关键词: 高级持续性威胁（APT）, 熵, 攻击指示器（IOCs）, 逻辑表达式

Abstract: By studying the known Advanced Persistent Threat（APT） attack events deeply, this paper proposes an APT sample logic expression generation algorithm IOCG（Indicator of Compromise Generate）, and the algorithm based on the threat information sharing theory. The algorithm can automatically generate machine readable IOCs（Indicators of Compromise）, to solve that the existing IOCs logical relationship is fixed, the number of logical items unchanged, large scale and cannot generate a sample of the limitations of the expression. At the same time, it can reduce the redundancy and useless APT sample processing time consumption, and improve the sharing rate of information analysis, and actively respond to complex and volatile APT attack situation. The samples are divided into experimental set and training set, and then the algorithm is used to generate the logical expression of the training set with the IOC_Aware plug-in. The contrast expression itself is different from the detection result. The experimental results show that the algorithm is effective and can improve the detection effect.

Key words: Advanced Persistent Threat（APT）, entropy, Indicators of Compromise（IOCs）, logic expression