APT攻击与防御
APT attacks and defenses

高级持续性威胁（advanced persistent threat，APT）逐渐演化为各种社会工程学攻击与零日漏洞利用的综合体，已成为最严重的网络空间安全威胁之一。APT以攻击基础设施、窃取敏感情报为目的，且具有强烈的国家战略意图，从而使网络安全威胁由散兵游勇式的随机攻击演化为有目的、有组织、有预谋的群体式定向攻击。近年来，APT攻击与防御已受到网络空间安全社区的持续关注，获得了长足发展与广泛应用。该文首先回顾了APT起源与发展演化过程；其次讨论了APT攻击机理与生命周期；然后探讨了APT防御体系与检测方法，归纳总结目前APT检测防御的最新技术；最后讨论了APT攻击发展趋势、APT防御存在的问题和进一步研究方向。
Abstract：Advanced persistent threats (APT) have gradually evolved into a complex of social engineering attacks and zero-day exploits as some of the most serious cyberspace security threats. APT attacks often attack infrastructure and steal sensitive information with strong national strategic interests, so that cyberspace security threats evolve from random attacks to purposeful, organized, premeditated attacks. In recent years, APT attacks and defenses have rapidly developed in the cyberspace security community. The origin and development of APTs are reviewed here with analyses of the mechanism and life cycle of APTs. Then, APT defenses and detection methods are described with problems and further research directions identified.