通信学报2026，Vol.47Issue(5)：153-170,18.DOI:10.11959/j.issn.1000-436x.TXXB260092
攻击技战术知识驱动的APT攻击路径推理方法
Attack tactics and techniques knowledge-driven APT attack path reasoning method
摘要
Abstract
Existing provenance graph-based advanced persistent threat(APT)attack detection methods mainly focues on identifying isolated attack events and fail to capture the temporal correlations and causal dependencies among multi-stage attack events.To address this issue,the problem of APT attack path reasoning was investigated,which aimed to ag-gregate related attack events belonging to the same APT campaign into a complete attack chain,and an attack tactics and techniques knowledge-driven APT attack path reasoning method was proposed.Specifically,the proposed method first constructed an anomaly subgraph containing isolated attack events through anomaly detection,attack tactics and tech-niques identification,and graph pruning,then introduced an ATT&CK-based tactic-technique sequence pattern built from threat intelligence to guide the attack path reasoning,and finally reconstructed complete APT attack chains by integrating graph search with a threat scoring mechanism.Experimental results on a simulated attack dataset collected from kernel logs and the public DARPA TC dataset demonstrate that under the premise of maintaining attack chain integrity,the pro-posed method improves the reconstruction precision by over 60％compared with existing methods.关键词
高级持续性威胁/溯源图/异常检测/攻击路径推理/ATT&CK攻击技战术Key words
advanced persistent threat/provenance graph/anomaly detection/attack path reasoning/ATT&CK attack tac-tics and techniques分类
信息技术与安全科学引用本文复制引用
吕明琪,盛起,陈铁明,朱添田,王飞..攻击技战术知识驱动的APT攻击路径推理方法[J].通信学报,2026,47(5):153-170,18.基金项目
国家自然科学基金资助项目(No.62372410,No.U22B2028) （No.62372410,No.U22B2028）
浙江省"尖兵"科技计划基金资助项目(No.2025C01013,No.2024C01066) （No.2025C01013,No.2024C01066）
杭州市重点研发计划基金资助项目(No.2024SZD0220) （No.2024SZD0220）
湖州市重点研发计划基金资助项目(No.2025ZD2037) （No.2025ZD2037）
绍兴市重点研发计划基金资助项目(No.2025B11004) The National Natural Science Foundation of China(No.62372410,No.U22B2028),The Zhejiang Province Lea-ding Goose Program(No.2025C01013,No.2024C01066),The Key Research Program of Hangzhou(No.2024SZD0220),The Key Research Program of Huzhou(No.2025ZD2037),The Key Research Program of Shaoxing(No.2025B11004) （No.2025B11004）
