Abstract: With the rapid development of network technology,the network world is becoming more and more fierce in attack and defense confrontation,and advanced network threat behaviors are emerging,but there are still some differences in the process description of multi-step attack behaviors in the actual operation and maintenance of the current network security analysts,which causes huge semantic communication costs.In order to solve this pain point problem in network advanced threat detection,ATT&CK network adversarial behavior framework is adopted as the unified description language of multi-step attack behavior,and a network advanced threat detection system based on event sequence association is designed and implemented,which can achieve effective detection of multi-step attack behavior through event sequence association model and visualize the presentation through ATT&CK attack matrix,which helps analysts to clarify the means,strategies and purposes of malicious attacks,and analysts can reduce attacker’s attack effect by taking corresponding defense measures through the techniques and tactics presented by the detection system.Experimental results show that the detection rate of the detection system can reach 96.43%,which is of great practical significance for analysts to solve the “defense dilemma” in network attacks.

Key words: Adversarial tactics, Techniques and common knowledge, Multi-step attack detection, Event sequence correlation, Advanced persistent threats