关键词: APT检测, 特征提取, 特征匹配, bloom filter

Abstract: Advanced Persistent Threat（APT） is a serious threat to the world, APT detection has become the key point of network security protection. Due to the complexity of APT, the traditional detection technology cannot perform well. An APT detection method is proposed by using APT communication features extracted from international security company reports. In order to improve the detection effect of this method, an algorithm for double feature matching is put forward. The initial feature matching method uses bloom filter to filter out some messages quickly, and then the exact matching method is set up to determine whether it is APT malicious traffic. The experimental results show that the method has higher detection rate and fewer false positives.

Key words: Advanced Persistent Threat（APT） detection, feature extraction, feature matching, bloom filter