Abstract: Advanced persistent threat attacks refer to long-term customized attacks on high-value targets, which will leave scattered traces on different hosts. At the same time, attackers will use various technologies to hide their actions in normal system activities, so it is difficult for analysts to observe them. In order to analyze it and take countermeasures, it is necessary to develop a new generation of threat detection and attack reconstruction tools, so that analysts can quickly determine whether there is a major intrusion, understand the process of attackers undermining system security, and determine the impact of attacks. Causality analysis is one of the most concerned methods and has strong robustness. In this paper, the advanced persistent threat attack is briefly introduced first, then the basic attack reconstruction schemes relying on causality analysis are discussed, and the threat detection and attack reconstruction schemes based on anomaly analysis, heuristic and graphic analysis methods are emphatically analyzed. The existing schemes are evaluated, and the challenges faced by the current attack reconstruction system are analyzed. Finally, the potential research directions of attack reconstruction are discussed and prospected.

Key words: attack reconstruction, causality analysis, advanced persistent threat attack, intrusion detection, threat detection

摘要： 高级持续威胁攻击指针对高价值目标发起的长期的定制攻击，会在不同主机上留下零散的痕迹，同时攻击者会使用各种技术将自己的行动隐藏在正常系统活动之中，因此难以被分析人员观测到．为了对其进行分析并采取对策，需要开发新一代的威胁检测与攻击重构工具，使分析人员能够快速确定是否有重大入侵，了解攻击者破坏系统安全的过程，并确定攻击的影响．其中因果关系分析是很受关注的一种手段，拥有较强的鲁棒性．本文首先简要介绍了高级持续威胁攻击，然后讨论了依赖因果关系分析的攻击重构基本方案，重点分析了基于异常分析、启发式和图形分析方法的威胁检测与攻击重构方案，并对现有的方案进行了评估，分析了当前攻击重构系统面临的挑战，最后对攻击重构潜在的研究方向进行了讨论和展望．

关键词: 攻击重构, 因果关系分析, 高级持续威胁攻击, 入侵检测, 威胁检测