Survey on APT Attack Detection in Industrial Cyber-Physical System

With the gradual evolution of industrial cyber-physical system (ICPS) into an interconnected and open intelligent control system, the advanced persistent threat (APT) has turned into one of the facing important security threats of ICPS. As an important means of network security defense strategies, APT attack detection methods can find the potential intrusion attack behaviors timely. The facing attacks and security challenges of APT in ICPS are introduced firstly in this paper, and the new security solution schemes are provided to cope with APT attacks. Secondly, the main characteristics and the basic principles of APT attacks are described, and then the APT attack models are studied to understand the principle of APT attacks. Thirdly, the APT attack detection frameworks are analyzed according to the attack characteristics of APT, and the APT attack detection technologies and defense strategies are studied. Fourthly, the relevant technologies, which are feature detection, anomaly detection, traffic analysis and big data analysis, are discussed to study the effective detection methods of APT attacks. Finally, the existed problems about APT attack and defense strategies are analyzed, and the further research about APT in ICPS are discussed from the attack, detection and prediction of APT.