Abstract:Anadvancedpersistentthreat(APT)isanetworkattackduringwhichanunauthorizedpersonobtainsaccesstoanetworkandstaysthereundetectedforalongperiodoftime.APTattacksaredifficulttoidentifybecauseoftheircompletelyinvisibility.Inspiredbythedangertheoryinthebiologyimmunesystem

adangertheory basedreal-timeresponsemodelforAPTattacks waspresented.Someimportantdefinitionssuchasself

nonself

dangersignal

dangerantigen

antigenpresentingcellandimmunecellinthenetworkactivitiesweredefined.Thedynamicevolutionequationsofantigenpresentingcells

immunecells

andantigengenelibrarywereestablished.Thedangersignalconcentrationwasalsoused tocalculatetheantigendanger.Thetheoreticalanalysisandexperimentalresultsshowedthatthepresentedmodeleffectivelyovercomesthequantitativereal-timecalculationproblemofantigendanger

andhasmuchmoreadaptabilitythantraditionalmethodsforAPTattacksdetection.