Advanced persistent threat (APT) has received broad interest in recent years. APT stands for aiming at specific goal, experienced attackers use advanced technique and take a long period of time to collect information or break the network. APT can’t be blocked through traditional ways for the incubation period always being several month even years, and the initial invasion always being too complicated to be prevented. Faced these threats, a new efficient approach should be discovered and applicated to protect our network.