- 期刊
An APT Attack Detection Method Based on eBPF and Transformer
摘要
Advanced persistent threats (APTs) are a type of attack that uses advanced techniques to launch long-term and targeted network attacks against specific entities. APTs can exploit system vulnerabilities and use sophisticated and stealthy methods to evade detection by traditional means. This paper proposes an APT attack detection system based on eBPF and Transformer to address this challenge. The system leverages eBPF to efficiently collect network traffic feature data from the bottom layer of the Linux kernel network stack and then applies a Transformer-based deep learning model to identify APT attacks. The paper conducts experiments in a simulated network environment and compares the performance of the system with existing attack detection methods. The results show that the system achieves a recognition accuracy of 96.5%, has high operational efficiency, and can effectively detect APT attacks in network systems, providing a new solution to cope with such attacks.