Ontology-Based APT Attack Detection and Defense Countermeasures

Cyberspace security has risen to the height of national strategies, represented by APT attacks, threatening important industries in various countries. In order to ensure cyberspace security, it is urgent to develop situational awareness of APT attacks. In view of the multi-step attack characteristics of APT, this paper proposes a series of questions that need to be answered in cyberspace threat situational awareness, and constructs the APT attack ontology. And through the representation and reasoning of a case, the consistency and effectiveness of the APT attack ontology are verified. It is proved that the ontology can realize the automatic correlation and reasoning of APT attack multi-source intelligence, find the weaknesses and loopholes exploited by each step of the attack, and deduce the corresponding mitigation measures. At the same time, we will find the causal relationship between various weaknesses and mitigation measures, and provide support for the auxiliary decision-making of country's cyberspace asset protection.