Research on Prevention Solution of Advanced Persistent Threat

This paper analyzes the process of Google Aurora attack, summarizes the typical steps of APT attacks. By analyzing the defects on traditional enterprise security architecture, this paper proposes a new security solution with a central analysis and control module. The module adopts a detection mode based on the storage, and it is divided into storage layer, analysis layer and presentation layer. KeywordsAPT attacks; malicious website; IDS; traffic analysis; anomaly detection After Google mail servers were penetrated by advanced persistent threat(APT) attacks, the attacks occur frequently in the field of network security. APT attacks don't adopt new attack techniques and tools, but they can get confidential information by using unknown vulnerabilities of the target system and using long-lasting invasion. This paper analyzes the processes of Google Aurora attack, and then summed up the typical steps of APT attacks. By analyzing the defects of traditional enterprise security architecture against APT attacks, this paper presents a new security solution with a centralized analysis and control module. The module uses storage-based detection mode and is divided into storage layer, analysis layer and presentation layer. I. BACKGROUND OF APT ATTACKS After Google Aurora attacks in 2010, in information security field there is a new term : APT. Attack processes of the event is as follows : (1)probing the information of Google employees through social engineering. The hacker selected specific Google employees as target, and gathered relevant information from FaceBook, Twitter, LinkedIn and other social network as possible , such as employees' e-mail address , friends list, and so on. ( 2 ) the hacker created a malicious website hosting fake photos and used a dynamic DNS provider to do domain name resolution for this website . Attacked Google employees received the network link from trusted colleague, clicked on it , and entered the malicious website. The malicious web page contained JavaScript program code with shellcode which caused IE browser's buffer overflow , and then triggered the execution of FTP download program or further grabed the remote new malicious programs to execute. ( 3 ) the hacker connected the victim host via SSL secure tunnel, continued to listen and eventually gained username, password and other information of Google's servers. ( 4) Finally, the hacker used the account information of the employee to successfully penetrate into Google 's mail server. Because the mails contain a large number of privacy , confidential content, the attacks for several months caused a painful consequence[3]. The APT attacks penetrated into internal network of Google for several months, and led to a wide range of data from various systems to be stolen. Except Google, there were about 20 other well-known companies to be attacked ,such as Symantec, RSA, TrendMicro, McAfee, etc. These attacks were carefully planned by an organized crime group which aimed for a long time into these enterprise network and stole data to obtain significant economic benefits. For APT attacks, Mr. Fan Yuan ,president of Hangzhou interest Hengxin Technology Co. and vice-president of international security organization OWASP China, pointed out APT attacks are attacks with a very strong target, and are likely to become the next major attack trend. An increasing number of Internet-based business solutions and applications are developed , but the uneven quality of developers plants a lot of security risks. This year, many enterprises suffered APT attacks, causing serious consequences, causing widespread concern about the security community[1]. On different occasions in recent years, many experts expressed great concern, such as Du Yue jin , director of the National Institute of Information Technology network security, has said APT attacks do not use new technology, it's methods are constantly improved, the hacker's technology is relatively superb, enterprises are increasingly difficult to find and prevent APT attacks. From recent monitoring data , APT attacks which are detected are just a very small part, but the impact of the attack and the resulting harm are indeed great. II. TYPICAL PROCEDURE OF APT ATTACKS According to Google Aurora attacks and major APT attacks occurring in recent years, it can be summed up the typical process includes directional information collection, a single point of attack to break, the construction of control pipeline, expansion of the network penetration and uploading the collected data and other steps: A. Directional Information Collection A hacker has targeted to collect network topology of the organization and internal employees' information. There are a lot of information collection methods, including network vulnerability scanning, and social engineering, and so on. According to APT attacks currently found, the majority of APT attacks are starting from the staff in the organization, so a hacker pays much attention to internal staff, such as the 2nd International Conference on Software Engineering, Knowledge Engineering and Information Engineering (SEKEIE 2014) © 2014. The authors Published by Atlantis Press 139 D micro-blog, b order to unde and then to at engineering m network. Ne vulnerability s and vulnerab scanning tool from being fo