Abstract: The existing attack assessment methods cannot effectively deal with the long-term concealment in APT attack. Aiming at the accurate assessment of attack behaviors in APT attack, the APT-oriented dynamic assessment of attack behaviors which focuses on both the space dimension and the time dimension is proposed. The attack behaviors are correlated in the causality-diversion among the whole network system to discover the attack paths. The attack paths are modified in the time-diversion to get the dynamic causal attack traces. The attack traces are quantified based on CVSS standard. The experimental result shows that the proposed method can correctly reflect the attack status and effectively assess the attack behavior.

Key words: APT attack, attack quantification, dynamic assessment, causal correlation