used to enhance the features of the nodes in the attack subgraph based on the attention mechanism to obtain feature vectors corresponding to the nodes, and train the initial detection model according to the feature vectors to obtain the final detection model;

[0077] The subgraph sampling module 30 is used to obtain the host log to be detected, and to construct a traceability graph according to the host log to be detected, and to perform subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph;

[0078] The detection module 40 is used to perform feature enhancement on the at least one target sub-image respectively to obtain an enhanced target feature vector, and input the target feature vector into the final detection model in sequence to obtain a detection result corresponding to each target sub-image.

[0079] Another aspect of the present invention further provides a storage medium on which one or more programs are stored, and when the programs are executed by a processor, the above-mentioned APT attack detection method is implemented.

[0080] On the other hand, the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the above-mentioned APT attack detection method.

[0081] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0082] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0083] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0084] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A method for detecting APT attacks, characterized in that: The method comprises: Collect multiple attack logs of known attacks, and construct an attack subgraph {ttp1, ttp2, ttp3, ..., ttp n }, ttp n represents the attack subgraph corresponding to the nth attack log; Based on the attention mechanism, feature enhancement is performed on the nodes in the attack subgraph to obtain feature vectors corresponding to the nodes, and an initial detection model is trained according to the feature vectors to obtain a final detection model; Obtain the host log to be detected, and build a traceability graph according to the host log to be detected, perform subgraph sampling on the process nodes in the traceability graph, and obtain at least one target subgraph; The at least one target sub-image is subjected to feature enhancement respectively to obtain an enhanced target feature vector, and the target feature vector is sequentially input into the final detection model to obtain a detection result corresponding to each target sub-image.

2. The APT attack detection method according to claim 1, characterized in that: The step of performing feature enhancement on the nodes in the attack subgraph based on the attention mechanism to obtain feature vectors corresponding to the nodes, and training the initial detection model according to the feature vectors to obtain the final detection model comprises: Feature vector enhancement is performed according to the following formula: Among them, h′ v is the vector representation after the attention mechanism updates, σ is the activation function, represents the sum of all neighbors j of node v, α vj represents the attention coefficient between nodes v and j, W is the weight matrix, and h j is the current representation of neighbor node j.

3. The APT attack detection method according to claim 1, characterized in that: The steps of obtaining the host log to be detected, constructing a traceability graph according to the host log to be detected, and performing subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph include: Taking each process node in the traceability graph as the center, subgraph sampling is performed within the neighborhood with a sampling radius of 5 hops.

4. The APT attack detection method according to claim 1, characterized in that: The step of performing feature enhancement on the at least one target sub-graph to obtain an enhanced target feature vector, and sequentially inputting the target feature vector into the final detection model to obtain a detection result corresponding to each target sub-graph comprises: Obtain the similarity between the enhanced target feature vector and each final feature vector, and select the maximum similarity from all similarities; Determining whether the maximum similarity is greater than or equal to a first preset similarity threshold; If the maximum similarity is greater than or equal to a first preset similarity threshold, it is determined that the target subgraph corresponding to the enhanced target feature vector has an attack behavior; If the maximum similarity is less than the first preset similarity threshold, it is determined that there is no attack behavior in the target subgraph corresponding to the enhanced target feature vector.

5. The APT attack detection method according to claim 1, characterized in that: The steps of obtaining the similarity between the enhanced target feature vector and each final feature vector and selecting the maximum similarity from all similarities include: Filter out the maximum similarity according to the following formula: Among them, score(G) represents the enhanced target feature vector G and the i-th final feature vector ttp i The maximum similarity of similarity(·) represents the maximum similarity between the enhanced target feature vector G and the i-th final feature vector ttp i The similarity.

6. An APT attack detection system, characterized in that: The system comprises: The attack subgraph embedding module is used to collect multiple attack logs of known attacks and construct an attack subgraph {ttp1, ttp2, ttp3, ..., ttp n }, ttp n represents the attack subgraph corresponding to the nth attack log; A detection model building module, used to enhance the features of the nodes in the attack subgraph based on the attention mechanism, obtain the feature vectors corresponding to the nodes, and train the initial detection model according to the feature vectors to obtain the final detection model; A subgraph sampling module is used to obtain the log of the host to be detected, and to construct a traceability graph according to the log of the host to be detected, and to perform subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph; The detection module is used to perform feature enhancement on the at least one target sub-image respectively to obtain an enhanced target feature vector, and input the target feature vector into the final detection model in sequence to obtain a detection result corresponding to each target sub-image.

7. A storage medium, characterized in that: The storage medium stores one or more programs, which, when executed by the processor, implement the APT attack detection method according to any one of claims 1 to 5.

8. An electronic device, comprising a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, the APT attack detection method according to any one of claims 1 to 5 is implemented.

Images