In recent years, frequent Advanced Persistent Threat (APT) attacks have caused disastrous damage to critical facilities, leading to severe information leakages, economic losses, and even social disruptions. Via sophisticated, long-term, and stealthy network intrusions, APT attacks are often beyond the capabilities of traditional intrusion detection methods. Existing methods employ various techniques to enhance APT detection at different stages, but this makes it difficult to fairly and objectively evaluate the capability, value, and orthogonality of available techniques. Overly focusing on hardening specific APT detection stages cannot address some essential challenges from a global perspective, which would result in severe consequences. To holistically tackle this problem and explore effective solutions, we abstract a unified framework that covers the complete process of APT attack detection, with standardized summaries of state-of-the-art solutions and analysis of feasible techniques. Further, we provide an in-depth discussion of the challenges and countermeasures faced by each component of the detection framework. In addition, we comparatively analyze public datasets and outline the capability criteria to provide a reference for standardized evaluations. Finally, we discuss insights into potential areas for future research.

中文翻译：

---

高级持续性威胁检测调查：统一框架、挑战和对策


近年来，频繁的 Advanced Persistent Threat （APT） 攻击对关键设施造成了灾难性的破坏，导致了严重的信息泄露、经济损失，甚至社会动荡。通过复杂、长期和隐蔽的网络入侵，APT 攻击通常超出了传统入侵检测方法的能力范围。现有方法采用各种技术来增强不同阶段的 APT 检测，但这使得很难公平客观地评估可用技术的能力、价值和正交性。从全球角度来看，过度关注强化特定的 APT 检测阶段无法解决一些基本挑战，这将导致严重后果。为了全面解决这个问题并探索有效的解决方案，我们抽象了一个统一的框架，该框架涵盖了 APT 攻击检测的整个过程，并提供了最新解决方案的标准化摘要和可行技术的分析。此外，我们还深入讨论了检测框架的每个组件面临的挑战和对策。此外，我们比较分析了公共数据集并概述了能力标准，以为标准化评估提供参考。最后，我们讨论了对未来研究潜在领域的见解。