基于欺骗诱捕的高级威胁智能感知与溯源取证技术

Advanced threats seriously endanger network and even national security, and how to effectively deal with advanced threats has become the research focus and difficulty in cyber security. In this research, we attempt to solve this issue from the perspective of discovery, tracking, and attribution. Drawing on research results in multiple fields such as cyber deception, artificial intelligence, Web tracking, privacy protection and homology analysis, we intend to form an advanced threat countermeasure technology system with the abilities of discovering unknown threats intelligently, tracking known threats persistently as well as collecting evidence secretly and remotely. We will carry out the following researches. To trap potential and ongoing threats, we will build a basic network environment on basis of cyber deception technology, which includes both the real system desensitized image and ubiquitous intranet service honeypots. To actively discovery unknown threats, we will construct multi-type honey baits with file, data, service and host as the carrier, and form an intelligent adaptive honey-rich baits deployment algorithm. To act remote legal forensics, we will mining the characteristics of operating systems, file formats, application software, and network protocols, then reversely deliver forensics honey baits by taking advantage of these characteristics while threats act the espionage and intrusion. Moreover, to persistently track threats and associate attack events, we will extract multi-dimensional features of attack tools (e.g. attacker’s Web browser and malware) as advanced fingerprints, and further propose fingerprint intelligent association algorithm to overcome the fingerprint change.

高级威胁严重危害网络安全甚至国家安全，如何有效应对高级威胁已成为安全研究的重点和难点问题。本课题尝试从发现、追踪和溯源的角度，借鉴网络欺骗、人工智能、Web追踪、隐私保护、同源分析等多领域的研究成果，形成具备智能感知未知威胁、持续追踪已知威胁和远程隐蔽合法取证能力的高级威胁对抗技术体系，最终提升我国网络空间安全前瞻性预警能力和常规性威慑能力。研究内容：基于网络欺骗技术，构建包括真实业务脱敏镜像和内网泛业务蜜罐群的基础网络环境，诱捕潜在和行动中的威胁；构建以文件、数据、服务和主机为载体的多类型蜜饵，并形成智能自适应的富蜜饵部署算法，主动感知未知威胁；挖掘操作系统、文件格式、应用软件和网络协议的特性，反向利用窃密和入侵行为投递取证蜜饵，实施远程合法取证；为持续追踪威胁和关联攻击事件，在攻防两端隐蔽提取恶意代码、攻击者浏览器等工具的多维特征作为高级威胁指纹，并形成指纹智能关联算法以克服指纹扰动。

本项目面向保护重要信息系统这一实际需求，针对在高级威胁对抗过程中面临的感知未知威胁和主动溯源取证能力不足的问题，研究基于欺骗诱捕策略的高级威胁智能感知与溯源取证技术，尝试从发现、追踪和溯源取证的角度对抗高级威胁，最终目的是提升我国网络空间的前瞻性预警能力和常规性威慑能力。.项目自2020年1月开始执行至2022年12月结束，基本按照课题计划开展和推进研究工作，通过构建基础欺骗环境诱捕潜在和行动中的高级威胁，并从网络流量、主机事件、恶意代码载体、邮件行为等方面开展环境内的威胁检测；通过在欺骗环境中部署内容高度可信、具备隐蔽追踪能力的蜜饵文档感知未知威胁；通过提取攻击、关联浏览器指纹追踪高级威胁和关联攻击事件；同时还围绕与本项目密切相关的领域内研究热点开展前沿性研究，在人工智能赋能的高级威胁预测与对抗方面取得了技术成果，预测了多种隐蔽高级的恶意代码技术并提出相应的防范措施。.本项目共发表高水平学术论文22篇，包括CCF推荐列表C类及以上论文8篇，获得专利授权9篇，协助和培养博士生和硕士生各2名，相关研究成果在保密安全领域得到应用。