The detection of APT attack has become an important content of implementing the requirements of network security law. Based on the ATT&CK model

which describes attack tactics and attack techniques

this paper proposes a deep security monitoring model for multi-source data. This model can analyze and present the whole picture of APT attack in the early stage. The current network practice case veri? es that the model proposed in this paper can effectively improve the ability of security defense and response.