| 引用本文： |
-
王笑语,龚晓锐,章秀,程子俊.多步攻击检测技术综述[J].信息安全学报,2026,11(3):192-212 [点击复制]
- WANG Xiaoyu,GONG Xiaorui,ZHANG Xiu,CHENG Zijun.A Survey of Multi-step Attack Detection[J].Journal of Cyber Security,2026,11(3):192-212 [点击复制]
|
|
| |
|
|
| 本文已被：浏览 169次 下载 152次 |
码上扫一扫！ |
| 多步攻击检测技术综述 |
|
王笑语1,2, 龚晓锐1,2, 章秀1,2, 程子俊1,2
|
|
|
| (1.中国科学院信息工程研究所 北京 中国 100093;2.中国科学院大学网络空间安全学院 北京 中国 100049) |
|
| 摘要: |
| 随着网络空间的不断发展和防御能力的不断增强,网络攻击行为变得越来越多样化和复杂化。在这种演变中,多步攻击已经成为网络攻击的主要方式之一。多步攻击是具有相同最终目标的多个原子攻击以特定逻辑序列组成的有目的的攻击。相较于单步攻击,多步攻击的时间跨度更长、隐蔽性更高、危害性更大。因此,多步攻击的检测是网络安全领域关注的重点课题。近年来,研究人员提出了大量针对多步攻击的检测技术。本文对这些研究进行了全面的梳理和总结,首先给出多步攻击的定义和特点,并列举多步攻击检测面临的挑战以及检测技术的发展阶段;随后本文从不同角度对检测技术进行了分类,根据使用的数据来源将多步攻击检测技术分为基于报警信息、基于日志关联和基于混合信息三种类型,每种数据源内,根据检测流程分为预处理、整合、关联、攻击检测四个步骤。本文从多个角度对这些检测技术进行了详细分析,系统地总结了每种类型的研究在数据集使用、实时性效果、处理步骤、是否生成关联图以及评估方法等方面的细节。最后,本文列举了可用于实验的数据集,并探讨了未来研究可能的方向。本文期望通过分析现有的多步攻击检测技术,为后续多步攻击检测研究提供有益参考。 |
| 关键词: 多步攻击 攻击检测 报警关联 溯源图 |
| DOI：10.19363/J.cnki.cn10-1380/tn.2026.05.14 |
| 投稿时间：2021-04-07修订日期：2021-06-28 |
| 基金项目:本课题得到国家自然科学基金(No.61802394,No.61902396),中国科学院战略性先导科技专项项目(No.XDC02040100)和青促会人才项目的支持,也得到中国科学院网络测评技术重点实验室和网络安全防护技术北京市重点实验室的支持。 |
|
| A Survey of Multi-step Attack Detection |
|
WANG Xiaoyu1,2, GONG Xiaorui1,2, ZHANG Xiu1,2, CHENG Zijun1,2
|
| (1.Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China;2.School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China) |
| Abstract: |
| With the continuous evolution of cyberspace and the strengthening of defensive capabilities, attack behaviors are progressively becoming more diverse and complicating. Based on these trends, multi-step attacks have emerged as a dominant modality for orchestrating cyberattacks. A multi-step attack refers to a purpose-driven action comprising multiple atomic attacks that are sequenced in a specific logical order and aimed at achieving the same ultimate goal. Compared with single-step attacks, multi-step attacks have a longer time span, heightened levels of concealment, and greater potential for damage. Consequently, the detection of multi-step attacks has become a key focus in the field of network security. In recent years, researchers have proposed a large number of detection techniques tailored to address multi-step attacks. This paper conducts a comprehensive review and synthesis of these research. The paper initiates by providing the definition and characterization of multi-step attacks. It then highlights the challenges encountered in detecting multi-step attacks and presents the developmental stages of detection techniques. Subsequently, this paper classifies the detection technology from two perspectives. Based on the data sources employed, multi-step attack detection techniques are categorized into three primary types: those grounded in alert information, those relying on log correlations, and those harnessing hybrid information. Within each data source category, techniques are further classified according to the detection process, which includes preprocessing, integration, correlation, and attack detection. This paper performs a detailed analysis of detection techniques from diverse aspects, and systematically summarizing the particulars details of each research, including elements such as the dataset employed, real-time effectiveness, position in the processing pipeline, generation of correlation graphs, and evaluation methods. Finally, this paper lists the datasets available for multi-step attack detection experimental evaluation, and explores potential directions for future research. Through analyzing the existing multi-step attack detection technologies, this paper expects to provide valuable references for the future research on multi-step attack detection. |
| Key words: multi-step attack attack detection alert correlation provenance graph |
|
|
|
|
|
