信息网络安全

信息网络安全 ›› 2020, Vol. 20 ›› Issue (4): 87-93.doi: 10.3969/j.issn.1671-1122.2020.04.011

• 理论研究 • 上一篇    下一篇

智能化网络安全威胁感知融合模型研究

赵志岩1(), 纪小默2   

  1. 1. 中国人民公安大学警务信息工程与网络安全学院,北京 100038
    2. 北京市公安局网络安全保卫总队,北京 100740
  • 收稿日期:2020-01-09 出版日期:2020-04-10 发布日期:2020-05-11
  • 通讯作者: 赵志岩 E-mail:zhaozhiyan@ppsuc.edu.cn
  • 作者简介:

    作者简介：赵志岩（1980—）,女,北京,讲师,硕士,主要研究方向为网络犯罪与取证、大数据分析;纪小默（1979—）,男,北京,本科,主要研究方向为网络安全。

  • 基金资助:
    公安部技术研究计划[2019JSYJB03];中央高校基本科研业务费专项资金[2020JKF310]

Research on the Intelligent Fusion Model of Network Security Situation Awareness

ZHAO Zhiyan1(), JI Xiaomo2   

  1. 1. School of Police Information Engineering and Network Security, People’s Public Security University of China, Beijing 100038, China
    2. Cyber Security Corps of Beijing Public Security Bureau, Beijing 100740, China
  • Received:2020-01-09 Online:2020-04-10 Published:2020-05-11
  • Contact: Zhiyan ZHAO E-mail:zhaozhiyan@ppsuc.edu.cn

RichHTML

30

PDF (PC)

292

摘要：

文章针对当前网络安全态势感知模型数据分析的深度和广度的局限性,以及协作联动能力不足等问题,提出了一种智能化网络安全威胁感知融合模型。模型采用模块化、组件化进行结构组织,包括网络安全漏洞隐患检测模块、网络安全数据预处理模块、网络安全数据要素提取模块、网络安全态势评估模块、网络安全态势预测模块及网络安全态势可视化模块,并明确了每个模块使用的技术方法。这些方法包括K-means聚类、PCA特征提取、贝叶斯网络、人工神经网络等。分析发现,模型具有持续监控、威胁预警、多重角度的可视化数据呈现、模块化与可插拔的中间件等功能,可根据不同组合的模型应用实现数据安全服务与信任评估服务,有效提升网络安全态势感知系统的监测预警能力。

关键词: 网络安全态势感知, 漏洞隐患检测, 数据预处理, 安全态势评估, 安全态势预测

Abstract:

In view of the limitation of the depth and breadth of data analysis of current network security situation awareness model, as well as the lack of logical collaboration and functional linkage, this paper proposes an intelligent fusion model of network security situation awareness, which adopts modularization and componentization to organize the structure of the model. The model contains six modules: network security vulnerability detection module, network security data preprocessing module, network security data element extraction module, network security situation analysis module, network security situation prediction module, and network security situation visualization module. And the technical details of modules are denoted in this paper, that includes K-means clustering, PCA feature extraction, Bayesian network, artificial neural network, etc. The model has the abilities of continuous monitoring, threat early warning, visual data presentation with multi angles, and the function design of modular and pluggable middleware. The model would provide data protection service and trustaccessment serviceaccording to different combination of model applications. The model could improve the monitoring and alert ability of network security situation awareness system effectively.

Key words: network security situation awareness, vulnerability detection, data preprocessing, situation analysis, situation prediction

中图分类号: